Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reporter likely to be charged for using “view source” feature on web browser

boingboing.net

Post reply on HN
Print view View original

81–90 of 210 posts

Re: Reporter likely to be charged for using “view source” feature on web browser

#81

Post by literallyaduck »

It was more than "View Source". It was decoding viewstate.

Reading someone's postcard in the mailbox is like looking at the source.

He opened the letter that was in the encoded viewstate.

The envelope doesn't offer any real security but it is illegal to open someone else's mail, and decoding a site's viewstate might technically be illegal as well, but unless you tell someone you did it no one will know.

The reporter should have notified them directly, anonymously, or kept their mouth shut.

If you send information to the client, it is your responsibility to make sure it doesn't contain private information.

The reporter should probably not be prosecuted, pardoned if convicted, and we should repeal the laws that make using anything sent to client illegal.

If you are sent something you didn't order in the mail the FTC says you don't have to pay:

https://www.consumer.ftc.gov/articles/what-do-if-youre-bille...

"By law, companies can’t send unordered merchandise to you, then demand payment. That means you never have to pay for things you get but didn’t order. You also don’t have to return unordered merchandise. You’re legally entitled to keep it as a free gift."

This reporter was gifted some viewstate because it came to his computer.

Edit:

To the person claiming it is "another language", I don't know anyone that does Base64 decoding in their head, and this is clearly not meant for human consumption.

Here is what viewstate is:

http://www.nullskull.com/articles/20060208.asp

There are many tools for consuming it through decoding and deserializing but that doesn't make it legal. There are tools for decoding DVDs which meet this same category.

Re: Reporter likely to be charged for using “view source” feature on web browser

#82

Post by nijave »

I think a lot of analogies miss the point that data was copied and transmitted to the client and accessed client side. I think it'd be more accurate to compare to a barcode

Imagine requesting a voter registration form and you receive a letter in the mail with all previous residents social security numbers encoded in QR codes that were added as a "convenience feature" for the voting office

In that case, it'd be ridiculous to claim you "hacked the voting office"

Re: Reporter likely to be charged for using “view source” feature on web browser

#83

Post by damagednoob »

nijave wrote: post #77

I saw in a thread somewhere else a while ago a bit more detailed explanation: The web page used an old .NET framework that serialized the application state, base64 encoded it, then dumped it in a hidden form field at the bottom. When you navigate pages, the data is POSTd back to the server to achieve a "stateless" web app on the server side The reporter had to view source and base64 decode the data Obviously still tr…

> The web page used an old .NET framework that serialized the application state, base64 encoded it, then dumped it in a hidden form field at the bottom.

Wow. I was a C# developer for many years and I never realised that ViewState encryption was _opt in_[1].

[1] https://docs.microsoft.com/en-us/previous-versions/aspnet/bb...

Re: Reporter likely to be charged for using “view source” feature on web browser

#84

Post by ethbr0 »

nijave wrote: post #77

I saw in a thread somewhere else a while ago a bit more detailed explanation: The web page used an old .NET framework that serialized the application state, base64 encoded it, then dumped it in a hidden form field at the bottom. When you navigate pages, the data is POSTd back to the server to achieve a "stateless" web app on the server side The reporter had to view source and base64 decode the data Obviously still tr…

I can't believe the defense wouldn't be able to present an expert witness / cross-examine the prosecution's on the distinctions between "encoding" and "encrypting."

Re: Reporter likely to be charged for using “view source” feature on web browser

#85

Post by jazzyjackson »

literallyaduck wrote: post #81

It was more than "View Source". It was decoding viewstate. Reading someone's postcard in the mailbox is like looking at the source. He opened the letter that was in the encoded viewstate. The envelope doesn't offer any real security but it is illegal to open someone else's mail, and decoding a site's viewstate might technically be illegal as well, but unless you tell someone you did it no one will know. The reporter…

What is this “encoded viewstate” of which you speak?

It’s my impression that the reporter didn’t have to go so far as thumbing over to the network tab or otherwise open any envelopes, the social security numbers were instead embedded in HTML, just not visible in the painted layout. Kudos for attempting a framing for the prosecution, but I don’t think there are laws against opening mail addressed to me.

Edit: just saw the comment about .net using base64 encoded state, so I understand your argument better now. In that case, if a ROT13 encrypted message was sent to me without the key, being trivial to crack doesn’t imply I have the right to share state secrets… agreed the case is a little more complicated than journalists have made it appear, go figure.

Re: Reporter likely to be charged for using “view source” feature on web browser

#86

Post by tragictrash »

literallyaduck wrote: post #81

It was more than "View Source". It was decoding viewstate. Reading someone's postcard in the mailbox is like looking at the source. He opened the letter that was in the encoded viewstate. The envelope doesn't offer any real security but it is illegal to open someone else's mail, and decoding a site's viewstate might technically be illegal as well, but unless you tell someone you did it no one will know. The reporter…

This is an incorrect assessment. The analogy is a postcard written in a language you don't understand.

The outside of the letter is a kind of lock, like encryption.

You don't violate the laws for translating the French on the back of the postcard to English if you happen to see it right?

Opening the letter is illegal, and breaking that lock is where the act becomes a crime. He didn't do that. He only translated what was delivered to him.

Re: Reporter likely to be charged for using “view source” feature on web browser

#87

Post by tragictrash »

damagednoob wrote: post #83
nijave wrote: post #77

I saw in a thread somewhere else a while ago a bit more detailed explanation: The web page used an old .NET framework that serialized the application state, base64 encoded it, then dumped it in a hidden form field at the bottom. When you navigate pages, the data is POSTd back to the server to achieve a "stateless" web app on the server side The reporter had to view source and base64 decode the data Obviously still tr…

> The web page used an old .NET framework that serialized the application state, base64 encoded it, then dumped it in a hidden form field at the bottom. Wow. I was a C# developer for many years and I never realised that ViewState encryption was _opt in_[1]. [1] https://docs.microsoft.com/en-us/previous-versions/aspnet/bb...

Someone interviewed for my company last month. One of his previous experiences was listed as "dynamic SQL". My third question was how do you prevent SQL injection attacks. He didn't know.

Re: Reporter likely to be charged for using “view source” feature on web browser

#88

Post by batch12 »

sixothree wrote: post #68
albertopv wrote: post #40

Seen from abroad USA seems like a parody of themselves, not a one particularly funny. Greatest country for greatest opportunities, still many politicians seem incredibly dumb, or ar least as dumb as italian ones, which are really really dumb, on average.

Just remember the US isn't exactly one entity, but a collection of 50 states. Still it's sad that the least educated states seem to have so much power lately.

Which states are these that should have less power than the states with the "smart" people?

Re: Reporter likely to be charged for using “view source” feature on web browser

#89

Post by tshaddox »

rchaud wrote: post #67
sgjohnson wrote: post #64

Earlier quoted context omitted.

It probably won’t even get to jury. It might get dismissed with prejudice before it goes to trial.

For a case that could potentially embarrass the state, I'd think the prosecution would try hard to make sure the case appears on the right judge's docket.

Why would it embarrass the state any more than the governor’s public comments already have?

Re: Reporter likely to be charged for using “view source” feature on web browser

#90

Post by tshaddox »

literallyaduck wrote: post #81

It was more than "View Source". It was decoding viewstate. Reading someone's postcard in the mailbox is like looking at the source. He opened the letter that was in the encoded viewstate. The envelope doesn't offer any real security but it is illegal to open someone else's mail, and decoding a site's viewstate might technically be illegal as well, but unless you tell someone you did it no one will know. The reporter…

The main difference is that the postcard is addressed to someone else and the law is very clear that you can’t open mail addressed to someone else. Also, I don’t really buy that “decoding” counts as an additional step, since all the contents of every web page are already decoded by the browser.
Post reply on HN