Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You May Not Like Weev, But Your Online Freedom Depends on His Appeal

wired.com

Post reply on HN
Print view View original

71–80 of 145 posts

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#71

Post by tptacek »

walid wrote: post #70
tptacek wrote: post #63

Earlier quoted context omitted.

That first sentence doesn't make sense. If a merchant screws up and manages to post a flat ASCII text file of credit card accounts with CVV numbers on a URL in a directory with an Apache index enabled, your argument says "well, sucks for the merchant and all their customers". There are clearly cases where the mere fact that someone has left something somehow exposed to a web browser does not connote authorization to…

True when you say that there can be data left out in public by mistake without public access authorization. However it is not the responsibility of the accessing entity to preserve this data private. An analogy is if your bank left your money easily accessible on a table in front of the bank without security. We are used to the idea of ownership, but this issue is a matter of blame. Here AT&T is the one to blame for…

This is, literally, an argument that if you stumble across a text file full of credit card numbers, expiration dates, and CVV codes, it should be lawful for you to put it up on Pastebin.

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#72

Post by nicholassmith »

walid wrote: post #70
tptacek wrote: post #63

Earlier quoted context omitted.

That first sentence doesn't make sense. If a merchant screws up and manages to post a flat ASCII text file of credit card accounts with CVV numbers on a URL in a directory with an Apache index enabled, your argument says "well, sucks for the merchant and all their customers". There are clearly cases where the mere fact that someone has left something somehow exposed to a web browser does not connote authorization to…

True when you say that there can be data left out in public by mistake without public access authorization. However it is not the responsibility of the accessing entity to preserve this data private. An analogy is if your bank left your money easily accessible on a table in front of the bank without security. We are used to the idea of ownership, but this issue is a matter of blame. Here AT&T is the one to blame for…

That analogy falls over, because in it weev actually saw the money and went over and took it. That'd be a crime off the bat.

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#73

Post by antitrust »

nicholassmith wrote: post #9

I agree with the sentiment that computer use crimes need to be reworked, and that weev shouldn't have been hoisted by the fact he is a colossal dick but the article seems to gloss over things for the sake of the argument. - `The spoofing was irrelevant; Spitler would have gotten the same email addresses if he had manually inputted the URLs on an iPad rather than a spoofed desktop browser.`, the spoofing is incredibly…

Looks like proof of concept to me. The test in my mind is what gets done with those 114k addresses. Did they get leaked? No -- and the company was notified of the breech? No harm, no foul.

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#74

Post by dllthomas »

linuxhansl wrote: post #68

A few points that stuck out: * "AT&T representative testified its reputation suffered as a result of the hack" No, their reputation suffered, because they were incompetent. Ironically, without this trial I would have never heard about this. * "At sentencing, instead of hearing about the effects of the iPad “hack,” the government recounted in detail Weev’s “attitudes” towards others on the internet." That is because o…

I don't think I go as far as others here. I am not sure an open door is an invitation to dig through someone's diary; that is, even if someone is incompetent in managing their security, there should probably still be a point at which abusing that crosses a line - though I am very open to discussing just where that point is (and some liability should certainly still sit with those who deployed an insecure system).

All of that said, I wholeheartedly agree that damage to reputation (where such damage comes only from revelation of the insecurity) is the fault of the people failing to live up to their reputation, not those exposing the reality of it.

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#75

Post by walid »

vertex-four wrote: post #29
sneak wrote: post #12

Earlier quoted context omitted.

It doesn't matter if they accessed one or a million - accessing information published on the web SHOULD NOT BE CRIMINAL. Whether you agree with his methods or not, there is no stretch of the imagination that makes prison for downloading (even 114k of) them make sense. It wasn't a hole or bug— it was an expressly implemented feature. ATT decided to do it this way to reduce resubscription friction. The iPad sends the s…

So, if somebody has SSH open on port 22, root password login enabled, and a root password of Pa$$w0rd, and I guess that and log in, should that be legal? If so, what about a more complex password? Should we legalise other remote attacks on systems? It could very reasonably be argued that in the case of AT&T's system, device IDs count as passwords for accessing the system. Simplifying things a little, there was an API…

A perfect implementation of what AT&T did is this service: http://www.mailinator.com/

As you can see all emails are accessible without a password, just a username. This is what was required to get the customers' data from AT&T, serial numbers which are by definition serial and obvious to predict, just like anyone visiting http://www.mailinator.com/ would punch in their own name to see what was there and then try some other people's names.

To make Weev's access illegal there must be at least some form of security like a password that he should circumvent. That would be illegal. Placing data accessible through usernames without passwords is not an obstacle or security measure and should NOT be criminalized because it weakens the law and makes anyone a criminal.

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#76

Post by walid »

betterunix wrote: post #15
IanCal wrote: post #10

Earlier quoted context omitted.

Should I be allowed to brute force passwords then?

Yes, because organizations that use simple password-based authentication to secure important things (bank accounts, private messages, etc.) should be held responsible for the outcomes of such attacks. In such a world the state of computer security would not be so pitiful.

WRONG!

"Brute force" is literally an attack. However what AT&T did was only use the equivalent of usernames just like http://www.mailinator.com/ does.

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#77

Post by xyandnoz »

sneak wrote: post #23
stfu wrote: post #4

I, for one like Weev. He is a boundary pusher. Many even around here on hn might perceive his stuff as tasteless. But I sincerely wished more people were as dedicated to their "ideals" as Weev is. Defending free speech means standing up for people who have controversial views - no matter how unease you personally are with these views.

http://www.reddit.com/r/IAmA/comments/1ahkgc/i_am_weev_i_may... I think he's despicable, but he's also my friend if only because he is willing to do whatever is necessary to stand up for what he believes in.

Unfortunately, a big part of "what he believes in" is (to use his words) "make people afraid for their lives" and of course, "ruin lives for lulz". So, yeah, I agree he is willing to be quite bold in standing up for his right to ruin. That said, as much as I desperately want to see him behind bars for the things he has done, this AT&T conviction horrifies me, and I hope for all of our sakes he wins this appeal. And he has been right about one thing -- this IS about "embarrassing a big company". Because no law enforcement agency is willing to pursue the actual crimes he has committed against powerless individuals... the things he does to people as part of his "performance art". I have tried every way possible to justify his current conviction and sentencing. But I can't. I support #freeweev but I sure as hell don't support weev. And until/unless you and your family have been victimized by his "work", you really have no idea what he is capable of or truly believes in. -- Kathy Sierra

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#78

Post by walid »

pi18n wrote: post #20
nicholassmith wrote: post #9

I agree with the sentiment that computer use crimes need to be reworked, and that weev shouldn't have been hoisted by the fact he is a colossal dick but the article seems to gloss over things for the sake of the argument. - `The spoofing was irrelevant; Spitler would have gotten the same email addresses if he had manually inputted the URLs on an iPad rather than a spoofed desktop browser.`, the spoofing is incredibly…

If he were guessing passwords jail time might be appropriate. It's fucking ridiculous that changing the user agent, even to circumvent server "protections", would be a crime worthy of any jail time whatsoever. What is he guilty of? Criminal misrepresentation of web browser?

Mostly. Seems like AT&T is operating like http://www.mailinator.com/ where you can access anything using an ID without a password.

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#79

Post by walid »

sneak wrote: post #31
vertex-four wrote: post #29

Earlier quoted context omitted.

So, if somebody has SSH open on port 22, root password login enabled, and a root password of Pa$$w0rd, and I guess that and log in, should that be legal? If so, what about a more complex password? Should we legalise other remote attacks on systems? It could very reasonably be argued that in the case of AT&T's system, device IDs count as passwords for accessing the system. Simplifying things a little, there was an API…

Just because there's an expectation of privacy doesn't mean that such an expectation is reasonable. It is not reasonable to have an expectation of privacy if your root password is "password" and you have ssh open to the world, no.

False. There is an expectation of privacy in a public bathroom even if it doesn't specify that cameras are not allowed.

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#80

Post by phaus »

nicholassmith wrote: post #62
phaus wrote: post #61

Earlier quoted context omitted.

One of the ongoing issues in the security industry is that there is no standardized form of disclosure. There are frameworks that have been put together, but only some companies embrace them. Other companies are openly hostile towards any solution that doesn't leave the power entirely in their own hands. Basically, many large companies feel that the public should remain uninformed, which then leaves the company free…

Which is why I think there should be some attempt at a formal body, the EFF is in the right place to spearhead an attempt at implementing something along those lines.

This might be a good idea, but I surely hope that whenever a formal body is created, that it isn't a government entity.
Post reply on HN