Anyone can make a threat. There's a bit of smarts needed to classify a "threat" as credible or not. Only really a law enforcement officer can credibly bring charges against you. Unfortunately, we live in a society where someone with more money than you can use the courts to harass you, so you even if you don't fear illegitimate felony charges, you can get pretty much get sued for any reason at any time, which brings with it consequences if you don't have a lawyer to deal with it. So I understand why someone might be scared in this situation, and luckily they were able to find someone to work with them, pro bono. I really wish the law had some pro-active mechanism for dealing with this type of legal bullying.
When your classmates threaten you with felony charges
101–110 of 350 posts
Re: When your classmates threaten you with felony charges
#102[deleted]
Re: When your classmates threaten you with felony charges
#103I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here: * Fizz appears to be a client/server application (presumably a web app?) * The testing the researchers did was of software running on Fizz's servers * After identifying a vulnerability, the researchers created administrator accounts using the database activity the…
> After identifying a vulnerability, the researchers created administrator accounts using the database activity they obtained Ignoring the legalities of it all, this step crosses a line morally imo.
Really what happened is we checked whether we could set `isAdmin` to `true` on our existing accounts, and... we were able to. Adi's more technical writeup has details: https://saligrama.io/blog/post/firebase-insecure-by-default/
Re: When your classmates threaten you with felony charges
#104I don't understand why in both contracts and legal communication (particularly threatening one), there is little to no consequence for the writing party to get things right. I've seen examples of an employee contract, with things like "if any piece of this contract is invalid it doesn't invalidate the rest of the contract". The employer is basically trying to enforce their rules (reasonable), but they have no negativ…
These guys (at least according to the angry letter) went beyond reasonable safe harbor for security researchers. They created admin accounts and accessed data. Definitely not clearly false that there's no liability here. Probably actually true.
Re: When your classmates threaten you with felony charges
#105I don't understand why in both contracts and legal communication (particularly threatening one), there is little to no consequence for the writing party to get things right. I've seen examples of an employee contract, with things like "if any piece of this contract is invalid it doesn't invalidate the rest of the contract". The employer is basically trying to enforce their rules (reasonable), but they have no negativ…
That's not the language they use. It will be more like "your actions may violate (law ref) and if convicted, penalties may be up to 20 years in prison." And how do you keep people from saying that? It's basically a statement of fact. If you have a problem with this, then your issue is with Congress for writing such a vague law.
"That's not the language they used. They simply admired your place of business and reflected on what a shame it would be if a negative event happened to it. How would you keep people from saying that? It's basically a statement of fact..."
Re: When your classmates threaten you with felony charges
#106Earlier quoted context omitted.
>I would much rather get punched in the face than serve 20 years in prison, but it is illegal to threaten the former, but perfectly fine to threaten the latter. How about you don't do the action that makes you punishable with 20 years in prison? On a more practical level, if someone is breaking into your house, should it be illegal to tell them to stop, on pain of you calling the police which presumably would cause t…
No, because it would be legitimate? Just like it is legitimate to use force to stop someone from hurting you...
The threatened party did the digital equivalent of breaking in to the threateners house.
Re: When your classmates threaten you with felony charges
#107This isn't the first time a security research who's politely and confidentially disclosed a vulnerability has been threaned. There's an important lesson to glean from this. The next time someone discovers a company that has poor database security, they should, IMO: (1) make a full copy of confidential user data, (2) delete all data on the server, (3) publish confidential user data on some dumping site; and protect th…
So your solution for possibly being prosecuted for something marginal is to do several things for which it would be much more reasonable to be prosecuted? That seems like a rather unwise solution to the problem.
It's especially unwise because you now give the company a massive incentive to hire real forensics specialists to try to track you down. You're placing a lot of faith in your ability to remain anonymous under that level of scrutiny.
Re: When your classmates threaten you with felony charges
#108Interesting. My school has a very similar platform, SideChat, which I doubt is much different. Makes me wonder how much they know about me, as I was permanently banned last year for questioning the validity of "gender-affirming care."
Re: When your classmates threaten you with felony charges
#109I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here: * Fizz appears to be a client/server application (presumably a web app?) * The testing the researchers did was of software running on Fizz's servers * After identifying a vulnerability, the researchers created administrator accounts using the database activity the…
I presume that the "limb" the EFF attorney went on is basically what would've been disputed in a court of law. It's easily argued that if an app is so badly configured that just _following the Firebase protocol_ can give you write access to the database, you haven't actually circumvented any security measures, because _there weren't any to circumvent_. It reminds me of the case where AT&T had their iPad data subscrib…
What's with the _ in your sentences?
Re: When your classmates threaten you with felony charges
#110[deleted]