Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reporter may be prosecuted for using “view source”

stltoday.com

Post reply on HN
Print view View original

141–150 of 168 posts

Re: Reporter may be prosecuted for using “view source”

#141

Post by nsotelo »

smhenderson wrote: post #85
akersten wrote: post #10

We desperately need a law that says (or at least need people in power to understand that) if your server sends it (as an agent working on behalf of your interests), you decided it was ok for me to receive it! For HTTP this understanding is literally conveyed in the status code (200-OK). Once data is sent to the client, you can't say they are breaking the law by looking at it[0]. Anyone with a text-based browser would…

Powerful Hacking Tool view source Even the FBI agent quoted in the article got it wrong, stating “allowed open source tools to be used to query data that should not be public.” - as if proprietary browsers don't provide a View Source feature, only "evil" open source tools. Maybe I'm reading too much into it and it's a minor mistake but given the context even a potentially innocuous statement like that rubs me the wro…

I read this as a failure of the state for publishing information that "should not be public".

Re: Reporter may be prosecuted for using “view source”

#142

Post by wvenable »

Supermancho wrote: post #103
wvenable wrote: post #79

Earlier quoted context omitted.

Your intent by crafting such a link was clear.

Thats a third party. Youre mixing responsibility and ascribing it to an innocent party. That was the obvious point, with an incidental mention of another (random input) case where innocence is a reasonable deduction. Therefore, it is not necessary for an sql injection attack to be connected with the intent of the actor. Period. From US caselaw, theres a little history about the not chasing after infected botnet hosts…

If you commit wire fraud through an innocent intermediary, you're still guilty of wire fraud. If you give someone a link that's an attack and they unknowingly run it, then you're the one at fault not the person clicking the link.

I think it's pretty straight forward.

Re: Reporter may be prosecuted for using “view source”

#143

Post by mindslight »

underwater wrote: post #140
mindslight wrote: post #46

Earlier quoted context omitted.

It would make the most sense to define software as a legal agent of those who deploy it. If an HTTPS server prints OK and returns a document for a straightforward request, then it's manifestly obvious that the owner's agent intended to give you that information. If the owner did not intend that to happen, the issue is between them and their agent. (Think: a customer service rep who didn't follow policy) Supplying a S…

If you socially engineer an employee to access data or steal money it's still a crime.

Yes, that was my point about SQL injection. By knowingly performing an SQL injection, you're deceiving the software agent webserver. Whether you're guilty of a crime then depends on your intent for why you did that. If you do this to find and report a bug, and don't do much else with the ill-gained information, you're demonstrating good intent. If you use the information to make further compromises or otherwise profit by it, then not so much.

But in the larger scenario here the software-agent webserver was not tricked at all, making it hard to argue that the person accessing the willfully-published information did something improper regardless of their intent.

Re: Reporter may be prosecuted for using “view source”

#144

Post by dtgriscom »

chrsig wrote: post #45
kuroguro wrote: post #31

Earlier quoted context omitted.

I agree that both of those shouldn't be punished. I'm not sure how one would properly define the law tho - for ex. an SQL injection could also be "just a query parameter" and the server would haply reply with a 200.

With a sql injection, you have to willfully provide an input with the hope that it results in injection my understanding is that the reporter looked at the source that was being sent as intended -- no manipulation of input by the client

You send a query string to a server with the hopes that the server will give you what you want. Isn't that the World Wide Web?

Proving "intent" is much harder than proving action. And, to me it seems bad for the law to enforce based on whether the server's authors "wanted" to provide a specific piece of information.

Re: Reporter may be prosecuted for using “view source”

#145

Post by hoppla »

jrockway wrote: post #22
Buttons840 wrote: post #18

> “If somebody picks your lock on your house — for whatever reason, it’s not a good lock, it’s a cheap lock or whatever problem you might have — they do not have the right to go into your house and take anything that belongs to you,” Parson said. The reporter did the equivalent of noticing a lock was rusted through and barely hanging on. He poked the lock and it crumbled to pieces. He didn't take anything, he reporte…

Locks are a terrible analogy for what's going on here. This would be like the government publishing a newsletter, and then writing a bunch of teachers' social security numbers on it in invisible ink. Someone then noticed that you can still read the invisible ink, and then wrote an article about how incompetently the government managed the data. This is a simple case of an egotistical politician who wishes he was King…

The absence of locks is a good analogy. But I think a fruit welcome basket is a better one. Not only because they handed PII over to all visitors, but because the epilogue is fruity

Re: Reporter may be prosecuted for using “view source”

#146

Post by bart_spoon »

TT-392 wrote: post #33
tschwimmer wrote: post #28

Earlier quoted context omitted.

I actually like the paper analogy a lot, let's extend it: Say the journalist was instead freely handed a redacted government document on sheets of paper. The reporter notes that it was redacted poorly and the redacting can be peeled off or a bright light can be shined on it to reveal the text underneath. By doing this, is the reporter committing a crime? I have no idea. My intuition says probably not, but I think int…

If it was just in the html the website served to you, and it just basically has it written in a way that tells the browser to not display that part of the html. Wouldn't that be closer to handing a journalist a government document with some text, then a line saying: "don't read the stuff below this line", and then a bunch of sensitive stuff below that in plain text?

No, because there is a difference between “being displayed by default” and “explicitly forbidden from being viewed”. It’s closer to requesting information, and in response being handed a bunch of material, some of which is in a stack of papers and some of which is enclosed in an unsealed, unmarked envelope. It isn’t displayed by default, but it’s there, and with the most minimal of effort it’s viewable, there is nothing explaining it shouldn’t be viewed, and it’s not absurd to assume that if it was included in the bundle of information you received in response to a question, it’s fine to view.

The onus is on the person providing the information to not include it in what they provide, not the viewer to not look at information provided.

Re: Reporter may be prosecuted for using “view source”

#147

Post by zaphod4prez »

iypx wrote: post #113
trs8080 wrote: post #109

Earlier quoted context omitted.

> If your server sends it, but you never intended (sysadmin, programmer error, bureaucracy, unsecured servers etc), and it's clear for me the information was never meant to be public, then I'm committing unauthorized access. So if your server sends privileged data and I "View Source" to see how you implemented some unrelated part of your site and accidentally see that data, I'm now guilty of unauthorized access and s…

So if you left open the front door of a police station and I enter to see how an unrelated part of the building is built, and accidentally grab a gun I see on somebody's desk.. then I would most certainly expect to be prosecuted. I understand you want to punish whoever forgot to close the door, and obviously the guy who abandoned his gun, I agree... but I have no business of being there whatsoever!

There is a very big difference here. In your example, you've clearly entered into someone else's property; in the case of reading the info sent to your computer... I am reading a thing you sent me!

A more accurate version of your analogy is if I asked to hold a police officer's tazer and he handed me his gun by accident... or even if I asked to see his gun and he handed it to me thinking it was empty, but it was in fact loaded.

Point being, the website essentially put that information on my computer! I am asking for something from them, but what they give me is 100% their business! They don't have to obey my request but they do have to not-send-private-data-to-random-people-who-ask-for-it

Re: Reporter may be prosecuted for using “view source”

#148

Post by chii »

dtgriscom wrote: post #144
chrsig wrote: post #45

Earlier quoted context omitted.

With a sql injection, you have to willfully provide an input with the hope that it results in injection my understanding is that the reporter looked at the source that was being sent as intended -- no manipulation of input by the client

You send a query string to a server with the hopes that the server will give you what you want. Isn't that the World Wide Web? Proving "intent" is much harder than proving action. And, to me it seems bad for the law to enforce based on whether the server's authors "wanted" to provide a specific piece of information.

Intent is something that is considered in murder homicide cases, so why not in these cases too?

Re: Reporter may be prosecuted for using “view source”

#149

Post by Buttons840 »

smhenderson wrote: post #85
akersten wrote: post #10

We desperately need a law that says (or at least need people in power to understand that) if your server sends it (as an agent working on behalf of your interests), you decided it was ok for me to receive it! For HTTP this understanding is literally conveyed in the status code (200-OK). Once data is sent to the client, you can't say they are breaking the law by looking at it[0]. Anyone with a text-based browser would…

Powerful Hacking Tool view source Even the FBI agent quoted in the article got it wrong, stating “allowed open source tools to be used to query data that should not be public.” - as if proprietary browsers don't provide a View Source feature, only "evil" open source tools. Maybe I'm reading too much into it and it's a minor mistake but given the context even a potentially innocuous statement like that rubs me the wro…

I like to point out that the Governor installed that powerful hacking software on his own computers!

Re: Reporter may be prosecuted for using “view source”

#150

Post by trs8080 »

iypx wrote: post #113
trs8080 wrote: post #109

Earlier quoted context omitted.

> If your server sends it, but you never intended (sysadmin, programmer error, bureaucracy, unsecured servers etc), and it's clear for me the information was never meant to be public, then I'm committing unauthorized access. So if your server sends privileged data and I "View Source" to see how you implemented some unrelated part of your site and accidentally see that data, I'm now guilty of unauthorized access and s…

So if you left open the front door of a police station and I enter to see how an unrelated part of the building is built, and accidentally grab a gun I see on somebody's desk.. then I would most certainly expect to be prosecuted. I understand you want to punish whoever forgot to close the door, and obviously the guy who abandoned his gun, I agree... but I have no business of being there whatsoever!

Except in your analogy, I didn't "grab" anything -- I asked a question about paying a parking ticket at the front desk and as an answer they handed me a loaded gun. When I tried to give it back, they prosecuted me for theft.
Post reply on HN