Live data from Hacker News

Reporter may be prosecuted for using “view source”

stltoday.com

161–168 of 168 posts

Re: Reporter may be prosecuted for using “view source”

#161
post #113

Earlier quoted context omitted.

> If your server sends it, but you never intended (sysadmin, programmer error, bureaucracy, unsecured servers etc), and it's clear for me the information was never meant to be public, then I'm committing unauthorized access. So if your server sends privileged data and I "View Source" to see how you implemented some unrelated part of your site and accidentally see that data, I'm now guilty of unauthorized access and s…

So if you left open the front door of a police station and I enter to see how an unrelated part of the building is built, and accidentally grab a gun I see on somebody's desk.. then I would most certainly expect to be prosecuted. I understand you want to punish whoever forgot to close the door, and obviously the guy who abandoned his gun, I agree... but I have no business of being there whatsoever!

We don't need to get this creative.

Say I mail a dead tree letter to the Department of Elementary and Secondary Education. And say in that letter I put a request for information on a particular teacher.

They send me a bit of a heavy envelope back. Which is a bit funny for my simple query but eh, I've gotten heavy envelopes before . The first page actually has the answer to my query, and then there seems to be a large number of pages of small print.

Normally people don't really read the small print, but today I'll do it anyway (maybe I'm suspicious due to the large packet) . What I find is that there's some normal legalese for a page or two I guess, and then on say page 5 through 100 it's actually a table with row after row of teacher's names and social security numbers. Ok, that's not good.

So the letter is addressed to me, and it landed on my doormat. It's pretty clear I'm the intended recipient.

In THAT case, I don't think it would fly for the state to go "But you were only supposed to read the first page, you were never supposed to read small print". I think that might be going a bit too far.

* If we assume the letter was printed by a computer, and

* And we assume the same knuckleheads who wrote the website also wrote the letter printing code.

Then it's not so much an analogy as it is very nearly the same thing (but now in terms a lawyer can understand, hopefully). All we've done is changed the underlying protocol and representation.

Re: Reporter may be prosecuted for using “view source”

#162
post #155
post #148

Earlier quoted context omitted.

Intent is something that is considered in murder homicide cases, so why not in these cases too?

Because murder is a crime, intent is not.

Intent to murder is now a misdemeanor… in Maryland.

Re: Reporter may be prosecuted for using “view source”

#163
post #27

What the reporter saw was the base64 encoded contents of the typical .Net "VIEWSTATE" session stuff, that looks like this: Meaning he likely just pasted the contents into a web based base64 decoder. I am totally mystified how a competent DA wouldn't have dropped this immediately.

> I am totally mystified how a competent DA wouldn't have dropped this immediately.

DAs have elections to win, and the risk of not having the governor's endorsement would put them in a tricky position.

Re: Reporter may be prosecuted for using “view source”

#165
post #160
post #157

Earlier quoted context omitted.

To differentiate between murder and manslaughter (say, due to negligence), the idea of intent (or state of mind) is taken into account.

There is nothing illegal about reading what was sent to you though.

If the data was sent as part of normal operation, then yes, it should be fine. But the post above is talking about incrementing an ID in a query, or inject SQL.

The intent of the person doing the incrementing id, or sql injection, is very much required to be taken in to consideration when considering whether it is an illegal act of computer trespass.

Re: Reporter may be prosecuted for using “view source”

#166
post #165
post #160

Earlier quoted context omitted.

There is nothing illegal about reading what was sent to you though.

If the data was sent as part of normal operation, then yes, it should be fine. But the post above is talking about incrementing an ID in a query, or inject SQL. The intent of the person doing the incrementing id, or sql injection, is very much required to be taken in to consideration when considering whether it is an illegal act of computer trespass.

Anyone can increment an ID or try to inject sql. 30 years of security practices shows white/grey hat hacking to be a good thing, and should be expected. GDPR even makes poor security finable. Cyberdefence also requires more security expertise, which can only be had from real experience.

"It's fine when the good guys do it", is poor lawmaking. So intent is hard to prove, and not very practical. It also put the blame on the accused, having to prove their innocence.

I find it interesting that people equate information breaches with murder.

Re: Reporter may be prosecuted for using “view source”

#167

"Don't look up" I watched it on Netflix last night and I can't get over how well it captures the insanity we witness on a daily basis. It's not a funny movie, it's painful to watch, but that's because it's a reflection of reality. Sure its over blown and silly in places, but it resonates so strongly with the idiocy of our time... It's a test with high specificity: If you don't get the resonance then you are part of t…

I have seen this movie referenced multiple times over the last several days and all I can say is, while I understand the points that McKay is trying to make, it's not funny because it's not funny and it's hardly insightful because it totally lacks any nuance and isn't particularly original. How long ago was Stephen Colbert synonymous with "dumb conservative"? Trying to claim that if you don't resonate with a film the…

and not a mistake imo.

Re: Reporter may be prosecuted for using “view source”

#168
post #158

Earlier quoted context omitted.

> wouldn't an expert be consulted?? All the prosecutes need is an expert that says "Base64 is an encryption. Sending data encrypted means they don't want you to read it.. they tried to break encryption and succeeded when they werent supposed to" And then just fear-monger the risk of broken encryption and government and how you have to try to break it and its dangerous or something. Lots of people claim to be experts,…

Base64 is a well-known plain-text encoding format. Using it as an encryption format violates privacy laws.

You sure the courts will know that if an "expert" paid by the state says otherwise?
Post reply on HN