Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This hacker might seem shady, but throwing him in jail is bad for everyone

washingtonpost.com

Post reply on HN
Print view View original

171–180 of 213 posts

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#171

Post by victorf »

IanCal wrote: post #129
biot wrote: post #35

Everyone throws out analogies about walking into unlocked houses and such. Those are fairly poor analogies, so let me offer one which I think is far better at conveying what really happens. Imagine you walked into a public library and struck up a conversation with the librarian: You: Can you tell me general information about this library? Librarian: Certainly, this library was built in 1990, has a million books on it…

I like the librarian comparison. Perhaps a receptionist would also work for this, they can give out some information about people working there (office phone number, etc) but not salaries. > When is the onus on the web server owner to configure their security properly? When is a "200 OK" response actually not okay? This is the "mind reader" aspect the article mentions This is why the laws usually care about the inten…

I like your analogy. Exactly what crime would you be charged with after calling with SSNs? He committed thoughtcrime, sure, but let's wait until he attempts to follow through with it before charging him.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#172

Post by victorf »

msandford wrote: post #12

If you visit and internet cafe and someone's forgotten to log out of their bank account and you fiddle with it, that's probably a crime. Since in nearly all cases they probably didn't intend to do such a thing. We can surmise this by observing the banking website had a password to protect the account holder. This is evident by virtue of the "log out" link that's clearly visible and that the website is served over HTT…

That's an actual CFAA crime because you have literal unauthorized access to the laptop. No further explanation necessary.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#173

Post by victorf »

MacsHeadroom wrote: post #73
daenz wrote: post #59

Earlier quoted context omitted.

> Private property is private property Except in many cases the private property is being made accessible. Imagine going to an open house and the owner accidentally left the basement unlocked. You open the door and walk down, then get arrested for breaking and entering.

More applicably, imagine there is no door, not even hinges where a door should be; just an opening to the basement. But you get arrested for walking down there anyway. Then the police tell you you're under arrest because "The owner didn't intend for you to go there."

Both of your scenarios are inapplicable because physically entering a property is totally unlike communicating with a public machine in the way it was intended to be communicated with.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#174

Post by victorf »

IanCal wrote: post #134
bigiain wrote: post #87

Earlier quoted context omitted.

If we want to stretch analogies beyond sense, how about this. You walk into a cake shop that has cupcakes with names written on the icing: You say "Can I have a cupcake with 'Iain' written on it?" They say "200 OK, here's a cupcake with Iain on it." You say "Can I have that wedding cake?" They say "401 Unauthorized, Sorry that's someone elses' cake." You don't get a wedding cake. You say "Can I have a cupcake with 'A…

> Did you do anything wrong? Possibly, it depends on intent. Add in: You: Hahaha, guys I can get anybodies cake! You: Looool their security is awful! You: Hahah, we could short this companies stock! Then you clearly knew what you were doing and therefore did something wrong.

If knowing that you are doing something immoral makes it a crime why isn't all of Wall Street in prison?

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#175

Post by mintplant »

drdaeman wrote: post #162
IanCal wrote: post #131

Earlier quoted context omitted.

Did Weev think that the email addresses didn't count as personal information, and were perfectly fine for anybody to scrape? > If the server owner had so desired, they could have made the data private by adding a password. But the server is still just sending data in response to a request, even with a password. The only reason a password is a line we draw is intent . It's hard to say you didn't realise that guessing…

Then, it seems, a good solution to solve the problem is to have server owner to declare in advance what are intended use and what's not. Accessing information without providing the correct password is certainly unintended use, so is guessing passwords. And accessing knowing the password is definitely the intended mode of operation. A logical step is to make that machine readable. Oh, wait, suddenly this is getting to…

> Then, it seems, a good solution to solve the problem is to have server owner to declare in advance what are intended use and what's not.

You mean like the Terms of Use for the AT&T website?

http://www.att.com/gen/general?pid=11561#14

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#176

Post by victorf »

sneak wrote: post #16
austenallred wrote: post #2

Reading this article http://www.theverge.com/2013/9/12/4693710/the-end-of-kindnes... makes me feel not too terrible that he's being thrown in jail.

Weev's a right shithead, you're absolutely right. I still bailed him out of jail for the time leading up to and during his trial. Why? Because UNPOPULAR SPEECH SHOULD NEVER BE CRIMINAL, no matter how revolting. Indeed, it is the unpopular and revolting stuff that needs the most defending: "The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundr…

sneak you're one of the few "true Americans" (as in when people talk about upholding freedom above all else) and unless I remember your posts wrong, you've had to leave the country to feel free. It's truly a sad state of affairs.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#177

Post by victorf »

andrewaylett wrote: post #150
usaphp wrote: post #56

Here is my analogy: 1. You just finished your workout and went to a locker room at your gym (he went to a public website) 2. You opened up your own locker and took your stuff from it (checked his account) 3. You found out that very few people are using locks in the gym locker room (figured the account id in url ) 4. You know that it is not your belongings in other people lockers, but they are not locked just because…

How about replacing step three with "You notice that all the lockers have glass tops" and following that with a story about taking photographs?

Why would we want an analogy that more accurately reflects the reality of the situation? We're trying to justify this, not let him out on appeal.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#178

Post by Dylan16807 »

icambron wrote: post #130
Dylan16807 wrote: post #115

Earlier quoted context omitted.

>This is currently downmodded because people don't like the implication. And they shouldn't, because it quickly forces someone into either a) agreeing with the law or b) saying that SQL injections must be, ipso facto, legal. Not if you make a distinction between using a service and breaking a service. Analogize with entering vs. breaking and entering. In many cases it is valid to punish someone for bypassing security…

Tackling that out of order, because it seems clearer. > Analogize with entering vs. breaking and entering. From Free Dictionary [1]: breaking and entering v., n. entering a residence or other enclosed property through the slightest amount of force (**even pushing open a door**), without authorization. Emphasis mine. If pushing a door counts, so does changing the user agent header or auto-incrementing IDs. The key her…

>Emphasis mine. If pushing a door counts, so does changing the user agent header or auto-incrementing IDs. The key here is "without authorization".

I'm not so sure about that. If it's not pushing to request record 334, why is it pushing to request record 335?

But I digress. Normally making standard web requests is analogized to looking, without touching. You have explicit authorization to go through the front door, and anything 'bad' you did inside was restricted to what you looked at.

>I believe this use/break distinction exists, but the distinction isn't something that's determined by the code or the vaguer "design of the code"; it's determined by the purpose of the service.

But then you get into the realm of having TOS be a legal, no matter how inane they are. This seems a far worse alternative.

>To drive that home, the library's hapless database admin who foolishly decides to update the list of books using her own SQL injection bug is not hacking, because she is authorized to fiddle with the database, even though, in your terms, it's bypassing the design of the code.

That's why I only said they lose the presumption of authorization. If all you know is someone SQL injected, you have to resort to other means to figure out if it was authorized. For example, if they already have equivalent access through non-code-bug means, and they simply prefer SQL injection, then there is no problem. But if they were doing it to avoid audit logs, there might be a huge problem.

>In other words, authorization is not the same as the technical artifacts involved in authorization. More generally, I don't think being bad at making software justifies people accessing it when they know it's not meant for them.

When it comes purely to accessing it, when it's non-HIPAA/etc. data, I don't think there needs to be very much justification.

And I don't see 'has no password' as a technical artifact. Details of web servers don't need to be involved here. The design is wrong on a fundamental, user-understandable level.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#179

Post by nitrogen »

EliAndrewC wrote: post #161
nightski wrote: post #125

Earlier quoted context omitted.

Well in a private by default world, browsing the internet just became one hell of a lot scarier. Any page you visit could become a felony.

Not so, because as others in this thread have stated, the key is intent.

Judging intent doesn't really work at scale. That's why we invented access controls.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#180

Post by PhasmaFelis »

jrockway wrote: post #127
PhasmaFelis wrote: post #124

Earlier quoted context omitted.

"Not quite as clear-cut as you think, is it?" Weev did literally threaten to murder Kathy Sierra, and he then bragged about doing so on multiple public websites. So, yes, it is quite clear-cut. (And, please, at least think for a minute before you try to rebut by saying that he didn't mean it, so it shouldn't count.)

Were you at the keyboard when he was typing this message?

Why, you're right. I don't know for sure that the NSA didn't fake dozens of threatening emails from Weev, and several forum posts, and then used mind-control satellites to keep him from posting that it wasn't him or telling any of his meatspace friends that it wasn't him, and then used mind-control satellites again to make him brag in person to that reporter. Oooh, or maybe they used mind-control satellites on the reporter to make him slander Weev's good name, and MCS once more to keep all the people in the article from revealing the truth!

Give it up, man. The guy whose image you're trying to clean prefers it nice and dirty.

Post reply on HN