Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stunnel and Airline Wi-Fi

potatofrom.space

Post reply on HN
Print view View original

191–200 of 239 posts

Re: Stunnel and Airline Wi-Fi

#191

Post by bspammer »

gpvos wrote: post #87
Pneumaticat wrote: post #19

Earlier quoted context omitted.

A good point. To be fair, though, even Lifehacker has posted a similar writeup [1] (linked in the article) and I don't think they've been threatened. Getting caught in the air - now, that's a different story ;) [1]: https://lifehacker.com/get-free-unlimited-wi-fi-on-flights-a...

Getting caught in the air seems nigh impossible, since by using this trick you aren't giving them any way to identify you.

They'd have your stunnel server IP, so if they were really, really determined they could probably track you down by forcing your ISP/VPS provider to identify you.

I doubt they'd bother for $45 worth of WiFi, but personally I would err on the side of caution.

Re: Stunnel and Airline Wi-Fi

#192

Post by PaulAJ »

418tpot wrote: post #106
kemitche wrote: post #44

Earlier quoted context omitted.

It's not nuts when compared to non-tech laws. It's illegal to come into my house and take my stuff even if I forget to lock my back door. If we want to protect security professionals, we should write laws that do so.

The path between two cities is privately owned and the owner charges people to walk through it. There is a side gate for bathroom access. This is akin to going up to the gate and telling the owner "I'm just here to use the bathroom" (sni:viasat) and then after going through the gate just continuing to the other city. Sure it's illegal, but hardly worth 5 years and I doubt there's a judge who would give more than comm…

> I doubt there's a judge who would give more than community service for a stunt like this.

Trouble is, the judge doesn't get to decide. Judges have to follow the federal sentencing guidelines. These can produce some bizzare results. https://www.eff.org/deeplinks/2013/03/41-months-weev-underst...

Re: Stunnel and Airline Wi-Fi

#193

Post by debatem1 »

PaulAJ wrote: post #25

In the USA this would be a violation of the CFAA https://www.law.cornell.edu/uscode/text/18/1030 . Specifically, the router is a "protected computer" and the procedure described here is "exceeding authorised access" because it routes packets around a mechanism that was designed to stop them. Maximum penalty 5 years. (Some might argue that it was authorised because the computer let him do it. However the CFAA simply d…

Criminally charging someone under the CFAA for what is essentially a TOS violation has come under fire before, and frankly I don't think many prosecutors want to be the one to get that legal theory thrown out.

Re: Stunnel and Airline Wi-Fi

#194

Post by adrianmonk »

eslaught wrote: post #95
novok wrote: post #86

Earlier quoted context omitted.

You could say the same about adblock then, so lets not open that can of worms

Is it though? The adblocker runs locally on your own computer; it certainly prevents the ads from doing what the designer intended, but it doesn't make the designer's computer (or any computer controlled by the ad network) do anything. Versus tracking does actually do something on your computer (e.g. running JS to discover fonts). Arguably that is a circumvention of the intentions of the user on their own hardware.

You can't look at the legality of it from the point of what the adblocker does. Software doesn't commit crimes; people do.

The possible crime (if it is one) would be if you know your browser has adblock, you know authorization to use their server is conditional on not using adblock, and you choose to access it anyway.

Re: Stunnel and Airline Wi-Fi

#195

Post by Forge36 »

liability wrote: post #190
Forge36 wrote: post #90

Earlier quoted context omitted.

It's not victimless, the loser is the service provider whose bandwidth is consumed. The line many draw is that corporations aren't people and can't be the victim, this is a false analogy. Thus: let's switch who is penalized: everyone else on the flight. Bandwidth isn't unlimited, without payment it's hard to justify increasing bandwidth if it isn't profitable. What should the author do? Report it. If he didn't, maybe…

> "Thus: let's switch who is penalized: everyone else on the flight." Only if everybody else on the flight was paying for WiFi (doubtful) and bandwidth was maxed out during the flight (plausible.)

Correct, I failed to clarify it penalized the paying users IF bandwidth was maxed out.

Re: Stunnel and Airline Wi-Fi

#196

Post by morpheuskafka »

PaulAJ wrote: post #25

In the USA this would be a violation of the CFAA https://www.law.cornell.edu/uscode/text/18/1030 . Specifically, the router is a "protected computer" and the procedure described here is "exceeding authorised access" because it routes packets around a mechanism that was designed to stop them. Maximum penalty 5 years. (Some might argue that it was authorised because the computer let him do it. However the CFAA simply d…

Wouldn't this be excluded anyway since the only thing "fraudulently obtained" was "use of the computer or system" worth less than $1,000 per year?

Even if that language weren't in 18 USC 1030(a)(4), the guidelines sentence assuming no priors would look to be 0-6 months and $250-$5000 fine, assuming you couldn't plea out to something less. I doubt the federal authorities are even going to waste their time looking at $12 of "fraudulent access" that will likely lead to almost no jail time.

Re: Stunnel and Airline Wi-Fi

#197

Post by [deleted] »

nordsieck wrote: post #177
SomeOldThrow wrote: post #169

Earlier quoted context omitted.

It’s also immoral to force bad pricing down customer throats. And yet that is the definition of the inflight wifi business. EDIT: I’m fairly sure at current prices a single flight could pay for a month’s service for a single plane, probably several times over. The profit margins (& I imagine some the cut to the airline) must be enormous, & there is no pretense of fair terms at sale time because a single corporation c…

> It’s also immoral to force bad pricing down customer throats. And yet that is the definition of the inflight wifi business. In what bizarro world are people being forced to buy inflight wifi?

[deleted]

Re: Stunnel and Airline Wi-Fi

#198

Post by debatem1 »

otterley wrote: post #51
tomxor wrote: post #34

Earlier quoted context omitted.

> However the CFAA simply doesn't work that way. "Authorisation" is what the designers intended, and the initial paywall made that intention perfectly clear. That might be the case but it's also nuts. It encourages litigation over better design and makes public enemies out of security professionals, ultimately driving away those professionals from the US and making US developed tech weak.

Has it, though, in practice? The CFAA has been in effect for over 30 years. If this law actually had the chilling effect you claim it does, we would already have observed a significant security talent exodus from the U.S. My observation from having worked in Silicon Valley throughout the past 20 years suggests there's still plenty of talent to go around and plenty of lawful work being done.

The reason it hasn't is because the CFAA's track record as a prosecutorial tool is mixed at best. Of the 8 or so high profile cases using it only one conviction has actually held up. As a result, prosecutors are understandably hesitant about leaning on it.

Re: Stunnel and Airline Wi-Fi

#199

Post by UperSpaceGuru »

dehrmann wrote: post #180
UperSpaceGuru wrote: post #80

Wow, this was an amusing read. I actually helped architect part of the system that was bypassed at LiveTV (now Thales). We had some serious hackers on the team and discussed how much probing & prodding it would take to find vulnerabilities like this, but made the conclusion anyone doing this should be worried about more serious consequences. I for one, wouldn’t attempt this myself on the aircraft. The hacker side of…

This is a level of probing anyone with a good understanding of HTTPS could do. It's not like mac spoofing or or setting up a honeypot (have fun stopping those). I think you set your bar one or two notches too low for what someone in tech can do. Practically, though, your bar is fine because this isn't actually a "security" vulnerability in the sense that something was leaked (worry more about honeypots), just that on…

Someone in tech can do a lot. But anonymity of the web vs being 1/~120 on an aircraft where you gave your name and other vital info before boarding is a little different. Anyone going to extremes (like using fake travel docs) likely has far more nefarious intent than getting a little free WiFi.

Re: Stunnel and Airline Wi-Fi

#200

Post by hdfbdtbcdg »

novok wrote: post #103
eslaught wrote: post #95

Earlier quoted context omitted.

Is it though? The adblocker runs locally on your own computer; it certainly prevents the ads from doing what the designer intended, but it doesn't make the designer's computer (or any computer controlled by the ad network) do anything. Versus tracking does actually do something on your computer (e.g. running JS to discover fonts). Arguably that is a circumvention of the intentions of the user on their own hardware.

You're accessing the other sites computer in a way they did not intend, which is with adblock.

If they track me they are accessing my computer in a way I did not intend. I even provided them with a DNT header to make my wishes clear.
Post reply on HN