Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When your classmates threaten you with felony charges

miles.land

Post reply on HN
Print view View original

301–310 of 350 posts

Re: When your classmates threaten you with felony charges

#301

Post by InSteady »

dahwolf wrote: post #187
marcod wrote: post #124

Earlier quoted context omitted.

While what you say is true, I feel strongly that it shouldn't be. It is morally right to show if a product that is used by many fellow students is marketed as "100% secure"* is in fact very vulnerable. If some less ethical hackers got a hold of that data, much worse things could have happened. * that's the biggest red flag. A company saying 100% obviously has very little actual security expertise. PS: I'm a big fan o…

Devil's advocate: I get into your home by bypassing (poor) security. I take pictures and make copies of anything inside. Then I publicly announce the breach and demand that you fix your security based on a deadline I made up. Then I say "trust me, bro" when I promise to never reveal the data I stole. Nobody would find any of that moral. The analogy breaks down because your home is not a place where sensitive data of…

Your analogy misses some key details. It is much less absurd if I am storing valuable items and documents for everyone in the neighborhood while publicly proclaiming my house is more secure than a bank vault. Meanwhile I can't even be fucked to lock the door when I'm away.

I'd say you checking the front door to find it unlocked, then taking a few pictures for proof is perfectly moral. In this case, I think most people would agree it is a step too far to expect you to come to me first, rather than immediately announcing to the entire neighborhood that I'm being incredibly lazy and reckless with their valuables (on top of outright lying to all of them).

Re: When your classmates threaten you with felony charges

#302

Post by abduhl »

feoren wrote: post #277
abduhl wrote: post #253

Earlier quoted context omitted.

I don’t know what to say in response to your complaints except negotiate better working conditions next time you get hired. The company wrote it. You accepted it. You can always ask for different terms and walk away if they don’t agree, start your own company, or change industries to one where companies are willing to negotiate. If you want protections for employees, sure you can (erroneously, in my opinion) look to…

> You can always ask for different terms and walk away if they don’t agree, start your own company, or change industries to one where companies are willing to negotiate. I suspect you have lived a very privileged life if you really believe these options are actually open to most employees in the U.S. Switch industries? Start your own company? Those are both extreme life-altering multi-year responses to losing PTO pay…

I grew up what you’d call “lower middle class.” Your suspicions are incorrect. I’ve switched industries twice in my life to the tune of nearly a third a million in student loan debt. I know how difficult it is and how expensive it is, but the actual strength of some people’s personal convictions matches the strength of the convictions you pretend to have online. Just like you, the companies I worked at (and owned a portion of) changed or the industries I worked in changed, but unlike you I left (and forced them to cash out my PTO because, contrary to what you think, you do have an enforceable employment contract even if it’s in the form of a benefits package, an employee handbook, or even just “that’s what the company normally does” at that point in time) after realizing that the change was permanent rather than taking to the internet to complain while continuing to pull an easy paycheck.

It’s strange that the people who tell you how difficult something is are almost always people who haven’t done it and the people who tell you how privileged you are almost always are even more so themselves. Tell me, when’s the last time you swung a hammer or pulled unemployment benefits?

Re: When your classmates threaten you with felony charges

#303

Post by InSteady »

fallingknife wrote: post #59
jbombadil wrote: post #11

I don't understand why in both contracts and legal communication (particularly threatening one), there is little to no consequence for the writing party to get things right. I've seen examples of an employee contract, with things like "if any piece of this contract is invalid it doesn't invalidate the rest of the contract". The employer is basically trying to enforce their rules (reasonable), but they have no negativ…

That's not the language they use. It will be more like "your actions may violate (law ref) and if convicted, penalties may be up to 20 years in prison." And how do you keep people from saying that? It's basically a statement of fact. If you have a problem with this, then your issue is with Congress for writing such a vague law.

“[the security researchers] may be liable for fines, damages and each individual of the [security research] Group may be imprisoned… Criminal penalties under the CFAA can be up to 20 years depending on circumstances.”

“the Group’s actions are also a violation of Buzz’s Terms of Use and constitute a breach of contract, entitling Buzz to compensatory damages and damages for lost revenue.”

“the Group’s agreement to infiltrate Buzz’s network is also a separate offense of conspiracy, exposing the Group to even more significant criminal liability.”

Emphasis added. The language is quite a bit more forceful and threatening than you make it out to be. Given that they were issuing these threats as an ultimatum, a "keep quiet about this or else...", it was likely a violation of California State Bar's rules of professional conduct.

Re: When your classmates threaten you with felony charges

#304

Post by InSteady »

Cheezewheel wrote: post #278
davesque wrote: post #276

I think I might be a bit of an outlier on this, but I struggle to see the value of imposing an embargo date in a security disclosure unless it's sent to a large institution that is used to a formal process like that. In most cases, if you're trying to communicate to someone that you've found a vulnerability under the pretense that you're doing it for the greater good, why begin by the relationship with a deadline bef…

Do you disagree that Users might be entitled to know when a corporation is misusing their private, sensitive information? What is ethical does not begin and end with the corporations best interest, the users whose private information is being mishandled are the victims here, let us not lose perspective.

Users who have been falsely assured that their data is both totally anonymous and "100% secure."

On the other hand, assuming the app creators we in far over their heads when it comes to proper security, I have to wonder if they started off cordially and then freaked out a short while later because after trying, they realized there was no possible way for them to correct the issue in the given timeline. So in desperation they resorted to something drastic (and arguably unethical) to cover their asses.

Re: When your classmates threaten you with felony charges

#305

Post by InSteady »

monksy wrote: post #68

Commentary on the journalism: Fantastic for calling Fizz out. "Fizz did not protect their users’ data. What happened next?" This isn't a "someone hacked them". It's that Fizz failed to do what they promised. I'm still curious to hear if the vulnerability has been tested to see if it's been resolved.

I think in a follow-up article by the Stanford Daily they said the app creators have gotten a few million in funding and lots of professional help, including to fix security issues. Although it still looks like user data is not fully anonymized internally like they had previously claimed.

Re: When your classmates threaten you with felony charges

#306

Post by InSteady »

Buttons840 wrote: post #120

> And then, one day, they sent us a threat. A crazy threat. I remember it vividly. I was just finishing a run when the email came in. And my heart rate went up after I stopped running. That’s not what’s supposed to happen. They said that we had violated state and federal law. They threatened us with civil and criminal charges. 20 years in prison. They really just threw everything they could at us. And at the end of t…

I understand there has been some progress on this front, but it's not nearly enough. We need stronger protections for whistleblowers and security researchers. Corporations and legislators wont write these laws for us because it's not particularly in their interest. Well, maybe senator Wyden and a few other highly ethical and tech savvy legislators well help, but the onus is on us as concerned citizens and perennial victims.

Re: When your classmates threaten you with felony charges

#307

Post by adolph »

bawolff wrote: post #298
adolph wrote: post #284

Earlier quoted context omitted.

The ostensible researchers didn’t follow the ethos to which they claimed and linked. Do you disagree with that?

Yes i disagree. You are quoting the document out of context and it doesn't say what you are implying it says. Maybe out of context is the wrong word. You quote enough of the paragraph it just doesn't support your point. All the paragraph says is that one hypothetical situation may have legal consequences in some juridsictions. It does not make any claim as to whether or not that is ethical or right.

Ok, do you agree that they claimed the OWASP document supported their actions?

Concerned about user privacy and security — and consistent with industry best practices [link to owasp] — we wrote a detailed email to the Fizz team [0]

Do you disagree that the OWASP page states the below?

Researchers should:

Ensure that any testing is legal and authorised.[1]

Ok, I can see how the OWASP document doesn’t use the words ethic or right or wrong. Would you agree that the claim by saligrama.io that they were “consistent with best practices” (where best practices is a link to OWASP) is not true?

I can see an interpretation where they communicated in line with best practices even if they didn’t follow best practices in their actions before communicating.

0. https://saligrama.io/blog/post/firebase-insecure-by-default/

1. https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability...

Re: When your classmates threaten you with felony charges

#308

Post by InSteady »

wang_li wrote: post #8

Yet another example of someone security "testing" someone else's servers/systems without permission. That's called hacking. Doesn't matter if you have "good faith" or not. It's not your property and you don't get to access it in ways the owners don't desire you to access it without being subject to potential civil and criminal enforcement against you.

As a user of the site who has been falsely assured that your data is "100% secure" and totally anonymous, is that data in fact not your property? Perhaps not in a strictly legal sense, but from an ethical standpoint it is certainly more of a grey area than corporations and their lawyers would want us to roll over and accept.

My understanding is that these security researchers only accessed their own accounts and data on the cloud servers, and in doing so they did not bypass any "effective technical protections on access."

Thankfully for all of us, the DoJ appears to disagree with your sentiment. At least with the current administration.

Is it your position is that when you are lied to, and your sensitive and personally identifying information is being grossly mishandled by a company, your only recourse is to spend thousands of dollars and incredible amounts of time on a court case that has very little chance of achieving anything?

Re: When your classmates threaten you with felony charges

#309

Post by InSteady »

edwinjm wrote: post #36
wang_li wrote: post #8

Yet another example of someone security "testing" someone else's servers/systems without permission. That's called hacking. Doesn't matter if you have "good faith" or not. It's not your property and you don't get to access it in ways the owners don't desire you to access it without being subject to potential civil and criminal enforcement against you.

If they don't do it, criminals will do it. I know what my preference is.

No, let's bury our heads in the sand while being sure to handicap (and treat as hostile) the only group of people who seem to care and have the expertise to do something about this giant mess we are in with regards to consumer, patient, and citizen data security.

Re: When your classmates threaten you with felony charges

#310

Post by feoren »

abduhl wrote: post #302
feoren wrote: post #277

Earlier quoted context omitted.

> You can always ask for different terms and walk away if they don’t agree, start your own company, or change industries to one where companies are willing to negotiate. I suspect you have lived a very privileged life if you really believe these options are actually open to most employees in the U.S. Switch industries? Start your own company? Those are both extreme life-altering multi-year responses to losing PTO pay…

I grew up what you’d call “lower middle class.” Your suspicions are incorrect. I’ve switched industries twice in my life to the tune of nearly a third a million in student loan debt. I know how difficult it is and how expensive it is, but the actual strength of some people’s personal convictions matches the strength of the convictions you pretend to have online. Just like you, the companies I worked at (and owned a p…

> I’ve switched industries twice in my life to the tune of nearly a third a million in student loan debt.

And you're actually suggesting this as a solution to others? That they lose years of income and take on $300k in non-dischargeable debt because their employer acted like a dick, in the vain hope that with this new degree, their new employers won't? Sorry, but "just spend years and take on $300k in student loan debt like I did" is just not compelling advice.

> the actual strength of some people’s personal convictions matches the strength of the convictions you pretend to have online

You're significantly upping the "personal attack" game here. You could just as easily say that I am the one with strong convictions, continuing to work at a company that treats its employees like shit because I actually do believe in the work that I'm doing there.

> It’s strange that the people who tell you how difficult something is are almost always people who haven’t done it

It's strange to you that the people who claim something is difficult are the ones who haven't been able to do it?

> Tell me, when’s the last time you swung a hammer or pulled unemployment benefits?

Not interested in a hard-knocks pissing contest. I assumed you wouldn't spend $300k in a game of Musical Diplomas in the hope of avoiding being treated the way most people in the U.S. are treated by most companies unless you had a significant safety net. I'm not sure what you're trying to prove by saying: no, you added it onto an already difficult life. My point is that this is not good advice.

Post reply on HN