tangetially related: Hong Kong's top court made a similar ruling on a similar case back in 2019
https://hongkongfp.com/2019/04/04/catch-computer-offence-not...
Van Buren is a victory against overbroad interpretations of the CFAA
91–99 of 99 posts
Re: Van Buren is a victory against overbroad interpretations of the CFAA
#92This should also make the use of open wireless access points legally protected. It was always ridiculous that an AP could broadcast "come join me" incessantly but it was potentially infringing to actually join and use the advertised network.
A simple captive portal with ToS would solve it, right?
Re: Van Buren is a victory against overbroad interpretations of the CFAA
#93Earlier quoted context omitted.
> Foreign actors can simply hire sys admins to access whatever they want, no need for hacking This is prosecutable under a myriad of existing laws. CFAA was specifically crafted to deter and punish hacking. As far as I know, that's still very much a thing.
It's not immediately clear which laws. The whole point of the CFAA was that existing trespass & theft laws don't really work for digital files.
Espionage is illegal.
Re: Van Buren is a victory against overbroad interpretations of the CFAA
#94Earlier quoted context omitted.
OK that's good to hear yes. But I am confused by the implications here. How is port scanning different legally from brute forcing passwords? Iterating integers is fine, iterating the dictionary is not? What if there's an integer ID in the URL but it's MD5 hash'd and I recognize for what it is and iterate integers and MD5 them?
I think brute-forcing passwords offline isn't illegal under the CFAA. Using a password you got that way would be illegal. Similarly, password stuffing (just trying many passwords on the login form) would be illegal, since you are trying to gain access. Not sure how that works if you are not successful though. Port-scanning would be fine. Interesting edge case is, what happens if you port-scan, find an open telnet por…
>There is no authentication, but does that mean you are authorized? //
Not being "not authorised" is not the same as being authorised. Authorisation is a positive action.
Re: Van Buren is a victory against overbroad interpretations of the CFAA
#95Cracks in the foundation of TOS feudalism?
Re: Van Buren is a victory against overbroad interpretations of the CFAA
#96This should also make the use of open wireless access points legally protected. It was always ridiculous that an AP could broadcast "come join me" incessantly but it was potentially infringing to actually join and use the advertised network.
A simple captive portal with ToS would solve it, right?
The problem is that the law was bad and so connecting to an unauthorized network had to happen before agreeing to ToS. It also put the onus on normal people to carefully pick SSIDs instead of on AP owners to secure their network.
Re: Van Buren is a victory against overbroad interpretations of the CFAA
#97Earlier quoted context omitted.
OK that's good to hear yes. But I am confused by the implications here. How is port scanning different legally from brute forcing passwords? Iterating integers is fine, iterating the dictionary is not? What if there's an integer ID in the URL but it's MD5 hash'd and I recognize for what it is and iterate integers and MD5 them?
It’s not about the techniques used, it’s about the intent of the functions. Remember that we’re in the legal domain and sometimes a common sense argument prevails even if there are some potential holes (if a hole is discovered, a future court case can worry about it). Port scanning is like looking at the outside of a house and noting where the doors and windows are. Brute forcing a password is like picking a lock to…
Ah yes, mens rea. "knowingly" "intentionally" "knowingly and with intent" are phrases used in the law text. Thanks for reminding me.
Re: Van Buren is a victory against overbroad interpretations of the CFAA
#98Earlier quoted context omitted.
I think brute-forcing passwords offline isn't illegal under the CFAA. Using a password you got that way would be illegal. Similarly, password stuffing (just trying many passwords on the login form) would be illegal, since you are trying to gain access. Not sure how that works if you are not successful though. Port-scanning would be fine. Interesting edge case is, what happens if you port-scan, find an open telnet por…
>There is no authentication, but does that mean you are authorized? // Not being "not authorised" is not the same as being authorised. Authorisation is a positive action.
Not every action requires authorization though.
Re: Van Buren is a victory against overbroad interpretations of the CFAA
#99Earlier quoted context omitted.
>There is no authentication, but does that mean you are authorized? // Not being "not authorised" is not the same as being authorised. Authorisation is a positive action.
Not every action requires authorization though.
For sure, it's been a while but IIRC the CFAA (and UK's CMA) refer to use of certain legal classes of computer "without authorization" or "exceeding authorization". Legal authorisation is an active state rather than something that happens passively.