6 ms·

The article states "Weev and a fellow hacker who originally uncovered AT&T’s mistake and collected the e-mails didn’t ask the company for permission to access

The article states "Weev and a fellow hacker who originally uncovered AT&T’s mistake and collected the e-mails didn’t ask the company for permission to access the Web addresses that shared iPad users’ private information" I really don't see how this argument holds up. From a technical point of view the very nature of HTTP includes asking for permission. You send a request "Please can I see the information at this URL" If the organisation running the server does not give that permission, it should not serve the data. These charges seem pretty odd to me, hopefully it gets resolved in a sensible manner.

robmurrer 14y ago
>> required visiting an AT&T web address with a particular – and easy to guess – code tagged onto the end. How is this different than a password?
- rapala 14y ago
  I guess this is exactly the thing that the court must decide on: whether guessing that code can be considered as a circumvention of security measures or not.
  - josteink 14y ago
    Following that logic breeds bizarre results. What if you find this magic token because it was embedded in some client-side, javascript login-form? Are you a hacker for viewing the source? Securing content on the internet is easy. If you don't want it accessible to anyone, don't give the content to anyone who provides an unauthenticated HTTP request. Why are we putting the legal responsibility of maintaining security on that content on everyone except the ones actually in position to do so?
    - robmurrer 14y ago
      If I look under your doormat, and there is a key, and I use it to open your front door...
      - josteink 14y ago
        Rather if you leave a (possibly classified) document under your doormat, am I a criminal if I find them and read them?
        rapala 14y ago
        Depends on the document and jurisdiction. If I remember correctly, some levels of military classifications here in Finland require you to not read the document and return it to the officials. Of course the one who left the document would also get reprimanded at least. Using someones password without permission is as illegal whether you shoulder surfed it, cracked it or red it from a post-it note.
      - nitrogen 14y ago
        A house's front door implies an expectation of privacy. A web server implies an expectation of public access.
- josteink 14y ago
  Someone can provide you with a clickable link, as in for instance this submission, and you would never even know that the content you are accessing is supposed to be "protected".
  - robmurrer 14y ago
    I see your point, but how does this apply to this case?
  - gabemart 14y ago
    You can format a link to be something like: http://username:password@members.example.com http://username:password@members.example.com I wouldn't say that means the account in question is unprotected.
    - josteink 14y ago
      If you are going to nitpick, I will say that this is a feature that relies on browser-support. It's not fundamental to the web. Query-strings however by definition needs to be supported on the server-side. They are a part of the web. They are required for the web to work. Why is "browser-support" relevant? Your example is not supported in MSIE. I also thought it was removed from Chrome (in the name of "simplicity"), but I may be wrong. A link with query-strings is guaranteed to work for everyone. http://support.microsoft.com/kb/834489 http://support.microsoft.com/kb/834489
      - gabemart 14y ago
        Huh, I had no idea that feature had been deprecated. I guess it's been a little longer since I used it than I thought.
        josteink 14y ago
        It was used for lots of http://famous-website.com:long-token-nobody-will-ever-read@phishing-site.com http://famous-website.com:long-token-nobody-will-ever-read@p... style attacks. Microsoft's solution to the problem may not have been ideal, but at least that was the reasoning behind it. Edit: And what do you see once you click post? Hacker news ironically proving Microsoft's point. It's a wonderful world we live in.
- maxerickson 14y ago
  A password at least makes it clear to a bystander that some access control is intended at that URL. Consider the silly case where I have a server responding to example.com/funny/ and then try to claim that it was secure simply because I had not published the link. People would be quite confused if they went to jail for visiting it.
maratd 14y ago
> From a technical point of view the very nature of HTTP includes asking for permission. A web server isn't an agent of the company and has no capacity to grant or deny permission. Think of it as a security system you install in your home. Now, if the security system is malfunctioning and you notice that it is malfunctioning ... do you call up the owner and let them know or do you go inside and look through their stuff? If you go inside and look through their stuff, it's trespassing. Obviously the two scenarios aren't the same, but I'd imagine that's the logic used in the argument.
- ams6110 14y ago
  A web server isn't an agent of the company and has no capacity to grant or deny permission. A web server certainly can grant or deny permission, but it seems that this one didn't.
  - jrabone 14y ago
    That is perhaps not the same as "capacity" in the legal sense. Is a web-server legally competent?
    - freehunter 14y ago
      The blame would rest on the admin who set the permissions. You can't blame a lock for not being locked, but you can blame the night watchman for not locking it. This doesn't remove blame from the intruder though.
      - gknoy 14y ago
        A webserver that doesn't restrict access (not even obfuscating the URL) is more similar to a "Free reading material!" shelf at the bookstore. If you go and take one of everything, it's not your fault if the bookstore mistakenly put things there that they'd intended not to be freely available.
- warfangle 14y ago
  On the other hand, if Weev is sentenced: what does that mean for such things as Google's security flaw bounty?
curiousdannii 14y ago
Yes, the 403 status code exists for a reason!

robmurrer 14y ago

>> required visiting an AT&T web address with a particular – and easy to guess – code tagged onto the end. How is this different than a password?

rapala 14y ago
I guess this is exactly the thing that the court must decide on: whether guessing that code can be considered as a circumvention of security measures or not.
- josteink 14y ago
  Following that logic breeds bizarre results. What if you find this magic token because it was embedded in some client-side, javascript login-form? Are you a hacker for viewing the source? Securing content on the internet is easy. If you don't want it accessible to anyone, don't give the content to anyone who provides an unauthenticated HTTP request. Why are we putting the legal responsibility of maintaining security on that content on everyone except the ones actually in position to do so?
  - robmurrer 14y ago
    If I look under your doormat, and there is a key, and I use it to open your front door...
    - josteink 14y ago
      Rather if you leave a (possibly classified) document under your doormat, am I a criminal if I find them and read them?
      - rapala 14y ago
        Depends on the document and jurisdiction. If I remember correctly, some levels of military classifications here in Finland require you to not read the document and return it to the officials. Of course the one who left the document would also get reprimanded at least. Using someones password without permission is as illegal whether you shoulder surfed it, cracked it or red it from a post-it note.
    - nitrogen 14y ago
      A house's front door implies an expectation of privacy. A web server implies an expectation of public access.
josteink 14y ago
Someone can provide you with a clickable link, as in for instance this submission, and you would never even know that the content you are accessing is supposed to be "protected".
- robmurrer 14y ago
  I see your point, but how does this apply to this case?
- gabemart 14y ago
  You can format a link to be something like: http://username:password@members.example.com http://username:password@members.example.com I wouldn't say that means the account in question is unprotected.
  - josteink 14y ago
    If you are going to nitpick, I will say that this is a feature that relies on browser-support. It's not fundamental to the web. Query-strings however by definition needs to be supported on the server-side. They are a part of the web. They are required for the web to work. Why is "browser-support" relevant? Your example is not supported in MSIE. I also thought it was removed from Chrome (in the name of "simplicity"), but I may be wrong. A link with query-strings is guaranteed to work for everyone. http://support.microsoft.com/kb/834489 http://support.microsoft.com/kb/834489
    - gabemart 14y ago
      Huh, I had no idea that feature had been deprecated. I guess it's been a little longer since I used it than I thought.
      - josteink 14y ago
        It was used for lots of http://famous-website.com:long-token-nobody-will-ever-read@phishing-site.com http://famous-website.com:long-token-nobody-will-ever-read@p... style attacks. Microsoft's solution to the problem may not have been ideal, but at least that was the reasoning behind it. Edit: And what do you see once you click post? Hacker news ironically proving Microsoft's point. It's a wonderful world we live in.
maxerickson 14y ago
A password at least makes it clear to a bystander that some access control is intended at that URL. Consider the silly case where I have a server responding to example.com/funny/ and then try to claim that it was secure simply because I had not published the link. People would be quite confused if they went to jail for visiting it.

maratd 14y ago

> From a technical point of view the very nature of HTTP includes asking for permission. A web server isn't an agent of the company and has no capacity to grant or deny permission. Think of it as a security system you install in your home. Now, if the security system is malfunctioning and you notice that it is malfunctioning ... do you call up the owner and let them know or do you go inside and look through their stuff? If you go inside and look through their stuff, it's trespassing. Obviously the two scenarios aren't the same, but I'd imagine that's the logic used in the argument.

ams6110 14y ago
A web server isn't an agent of the company and has no capacity to grant or deny permission. A web server certainly can grant or deny permission, but it seems that this one didn't.
- jrabone 14y ago
  That is perhaps not the same as "capacity" in the legal sense. Is a web-server legally competent?
  - freehunter 14y ago
    The blame would rest on the admin who set the permissions. You can't blame a lock for not being locked, but you can blame the night watchman for not locking it. This doesn't remove blame from the intruder though.
    - gknoy 14y ago
      A webserver that doesn't restrict access (not even obfuscating the URL) is more similar to a "Free reading material!" shelf at the bookstore. If you go and take one of everything, it's not your fault if the bookstore mistakenly put things there that they'd intended not to be freely available.
warfangle 14y ago
On the other hand, if Weev is sentenced: what does that mean for such things as Google's security flaw bounty?

curiousdannii 14y ago

Yes, the 403 status code exists for a reason!