this post was submitted on 23 Sep 2024
205 points (97.7% liked)
Privacy
32177 readers
400 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I have no idea what the law is in India, but if he got a "hacking" charge for this it would be a gross miscarriage of justice, considering he never once did anything resembling social engineering, brute forcing passwords, any sort of injection attack, or anything else that might actually be involved in hacking.
However, assuming he never tried to reach out to the company themselves first (and I saw no indication in the article that he had), this is really quite a horrible irresponsible disclosure. It's pretty obviously a significant leak of sensitive data—both customer and business data—and giving them 90 days to fix it before alerting the public to what you found is pretty basic security ethics.
I also don’t know the laws in India, but in the US nearly every major “hacking” case for decades has been a miscarriage of justice to some degree or another.
Like Kevin Mitnick who simply figured out that a major early ISP was keeping customer payment information in plaintext on an internet-connected server.
That’s a huge misrepresentation of what Mitnick did and how the government mischarged him. He did a bunch of dumb stuff that was illegal. He was overcharged in very bad ways supporting ridiculous lies from the companies he broke into.
Well there was that one part where he turned off his laptop after (not wanting to drop what he did here as the article was pulled), but I could totally see a company freaking out and going nuclear. That being said, I'm just looking through the FreedomGoggles that recently saw a "hacker" using F12 to compromise a bunch of teacher data. You know, their important sensitive data that was definitely not sent to their device where it could be seen by right clicking and hitting view source.
Under US law, that would be considered hacking.
It is antiquated, and frequently abused by prosecutors, but legally speaking hacking is as simple as accessing any system you're not authorized to.
And even more so, he documents alterations and changes that he made to that system e.g. ordering a soup for a random table.
Again, only speaking for America, but this would be a textbook example of grayhat hacking, which could easily be prosecuted.
I'm not saying it should be illegal, or that I agree, just that it currently is.
A good lawyer in a case with a sensible well-informed judge could run a good case, since he's only actually making calls to an API that has not just been left open for anyone to access (which you could argue is implicit authorisation no different to how a store having unlocked doors is implicit invitation to enter the store), but has actually been explicitly invited to access by virtue of the site he was sent to in the QR code causing his browser to make requests to that API.
Admittedly, a competent prosecutor could also make a case that by changing the query parameters, he was then losing that explicit invitation, and could then try to pick apart the implicit argument.
Though it's all irrelevant, because there's a reason I said "miscarriage of justice" and not "incorrect application of the law". If the law did find someone guilty here, it would be an unjust law. That was my point.
So you're saying that if all lawyers, and judges involved, are all also programmers, security researchers, or otherwise well-versed in computer security, they might choose to ignore the law how is written, and nullify it with their own experience?
Also, there is plenty of case law, and people with convictions on their record, for doing far less than what this guy did.
That doesn't mean the law is just, or that I agree with it, just that it's currently illegal.
No? That's nothing close to what I said? I said that the law as it's written could very likely be interpreted in a way that achieves a just outcome, as long as people involved have adequate understanding of technology.
If this guy was living in America, the only thing protecting him would be prosecutorial discretion, which would be bad news for him, because absent that, he'd be looking at real jail time. Because your argument is that lawyers and judges can nullify the law with their outside expertise on topics other than the law, but they can't. That is not something they are empowered to do.
I'm outsourcing the rest my response to Llama because i think you need a more in-depth response then I'm willing to type out on my phone screen.
The prompt was just to summarize the CFAA, something an LLM is actually useful for:
The Computer Fraud and Abuse Act (CFAA) is a federal law in the United States that was enacted in 1986 to address various forms of computer-related crimes. Here's a summary of the key aspects of the CFAA:
Purpose: The CFAA aims to prevent and punish unauthorized access to computers, computer systems, and computer data, as well as to protect against malicious activities that can cause harm to individuals, businesses, and the government.
Key Provisions:
Penalties:
Notable Cases:
Criticisms and Controversies:
Overall, the CFAA is a complex law that aims to address various forms of computer-related crimes, but its broad language and harsh penalties have raised concerns about its impact on security research, free speech, and individual rights.
JFC why do people always do this shit? Repeatedly insist on misrepresenting someone's argument even when they have explicitly explained why the misrepresentation is wrong…
Okay, then if that's not what you mean by the above, please explain your real intent.
Because that blog post documents at least three separate types of violations of the CFAA:
Unauthorized access, computer fraud, and computer trespass.
So I'm not sure what special technical knowledge the judges or lawyers involved could have that would resolve the case without a conviction, unless you mean that because they have that knowledge they understand how arcane and unjust the CFAA law is, and would move to nullify it.
But you're adamant that is not what you mean, so help me understand.
Just read the comment I literally made before you made that reply. It explains it pretty precisely.
It comes across as someone who genuinely believes that American legal system is either technocratic, or otherwise operating on an alternative set or principles that aren't currently present.
And in this aspirational version of the American legal system, the CFAA wouldn't exist, and this gray hat whistleblower would be afforded some legal protections for documenting the gross negligence of that service provider.
But if we're stuck operating in reality as it currently exists, he'd be SOL and there'd be no technocratic mechanisms to save him, except for prosecutorial discretion.