Discussion between Michael Hall and jmoreno

Feeds

23:05

Q: Legal implications of printing something remotely to tell the owner their printer is vulnerable?

Commonly, wireless printers in homes and corporate settings can be configured incorrectly, exposing them to the internet. This can be a major security vulnerability, and can allow anyone to not only print stuff remotely on it, but sometimes even get full access to the network it's connected to. I...

jmoreno

Ethics are irrelevant to crime, and the CFAA makes it a crime to do anything on a computer that the owner of that computer doesn’t like. This is easily into the bounds of doing serious time in jail

Michael Hall

Seems to me that it would depend on whether you hacked your way in, or casually browsed to the printer on an unsecured WiFi network. (i.e. breaking and entering a locked house with no-trespassing posted, vs walking into a home a realtor is holding an open house for...)

jmoreno

@MichaelHall: nope, how easy it is to access is irrelevant. See apple/att and endpoint that returned email addresses, no password, right out there in the open, no restriction at all. Jail: nbcnews.com/technolog/…

Michael Hall

@jmoreno, I didn't mean hacked in the context of difficult, I meant that some trickery is needed, and the intent is mischief. He spoofed his way in and harvested personal information that was not intended to be available to the public. I would define that as hacking and theft.

jmoreno

@MichaelHall: I would not characterize changing the number at the end of a url as “trickery”, although I’ll give you mischief in his case. Note that he did exactly what the OP asks about, and it is/was generally considered a crime although as he is out of the country no charges have been filed

Michael Hall

23:05

@jmoreno, he programmed his desktop computer to spoof multiply iPads, is that not tricking the system?

jmoreno

@MichaelHall: no. The url of this stackexhange question is law.stackexchange.com/questions/84142, there will be another one at law.stackexchange.com/questions/84143, he basically changed 84142 to 84143 and then went to jail for a year (well, he did it 100,000 times, still same thing). It’s not what they wanted to happen, but it’s not trickery.

Michael Hall

When you change the number on the end of a URL on this website you go to a different publicly accessible question or comment. When you change the URLs as he did you turn them into a "unique iPad ID" that belongs to someone else. You are spoofing their system into believing that you are that account holder, on that device. How is that not tricking the system?

What you are saying is akin to pleading that you "just changed a couple numbers" on a social security card.

It's not trickery to simply change a couple of numbers and pretend to be someone else...

@jmoreno, forgot to tag you up front...

jmoreno

23:51

@MichaelHall: Because the system doesn’t include a process of asserting that the iPad is yours. SSN is an excellent example: if the IRS created an endpoint, that given a SSN it returned the name and taxes due/refunded, using someone’s else’s number wouldn’t be trickery.

There is no misrepresentation or trickery involved, because there’s no prior step that requires representing anything. In this case, they didn’t WANT you to enter someone else’s number (or more likely never considered the possibility) and so through the CFAA it’s a crime to do so. There wasn’t even a terms of service saying that you agreed to only look up your own iPad.

next day → last day (17 days later) »

all rooms