Hacker News Reader

Comment by tptacek | Hacker News Reader

Almost certainly not (if the lock somehow phones home to a central server and your research involves subverting the server, you could have problems, but no lock I know of works that way).

While it might not be illegal to mess with a lock you've purchased, it could be unlawful, in the sense that you might be violating a contract that you agreed to when you purchased the lock. So while I would stake money on you not getting arrested for doing that work, I wouldn't bet against you getting sued, which is a far more common occurrence. Researchers getting arrested: rare. Researchers getting sued: a little less rare (still pretty rare).

View on HN

There's a kind of funny warranty/liability split when you cant test the quality of your own lock.

Locks are generally a let the buyer beware kinda proposition. It's up to me to decide if this lock is good enough to protect the tools in my shed.

If i'm explicitly forbidden from investigating that - i think the manufacturer should be required to say how much of your losses they'll cover when the lock fails. Obviously the current state of affairs is _none_ and i can't lawfully tell if the lock sucks or not.

We'd all be better off if lock makers were forced to choose. either i can pick my own lock (evaluate my own risk) or advertise how much insurance comes with the purchase of the lock (evaluate risk for me).

(i fully appreciate the world does not work this way. I'm just asserting it would be better for everyone if it did.)

Such one sided contracts where there was never a possibility of negotiation need to be tossed out. This applies to the EULA of a smart lock to a lease agreement with some super corporation located in a different state. Such contracts can only be consensual when involving two entities of similar power.

This is pretty silly. All sorts of valid contracts are non-negotiable. You have an option: return the device for a refund.

In a Democracy, one can not resign fundamental rights in a contract. Not in one you get to read before signing, and definitively not in one you can only read after signing.

You can agree to some punishment (like in an NDA). But if it's in a level that would destroy your life, it ought to be illegal again. And every time you agree for some punishment for exercising a fundamental right, you must gain something proportional to the right taken, otherwise it ought to be illegal again.

It's impossible to have a democracy if most of the population is slave due to some contractual clause.

Researchers getting sued: a little less rare (still pretty rare).

A quick intuitive verification for this claim: when you buy an E&O insurance as a technologist they'll ask a lot of stupid questions (in the sense that you'll be offended they have to even ask) but they don't ask "Do you do security research?" because the underwriters believe the risk and hazard to be actuarially immaterial.

I mean my business insurance still has a Y2K rider

>This Policy does not cover any loss, damage, cost, claim or expenses, whether preventative, remedial or otherwise, directly or indirectly arising out of or relating to: (a) the calculation, comparison, differentiation, sequencing or processing of data involving the date change to the year 2000 or any other date change, including leap year calculations, by any computer system, hardware, programme or software and/or any microchip, integrated circuit or similar device in computer equipment or non-computer equipment whether the property of the Insured or not; or (b) any change, alteration or modification involving the date change to the year 2000 or any other date change, including leap year calculations, to any such computer system, hardware, programme or software and/or any microchip, integrated circuit or similar device in computer equipment or non-computer equipment, whether the property of the Insured or not. This Clause applies regardless of any other cause or event that contributes concurrently or in any sequence to the loss, damage, cost, claim or expense.

And further, if you're doing this on your own and never publish anything, it's not like Bluetooth Locks, Inc knows what you're up to and just magically serves you with a lawsuit.

>>...but no lock I know of works that way).

And if the law is followed, you never will know of one.

That is the problem.

I don't think this is the case. Not only are there probably no locks that work like this on the market, but it is even less likely that, were one to exist, it would be impossible to discover the remote server connection without probing the remote server. Remember also that the law we're talking about isn't strict liability; you have to knowingly exceed authorization.

I've spent the last 13 years doing this kind of work, and bumped into a lot of remote servers I don't own on assessments of devices. There've been a lot of times where I wished I could go further, but never a time where I accidentally got sucked into hacking someone else's computer by dint of probing my own device.

Reply on news.ycombinator.com