Hacker News Reader

Comment by Causality1 | Hacker News Reader

It does beg the question, does changing a user's password without their consent violate the CFAA?

At the very least I smell potential fraud with the trip wire limits then associated messages saying no more screen times and password resets. CFAA could potentially be applied but I think since it’s their platform and done by an authorized agent it may be a stretch. But some state AGs could read into these actions and open wider lines of investigation, and compel other evidence. If this is what they are okay talking about, think of the other dirty deeds that were kept hush hush..

it's just one way to lock a user out. on my server i can set a flag that blocks login instead. (that flag is normally set until a user is verified)

so the question is not: am i allowed to reset your password. but am i allowed to limit your access to my service.

the problem is not what they did and why, but how they did it and how it affected the users.

> am i allowed to limit your access to my service.

And the clear answer to me is 'yes'. And the customer can try to sue for non-delivery of service if they like, but probably won't get back much more than the $10 subscription fee.

The problem is not locking out users, it’s allowing yourself or someone else to impersonate them.

It's your system, you're free to design it as you wish. The accounts aren't "property" of users, they're instruments you use to provide some service - if you allow your employees to impersonate these accounts, then that's authorised access.

You're generally liable for the consequences of that access - e.g. if Twitter would have their employees take over Trump's account and post "I'm a doo doo head" every five minutes, then that might result in some legal challenges; or if a PayPal employee made payments impersonating your account, then those payments would constitute fraud; but, in general, your employees accessing user accounts and altering data in them is not prohibited by any laws.

[edit] It would be nice if the downvoters could provide some argumentation why they disagree - I can accept that users should have some rights, but according to the current laws they don't. CFAA protects the owner of the system, who gets to decide what access is authorised and what not.

Yes, this is the important point. Changing someone's password is not just locking them out, it's allowing you to log in as them.

I have control of a user database for my site. I cannot log in as my users since I don't know their password and the database is hashed. But if I log into the database and change their password, now I know what their password is. And now I can log in as them.

depends on how it's done. i could randomize the password in such a way that i don't know what it is. better yet, since the password should be stored in hashed form, just changing that string would change the password to one that is unknown or even impossible. that's how i lock unix accounts.

It depends whether they had permission from the owner of the system. An employee who tampers with passwords may violate the CFAA but if the system owner (MoviePass) authorised it it's fine and dandy, the users have no particular rights there.

Reply on news.ycombinator.com