Hacker News Reader

Comment by Kapura | Hacker News Reader

I think this is indicative of the biggest problem we have had with social media: there is no legalism here, just "codes of conduct" that companies and users both willfully ignore.

If your handle gets sold by some facebook employee to a rich kid in LA, what recourse do you have? I don't know what laws this would break (maybe some broad definition of fraud? I Am Not A Lawyer) so it's not like this person has a slam dunk legal case...

We have no external arbiters of online interaction, no well-respected third party we can go to to arbitrate. The last defense is the mob, potentially shaming the companies in question into recanting. I've seen it happen on this very website multiple times. But it is not sustainable, it does not scale, and it allows the companies to keep fucking with people who can't make their injustices known.

View on HN

I think this goes a bit broader than just social media. It really has to do with the concept of ownership of words/handles/subdomains on third-party systems.

Who owns a twitter handle? Who owns an Instagram account handle? Do people with trademarks have a right to their trademark on a third-party system?

I work at AWS. Some of our services allow you to customize subdomains (AWS SSO, as an example). There have been customers (typically large enterprises) that assert they should have rights to a specific subdomain within AWS. These subdomains typically relate to their business name or various trademarks.

Should these customers have rights to these names? If I'm a small business (or perhaps an individual) and reserve companyxyz.amazonapps.com, should a company have recourse to take that away from me?

It's a question that hasn't really been collectively answered within the digital space. And until this question is answered, there are going to continue to be issues.

Precisely what I was going to link this to: the early (and now, TLD-expansion) domain name ownership mess.

The US (and seemingly other countries) trademark system is woefully underspecified for the modern world. Among other issues:

- Enforcement, given an exponential explosion of user-created public content with increasingly sophisticated tools

- 1:1 design & physical matter copying

- Likeness-intended / indistinguishable deepfakes

Trademark skated by on "Would it confuse potential customers?" for decades, but we're at a place where that's no longer sufficiently precise.

There's also the international issue. Different countries can have conflicting trademarks. So if you've got a valid trademark for "ACME, inc" from the US, and someone else has a valid trademark for "ACME, inc" from the UK, who gets the ACME domain/TLD/subdomain/twitter handle/etc? Both can get legal judgements in their respective countries!

I'd say if you only own "ACME, Inc" in the US (UK), you only get to register acme.co.us (.co.uk). In this case, when no company owns an international ACME trademark, there should be a body that maintains acme.com as a simple text-only disambiguation page showing you links to each ACME, Inc with a description in the respective country's official language(s). I am nearly certain there is already a discussion buried at the end of some RFC about exactly this problem and proposed solutions, which weren't implemented because the good-enough solution was way cheaper than adding trademark disambiguation to the assigned names system.

Forget about international, within a single country you can have identical trademarks in different areas of business [1]. That's why I think we're stuck with first-come, first-served as the only fair way to allocate shared namespaces. I'm pretty sure there was an Apple Ford on the main street in my hometown -- if they get "@apple" first on the next hot social media service, why should anybody be able to take it away from them?

1: https://en.wikipedia.org/wiki/Apple_Corps_v_Apple_Computer

If the new owner is imposter trying to be the old owner, it would be identity theft and fraud. If it's just giving the handle to someone else there is nothing. If you don't pay for a account, you don't usually own it unless there is something I'm missing.

If you want to own your identity in the internet, get a website you own and don't rely on shady social-media networks that give you something free.

It's remarkably hard to actually "own" anything on the internet. The act of paying for something or not does not dictate what's your property - ASNs are leased, IPs are leased, domains are leased, connections are leased and you'll need to either pay or use someone else's to host something on the internet. The closest you could come is legacy IPv4 space and not rely on traditional infrastructure such as DNS.

Most registrars have decent trademark policies but again it's the internet. Just because you have a trademark in your country doesn't mean someone else doesn't elsewhere or that the registrar is going to care 5 years from now when the ToS change on renewal.

If you want to be securely verifiable on the internet you're better off being searchable and signing your content. The hard part is finding people that care enough to verify who you are in a decentralized manner for that to matter though.

I wonder how Let's Encrypt and other certificate authorities handle disputes over domain transfers?

A DV (domain validation) certificate shows the content came from the person in control of the domain (i.e. can change DNS records or change the server content) not that the person in control of the domain is "who it should be". With that in mind the person who can show current control is able to generate new certificates and issue revocations for old ones.

OV (Organization Validation) and EV (Extended Validation) certificates get into the "is it who they say to be" but Let's Encrypt won't issue those. What all getting validated entails is a bit more in depth for each of these and so is the revocation.

The ultimate protection in cases like domain transfers is limited lifetimes though. Gone are the days where the last guy likely had a 2+ year cert for the domain. Let's Encrypt is 90 days max and it's increasingly hard to get even 1 year from traditional players.

Interestingly you can "own" an Onion address for a Tor hidden service quite easily. You know the private key and nobody else does, so nobody can take your address away from you.

Yeah .onion addresses fall into the bucket of signing things (which works) and trying to get people to care enough to use it (which usually doesn't outside of extreme niches).

An interesting note on Onion addresses though is the top supercomputer is already at the level to be able to brute force collisions for any onion address in a little over a decade. I expect within about 10 years when this becomes a more imminent problem names will become longer.

If it's known that you are the owner a court can theoretically take it away from you. (Or at least jail you if you don't hand it over.)

Perfect.

That's the same level of ownership that you have over anything physical, which is the level of ownership that the comment I was replying to was saying is hard to achieve on the Internet.

Just because a fee is due annually doesn't mean you don't "own" whatever it is that you "lease".

In the real world, you still have to pay taxes and HOA fees on real estate property that you own; plus, have to put up (or finance) a huge deposit in order to "own" it. Same goes for any other large property like cars.

You're talking about trademarks, but trademarks themselves often require renewal every 10 years, where you have to continue paying a renewal fee in order to continue to "own" it.

The question of ownership comes down to whether you have a right to that renewal. As long as you keep paying the fee, you have a right to continue using that trademark, unless legal action is taken to challenge it.

Can you say that about your Twitter handle? Do you have a legal right to keep using that Twitter account, and if Twitter tries to give the account to someone else, can you get an injunction preventing them from doing so? (Now, same question but for your FB, Instagram, email, domain name, etc etc.)

Platforms charging $1/year for a social media account seems like a reasonable solution to a number of problems.

That's really not a bad idea like you own a domain you own your federated account on a Platform, you can self host it or put it into their cloud (costs 1$/mtn)...yes yes i know mastodon or diaspora but facebook and twitter should be forced to go a "federated" way, with that they could rip out most if not all of their problems they actually have, and you have all the rights you want (if you host it).

Interestingly, this is the same issue we're seeing in the Senate: in the void where formal rules of procedure should ecist, we're left with 'traditions' built entirely on the shaky premise that everyone is acting in good faith.

No matter who did the take-over, whether it's a Facebook employee or not, it would likely fall under a wire fraud.

This is most definitely against Facebook's internal policies. Therefore, the employee "exceeded access rights" on a protected computer system, by doing something they clearly were not allowed to do. That is a violation of the CFAA (Computer Fraud and Abuse Act), which is a federal felony. Further, the person that actually has possession of the account is likely guilty of either bribery or "honest services fraud" [1] for inducing an employee to break the law in exchange for money or other enticements.

[1] https://werksmanjackson.com/blog/what-is-honest-services-fra...

The term 'legalism' probably isn't what you're looking for here. I think 'Law' would be better suited.

The biggest problem is that a lot of these companies no longer have support for the average users, so, you simply have no way to escalate the issue, other than Hacker News or the like.

It's this support-through-Hacker-News phenomenon that must be addressed. One CDN is especially notable for doing this -- they may delete your site w/o an explanation, and then if it blows up, their CEO or CTO comes here to say not to worry, that you can always contact him directly here through HN or the special email. What if you don't have or don't know HN? We never get any follow-ups or postmortems for these incidents, either; with the companies brushing the whole incident as a private matter, never respecting the wishes of the user to share the details publicly, never sharing the details with the user itself, either.

P.S. Looks like Danny Hall got the account restored a few hours ago with all the pics; but he didn't seem to have received any explanation, either; probably never will.

You’re assuming the attacker was telling the truth about “knowing someone” at Facebook. More likely they figured out how to bypass 2FA (e.g. sim swap, socially engineered a customer service account recovery workflow, etc.)

Yes, that's the simplest explanation. Not that Instagram is above giving an existing nobody's account to a VIP, but they're not going to do that without wiping its content, and notifying the nobody first.

> notifying the nobody first

They certainly never do this. SOP is just to swap the existing account to a different name.

Hey, I knew you on IRC a long time ago. You hooked me up with some SuperVPN proxies that worked for a few years. I left the scene about the same time because of YUI's arrest- I wanted to say thanks. I've been thinking about HTP and co a lot recently, because of my work. Also want to thank you for pwning r000t.

Whoa, a blast from the past. I vaguely remember you. Wonder what YUI & co are up to these days

I don't think the "theft" of the username would break any kind of law, as this was a company decision (since it done by an employee) and the username was never your property anyway. I'm assuming that employee definitely violated some internal policies, but nothing from a legal point of view.

The only recourse I can see from a legal point of view is that they seem to have handed over the entire account (as the followers seem to have been carried over), which contains private data including DMs, stories, archives of deleted pictures, etc. Given that the original owner of the account is based in the UK, GDPR should apply. I wonder if people he talked to via DMs (as well as those with private accounts who granted his account access) would also have a case, since Facebook's actions have disclosed private conversations & contents of private accounts) to an unauthorized person.

I don't have a Twitter account but if someone could suggest this person to complain to their local data protection regulator (the ICO in case of the UK) that would be great.

I wonder if the justice department would go after somebody who overtook Donald Trump or other high profile official. They might make the case based off national security as the legal rational. But, otherwise I do agree with your point.

I think the OP's point was that there _should_ be a law, and that the current legislative framework is insufficient.

There are plenty of laws that would give rise to remedies in this situation. Contrary to popular belief, tech companies aren't invincible to lawsuits. Neither is the guy operating the stolen account.

The issue isn't whether or not there are theories under tort or contract that would cover remedies here - they would. The issue is whether or not this is something that's economically feasible to get in front of the courts - it's not.

OP is simply ignorant. There are many laws that would make account take-over an illegal activity - it would depend on what exactly the perpetrator did, but wire fraud and criminal conspiracy most likely apply.

If the OP's point is about consumer protection in case of any dispute with online provider, there's maybe a tiny bit of truth, but that's not a criminal law.

If the OP's point is whether there's sufficient enforcement and investigation for account take-over, that would be correct, but it's not clear if the society would be better off spending large resources on investigating those when there are much more serious crimes not being investigated sufficiently and when companies are generally doing reasonable attempts at providing protection.

>and the username was never your property anyway

Usernames can be associated to content and brands that have been made on other platforms. I wouldn't be so sure about this.

There is absolutely a legal theory, and that is fraud. If you claim to be someone you are not, and someone relies on your false claim to their detriment, you are liable.

My point was whether Facebook itself committed a crime and whether the account holder had any recourse against Facebook. To me it doesn't look like it - the username remains the property of FB and they are free to do anything they want with it.

It might take an open-minded judge to accept this, but attorneys often fall back to common-law negligence when there are no stronger legal theories to rely on.

All the elements of negligence seem to be here, except probably for duty of care. A judge would have to find that Facebook owes a duty of care to its users to protect the integrity of its identities, and that Facebook breached that duty.

I can foresee Facebook and other information service providers fighting vigorously against such a legal conclusion, but maybe it's just the kind of law we need.

If somebody hijacks your account, they get access to all your DMs and other private info. Are you claiming that all that is fb's property, too?

Fraud seems a stretch. Maybe if you used your handle for commerce and someone stole it & attempted to sell the same product.

It doesn’t strike me as litigation you’d be likely to win.

> Maybe if you used your handle for commerce and someone stole it & attempted to sell the same product.

That would be an example -- but certainly not the only imaginable one -- of reliance and detriment, both of which are necessary elements of fraud.

It's likely that Facebook was defrauded here, or that an employee of Facebook breached his employment contract. In either case Facebook would have standing to go after the fraudster/employee, but the account "owner" might not.

It's not only the user name. It's the photos, chats, etc.

Of course one should backup the photos outside Instagram or any other service but I have no idea if Instagram allows that. For Whatsapp on Android it's as easy as syncing the pictures folder on the phone to my computer. Then I backup them with all my other files.

Maybe it is against the terms of service? So it'd be a violation of a contractual agreement?

But no money changed hands, so not sure about that.

Contracts don't have to involve money, just something of value on both sides.

In Cali you can go to the police. https://www.stimmel-law.com/en/articles/californias-computer...

And yet, you might find yourself being held legally accountable for what's posted

Do you

A) Trust the competence of the government to understand the nuance of technology to not pass a law that takes into account all of the Nintendo’s consequences. During the dog and pony show when the house had the 4 tech CEOs to testify, one representative asked Zuckerburg about Twitter’s policies.

B) The impartialness of judges, prosecutors and regulators? Trump is now trying to get a law passed because he didn’t like Twitter’s policies. Would judges appointed by the current administration be more likely rule in favor of “Planned Parenthood” or”Black Live Matters” if they both made a claim over @blm?

As far as a third party. I would much rather have an independent non profit set up and FB, Twitter guarantee funding for them over 10 years and they do binding arbitration. They woukd be hopefully better informed.

> I think this is indicative of the biggest problem we have had with social media: there is no legalism here, just "codes of conduct" that companies and users both willfully ignore.

This is a good thing! If Congress is given the task of creating "modern" Internet legislation, they're almost certainly going to fuck it up somehow. We got a taste of this when Orange Man threatened to nuke Section 230.

Lost your Instagram account? Dude, that is nothing. I lost my company in Shit-hole country Estonia and 20k with it.

"I think this is indicative of the biggest problem we have had with social media: there is no legalism here"

I think the concept of law does not go very far in Estonia.

You're gonna have to elaborate on that.

I am an e-resident and I "bought" a company in Estonia from another company in Estonia, owned by a Russian scamster. Both companies do exist and are in "good standing".

Estonian authorities don't care about criminal activities, wire fraud or money laundering. In fact, I wasn't even able to get a case number or in most cases even an answer. So this guy is selling the same company over and over again. Not a bad business for him.

In the end, if you think about it, this may be the whole idea of the eResidency. It has become very difficult for companies held by eResidents to open any bank account in Estonia since banks are smarter and are afraid to be cut off from international money transfers. Most of these companies therefore hold bank accounts in other EU countries. Mostly new online banks.

Regarding the Estonian law enforcement, why should they care? It is hard to explain something to a man if his salary depends on not understanding it. And in the end all these companies bring in revenue.

All leads will point you to cybercrime [AT ] politsei.ee From dozens of emails I never received any reply. It seems not to be monitored. Funny.

Have you detailed this online someone (eg lengthy blog post) or similar?

If no, please do so and point people at it. There isn't much/any info about this kind of problem with eResidency companies. Getting the info to be widely known will help in getting it addressed. At least for the next people. :/

Why the downvote?

Because it's unrelated to the topic at hand? If what you say is true then it's interesting but that's not really the place to discuss it.

We were talking about there is no "legalism" and accountability in this thread. (Kapura)

Reply on news.ycombinator.com