Hacker News Reader

>Basically, I would say that unauthorized access should require some material deception to gain access. So if you socially engineer your way in, it's unauthorized--you lied to someone. If you use a computer virus, it's unauthorized--you lied to the computer to get it to execute that code, probably misrepresenting it as some other type of data. If they set the permissions wrong or it's just an AUP thing, it's not unauthorized access. Though, as here, it might be against the law for some other reason (violation of privacy or whatever).

Interesting test. What if you set your user agent to chrome instead of firefox and that grants you access to a website?

That would arguably be wire-fraud (you lied over an electronic network in order to get some material gain).

Yeah, cases like this are a bit harder. Part of the idea is how important the lie is to gaining access. It is difficult to distinguish a relatively harmless lie like this, or claiming to have actually read the 1,000,000 page AUP, to someone impersonating another.

> What if you set your user agent to chrome instead of firefox and that grants you access to a website?

The website is at fault. This is no different than lying about your religion to bypass a discriminatory shop owner.

But where do you draw the line re: which type of "lie" matters?

A naive generalization might say that "lying" by setting a header = illegal. But clearly there is a difference between setting the Authorization header and setting the User-Agent header.

But what about headers that are not so well-defined? What about custom headers?

I'm not disagreeing with you, but these are the first questions that come to mind.

It seems that a judge would have to carefully consider the design of the system, and whether the vector that granted access was something that was clearly negligent on the part of the site owner, or was truly an attack vector and deemed illegal. But it seems difficult to formulate a universal test for this.

> But clearly there is a difference between setting the Authorization header and setting the User-Agent header.

No. If you falsify information indicating that you have authorization to access the site, it doesn't matter what header it's in. Conversely, if you falsify information that has no bearing on whether you have authorization to access the site, it also doesn't matter what header it's in.

You are either authorized to access the site (or URL, or whatever) or you are not. What tools you use to do so are only relevant if they cause you to generate accesses (eg network requests) that you are not authorized to make. By construction, configuring one tool to generate accesses as they would have been generated by another tool does not produce unauthorized accesses unless that other tool's normal accesses would be themselves be unauthorized.

> Conversely, if you falsify information that has no bearing on whether you have authorization to access the site, it also doesn't matter what header it's in.

Ahh, but here's where things get tricky. Who decides that the information has no bearing on whether you have authorization to access the site?

Imagine a situation where a very poorly designed site allows "My-Obscure-User-Agent", but denies all other User Agents. This is obviously a horrible design, but if the intent of the developer was to authorize access to a specific set of internal clients, identified by a unique/non-standard user-agent, how would you classify the act of changing one's browser settings to send the accepted agent?

User Agent is a great example of something that has a pretty well-defined purpose (and that purpose has nothing to do with authorization), but has also been misused by naive or lazy developers to control access to sites.

I think the tail end of GP's comment answers your question:

> configuring one tool to generate accesses as they would have been generated by another tool does not produce unauthorized accesses unless that other tool's normal accesses would be themselves be unauthorized.

Therefore: When you generate a request that spoofs the obscure user agent string, it is authorized only if you were also authorized to use the obscure agent. The string is a secret like any other, even if it's a secret shared by the entire group of people who were provided with the obscure agent.

On the other hand, is it really a secret if the agent tells it to every server that the agent connects to? At some point it's not a secret if little care is taken to protect it (and the name of the header has some bearing on what care is taken, for example whether it ends up stored in clear text in access logs...).

> Therefore: When you generate a request that spoofs the obscure user agent string, it is authorized only if you were also authorized to use the obscure agent. The string is a secret like any other, even if it's a secret shared by the entire group of people who were provided with the obscure agent.

"it is authorized if and only if you were also authorized", but otherwise yes, exactly.

I originally wrote something like that, but removed it to fix wordiness. There's a difference?

  |  A  |  B  |A-only-if-B|A-if-and-only-if-B|
  |false|false|   true    |       true       |
  |false|true |   TRUE    |       FALSE      |
  |true |false|   false   |       false      |
  |true |true |   true    |       true       |

Arguably it's nitpicking (the unmodified statement is true, just less precise), but I like to say "exactly" when people rephase my statements in a more/differently clear way than I managed to, and don't like to say false things.

I think your matrix depicts that [the hypothetical scenario where a person is unauthorized to spoof the obscure UA string, but is authorized to use the obscure agent] is allowed when saying "only if" but is not allowed when saying "if and only if" -- if I'm reading it properly. If so, and only if so, then I disagree with you; to me, the "if and" does absolutely nothing but add wordiness without changing meaning.

However, if the columns of your matrix were modified to compare "if" versus "[if and] only if" (where square brackets represent an optional component that does absolutely nothing), I'd agree with the logic, being analogous to the difference between OR and XOR (for the boolean sense of OR, not the English sense which is akin to XOR).

> if I'm reading it properly.

And now I'm not sure I'm not the one who isn't reading things properly. (And that sentence probably doesn't help matters.)

I'll point to (the "only if" part of) https://en.wikipedia.org/wiki/If_and_only_if#Distinction_fro..., which I think agrees with me and disagrees with you, assuming I'm not misreading one or both.

> a very poorly designed site allows "My-Obscure-User-Agent", but denies all other User Agents.

> to authorize access to a specific set of internal clients,

Are you, the person, authorized to access the site? If yes, setting a User Agent header to "My-Obscure-User-Agent" is truthful (insofar as it bears on whether you (the person) are authorized), regardless of whether you are using the prescribed internal client. If you are not authorized, the use of said internal client doesn't change that.

Edit: as a analogy, suppose you took a job and your employer provided you with a uncomfortable uniform jacket which your employment contract stipulated you must wear when on the job. If you acquired a more comfortable jacket and dyed it to resemble the uniform, your employer would (arguably) be within their rights to refuse you access (blocking by user-agent), but if they let you in, that does not mean you have entered (the employee-only portions of) your workplace without authorization. Same applies to cars, phones, power tools, etc; you may have done something wrong by bringing them to work, but that something is not unauthorized entry.

I would not say “no different.” Religion is a protected class[1], web browser preference is not. The law does not treat all kinds of discrimination equivalently.

[1] https://en.m.wikipedia.org/wiki/Protected_group

I don't know... some people are pretty fanatical about their web browser preferences.

The CFAA requires you to have effective security measures, or something of the sort. I'm dubious a User-Agent filter qualifies, especially so if it's only filtering for the largest browser by market share.

Fwiw, from my readings of similar cases, this seems similar to how the courts read the law. Any access you can achieve without material deception is valid. There was a case on here a while back where a couple of reporters filed a FOIA request and the city accidentally put records not meant for release in the Dropbox folder. Reporters downloaded the accidentally-added files, city sued. The city ended up settling because it looked like the court was going to rule against them.

The court's logic was basically that by allowing access to the information, you have de facto authorized the user to access it. It would be impossible to tell whether you can legally access any information if the counterparty can give you access and then decide you shouldn't have seen it when you do access it.

I think the problem with the deception test is that if the login screen for the DMV database access had a checkbox that said "I am only using the system in a way consistent with department policies" or something, then you could argue that checking that box was deceitful.

I think Congress' intent with CCFA was to criminalize hacking. There are already laws against fraud, so we don't need a deceitfulness test to catch, say, social engineering. The problem I think is that CCFA was written in 1986 and not enough people understood what hacking was well enough to write it down clearly in the law, so instead the "excess of authorized access" language is in the law, and has been used to criminalize lots of things that aren't really hacking and Congress didn't intend to criminalize with the CCFA.

I think that is a real worry and you're not wrong that that's a hard test to pass. I just wish for a brighter line over what 'unauthorized' means and it's hard to do that in a way that doesn't let companies write AUPs that effectively define the scope of criminal laws in some way.

The decision talks about a gates-up-or-down analysis, which seems like the seed of a reasonable test: when the gates are up, entering a restricted area isn’t criminalized; when the gates are down, picking the lock or finding a home in the wall is criminalized.

I haven’t read the decision closely enough yet to see how well developed that idea is.

What if I, as your employer, say "you're not authorized to look at records that haven't been assigned to you" and you then look at a record that hasn't been assigned to you - is that unauthorized access?

edit: I certainly don't agree that the distinction between access to a file in a file cabinet and a record on a computer should be significant. I think it's a dumb law. But the unauthorized access test is straightforward. If I work at a company that disallows internet browsing other than for work purposes and I visit my facebook page, I think that's a clear case of hacking under the "authorized access" test, and my only real defense would be that I needed to check facebook for work.

I'd say that should only be fraud if you lied to get access, I don't agree with interpretations that allow any random AUP to create new felonies.

Don't get me wrong, I understand how that can be straightforwardly interpreted as "unauthorized access." I'm advocating for what the law should be, in my view. The idea is to make a bright line that gives a test for mens rea to avoid over-criminalization while not being too unreasonable. I'm sure there could be scenarios I haven't thought of that would turn out poorly.

That is "hacking" the same way opening an unlocked filing cabinet you were told never to look in is "lockpicking".

>is that unauthorized access?

Yes. And SCOTUS's problem is that they think the punishment for visiting facebook at work shouldn't be the same as the punishment for stealing company records - and that's fine, and of course something I agree with. But SCOTUS should actually address that directly, rather than going down this weird path of trying to warp the definition of "authorized".

> rather than going down this weird path of trying to warp the definition of "authorized".

I don't think they are. I think SCOTUS is looking at this, as is their wont, from a legal perspective.

We have two legal systems: civil and criminal. Both of them have the concept of "authorized." What SCOTUS has said here is that whether or not something is unauthorized may be a civil tort claim--you broke a contract--versus a criminal offense--you broke the law.

That seems to be the knot everyone is trying to untie here. It's not illegal for me to break a contract with someone. It is illegal for me to break the law.

That isn't "hacking" as defined by the CFAA (according to this ruling). It's certainly not following your employer's policies, but your employer policies should not rise to the level of potential federal criminal prosecution.

Now, if your employer put software on your machine or on their network that prevents you from viewing Facebook, and you work around that restriction, it could be argued that you have now "hacked" their network and gained access you were not authorized to have.

The distinction is pretty clear in the ruling - if you have access, you can do X without it being considered a violation of the CFAA (doesn't mean you can't be fired, or prosecuted for other crimes leading from the actions, or other repercussions). If you don't have access, and you figure out a way to gain access, it is now a violation of the CFAA.

> Basically, I would say that unauthorized access should require some material deception to gain access.

This seems like a poor definition, IMO.

For example, what if I tell you I'm going to club you over the head and get access to the computer you're on. And I do so. There was no material deception. I did exactly what I said.

Another example is what if I just walk around the counter while you're not there. There is no one around to deceive.

But then that would be considered hacking only if you used an axe.

Presumably the argument is that you are "deceiving" the computer into thinking that you are the person whose head you clubbed, or who walked away from the counter.

Only if the computer had some type of technical authorization associated with it.

> For example, what if I tell you I'm going to club you over the head and get access to the computer you're on

That's either a true threat, or assault and battery. It only becomes computer fraud if you fraudulently use my credentials to access the computer.

> Another example is what if I just walk around the counter while you're not there. There is no one around to deceive.

That's trespass, not computer fraud.

There's more than one crime on the books. Saying that something isn't computer fraud isn't claiming that all those things should be legal.

Like in this case, I think it should be bribery more than computer fraud.

> That's trespass, not computer fraud.

Why is that trespassing? There's no sign that says I can't go behind the counter? In fact, in many cases you can go behind the counter, just you aren't expected to jump on their computer. The problem isn't that I'm behind the counter. The problem is that I'm using a computer I'm not authorized to use -- it's just whoever set up the computer didn't set up an authorization gateway.

But really access to the computer really isn't fraud. It's what you do once your at the computer that matters much more. Its authorization for the action that matter, not access authorization.

There’s actually an argument to be had around how illegal this should be.

Let’s take computers out of the picture again. Suppose I know that an organization O throws out folders with sensitive data D into the trash can in their publicly-accessible lobby every Friday at 3 pm. People that want to know D pay me to come there at 2:55, root through the can and write down the pieces that they need.

Should what I am doing be illegal? Whatever your answer, is it in any way different from walking around that same lobby sniffing O’s open Wi-Fi network except for “computers were involved”?

So how is this any different than my front door if I don't lock it. Can you just walk around in my house if the door is unlocked. Trespassing doesn't depend on doors being locked or not. The act of trespassing (and most crimes) doesn't depend on the victim setting up a suitable defense before what you've done is a crime. Even things like sex require some sort of consent (implied or otherwise) or it's a crime.

Can I walk into a bank and take all the money from the vault if they leave it open? But yet somehow with a computer that isn't yours you seem to be stating that if you don't properly protect it then access to it by anyone who happens upon it is completely legal.

> Why is that trespassing? There's no sign that says I can't go behind the counter?

You wrote it as if it's somewhere you're not authorized to be, e.g. an Employee's Only section which would tend to be trespass. If you are authorized to be there and they leave records out that they shouldn't, I think that failure is on them and they need to improve security.

If someone leaves a database of everyone's personal details on an open webserver, that doesn't become hacking or computer fraud if someone visits the site. I mean, I don't think it should be true that I could say "you, specifically, aren't authorized to read this post" and have that morph into a federal felony.

In my view, there has to be at least some kind of notice that someone is crossing a criminal boundary. I think lying makes a decent, if imperfect, boundary. It's possible that someone can think of something better, too.

> For example, what if I tell you I’m going to club you over the head and get access to the computer you’re on. [...] There is no material deception.

Then there’s no hacking and you should be charged with assault or whatever else is appropriate.

> Another example is what if I just walk around the counter while you’re not there.

Then it doesn’t matter if there was an unlocked computer or an unlocked cabinet behind that counter.

There doesn’t need to be, for every illegal act X, an extra special law or punishment for “X but a computer was involved”.

People want a criminal penalty for hacking and maybe they’re right, but you shouldn’t try to cover every undesirable act that involves a computer with a single law any more than every undesirable act that involves a piece of paper is covered with one. You also shouldn’t claim that breaking down a door is the same as walking through an open one, even when both constitute (among other things) trespassing.

This is the frustration I have with things like "cyberbullying laws".

I mean, sure the usual "plain ol' bullying laws" might need an update to keep up with the times but a whole separate set of laws just to capture "but it used a computer" is silly.

Mind you, I also have a thing about professional sports breaking out into punchfests. They should get prosecuted for assault or whatever just the same as anyone on the street.