Viewing website HTML code is not illegal or “hacking,” prof. tells Missouri gov. | Hacker News Reader

Viewing website HTML code is not illegal or “hacking,” prof. tells Missouri gov.

arstechnica.com

97 pointsglitcher19 comments

Ah, so finally the detail. The site was apparently an ASP.NET site, and they were putting the whole SSN into the "VIEWSTATE" object.

Which looks something like this in the html:

There is a choice to encrypt it, but I'm skeptical how useful that is, or that it was enabled in this case.

So the "hack" was "view source" -> decode some base64 data sitting in plain sight.

Edit: A little bonus. This bizarre video from a PAC the governor started, still trying to call this "hacking": https://www.youtube.com/watch?v=9IBPeRa7U8E

Wow, great job piecing together the “View State” comment from the article.

The docs on how to encrypt[0] this information has an interesting example use case:

> View state data is stored in one or more hidden fields on the page and is encoded using base64 encoding. ... In some cases controls might use view state to store information that no users should have access to. If those identifiers contain sensitive data, such as social security numbers (emphasis added), you should encrypt the view-state data in addition or instead of sending over SSL.

[0]: https://docs.microsoft.com/en-us/previous-versions/dotnet/ne...

You can encrypt it, but then it's useless for anything other than keeping state on the server side, and only across form posts. In which case a session id would be simpler. It seems to be a holdover ASP.NET feature from when browser support was weak for things like cookies.

In this case, they just really shouldn't have sent the SSN at all, as only the last 4 were ever displayed on the page.

It's always fun when someone thinks they are encrypting something when they Base64 "Encode" it. "Is it encrypted?" "Yes, it's encrypted using Base64!" Facepalm

My biggest fear is that nothing comes of this. The elected representatives of Missouri are making accusations that should be laughed out of court.

Agreed.

One interesting thing about Missouri is that, in addition to the Governor swearing to take care that the laws are faithfully executed, Missouri says that violating your oath of office is per se perjury.

In my opinion, the Governor needs to be impeached and prosecuted criminally for abusing his office in this manner.

who ever owns the choices leading upto , what amounts to distribution of a list of SocSec numbers +PII is in jeopardy.

i wonder how many browser caches currently hold that list.

now the next part is interesting, seeing as the government issued that list, is it now part of a public domain? can any one who distributes or causes it [list] to be distributed, be prosecuted?

If you care about this issue, please consider signing this petition urging Governor Parson to apologize.

https://www.change.org/p/governor-parson-apologize-to-st-lou...

Do petitions accomplish much? I don't know. Still, someone needs to tell this guy he's an idiot.

I would sign one requiring him to resign.

Incredible and terrifying that this needs to be explicitly asserted

Decoding viewstate might technically be illegal according to the DMCA, but shouldn't be and if the journalist is convicted they should be immediately pardoned.

Is the base64 in there actually a measure intended to stop copyright infringement? It can't be, base64 is completely transparent. The reason things are encoded in base64 is so that they can be transmitted in a subset of ascii (and thus be embedded in plain text formats like html).

Viewstate is base64 then a further serialized underneath, it isn't XML or JSON, but is totally readable enough to pick out fields.

In some states if you have screened in porch and you break the screen, it is still breaking and entering.

Even the base64 could be equivalent to the screen door.

I hope the reporter doesn't actually get prosecuted for this, but we need to fix some of our laws.

It's not nearly as bad as breaking a screen door. It's more like writing in a foreign alphabet, and then crying foul when someone can read that alphabet.

I think this is a much better analogy. I'd even go so far as to say that it would be like using Morse code and then being upset when someone else listening also knows Morse code. https://www.youtube.com/watch?v=8zfNfilNOIE

The Computer Fraud and Abuse Act outlaws "unauthorized access". The website owner clearly did not authorize access to that, so the letter of the law may have been violated. Maybe the law should require malice, criminal intent, and actual harm to have happened for "unauthorized access" to be a crime.

If you mail me a letter, and on the back of the letter you write a secret in French, would you claim that I wasn't authorized to turn the paper over and that I wasn't authorized to know French? Maybe don't write secrets on things you mail me or don't get upset when I read them.

Didn't they grant them access? HTTPS has access control mechanisms in place, if that page wasn't meant to be accessed, that's one thing, but it was literally a public page on their website. Furthermore, if it wasn't data the user was meant to access, why did the website owner transmit it to them? (And not just the Journalist in question, but everyone who had gone to that page while this was there).

Where this page not meant to be public, I'd tend to agree with you, but it was meant to be public and was transmitting this data to use as an identifier. The encoding its in is irrelevant, encodings are not encryption and this journalist did nothing illegal.

As I said here https://news.ycombinator.com/item?id=28948168, this is just an attempt at "it's secure because someone in authority says you can't look it at". That's not security, and looking at the information sent to the browser cannot, in any circumstance, be considered "unauthorized".

Reply on news.ycombinator.com