Hacker News Reader

Comment by Veen | Hacker News Reader

I wasn't aware companies could, by fiat, declare certain publicly available endpoints private, thereby compelling everyone by force of law to pretend they don't exist.

View on HN

My bank's website is publicly available. That doesn't mean anyone is free to access my bank account. Just 'cause something is accessible on the internet doesn't mean you have the right to access it. Case law and statute goes back at least to the 1980s on this point.

The aforementioned tools do nothing whatsoever to grant to access accounts which aren’t theirs.

I know. That’s not what I said.

> That doesn't mean anyone is free to access my bank account.

People have gone to prison over guessable GET parameters

https://en.wikipedia.org/wiki/Goatse_Security#AT&T/iPad_emai...

https://www.praetorianprefect.com/2010/06/114000-ipad-owners...

Citing convictions overturned on appeal probably isn't the strongest evidence of illegality. (Because they were overturned on threshold issues that didn’t involve inquiry into the substantive merits of the charges, its not evidence against illegality, either, but...)

My point is people have gone to prison over GET parameters, not the legality of the it. DOJ has CFAA. Abusing private APIs is flying close to the sun. Even if you do get out of prison eventually

> My point is people have gone to prison over GET parameters, not the legality of the it. DOJ has CFAA.

And CFAA is limited by Van Buren.

They can. Now you know.

So, if I create a cat GIF API, but announce that it's a private cat GIF API only I am allowed to use, I can sue anyone else who uses it to retrieve a cat GIF?

Legally and literally: yes.

Knowingly using a private API without authorization can fall under CFAA, contract law, copyright law, trespass to chattel, etc -- and you can issue a C&D and/or sue for whatever is relevant.

Reply on news.ycombinator.com