Hacker News Reader

Comment by a_dabbler | Hacker News Reader

Sounds to me like the database credentials were embedded in the application so presumably the application would log in to the vendors server as an intended action. Does this mean all the vendors users must be charged with hacking also?

View on HN

The clue’s in the name: “misuse”.

Is there evidence he misused the data or the server? Did he download all the data and sold to third parties, spammed the hell out of existing users or anything like that? How is verifying the credentials misuse?

He didn’t just “verify the credentials”. He was in the database making queries, viewing private data.

"Viewing" private data for purposes of verification of the issue. How about you just don't ship passwords in the application like some negligent troglodyte?

How do you find out it was private data without viewing it first? How is that misuse of data if you just view it?

Extracting credentials from a piece of software to manually connect to a server without authorization in order to go spelunking is clear-cut misuse regardless of what data you find on the server.

The customer who hired this consultant was authorized to read that data because it was their data, not the vendor's; it was just stored on the vendor's server.

He was authorized to read that data. He was not authorized to freely access the server the data was stored on, or to extract the credentials from the software. This is an obvious difference that matters.

I can't break into an AWS data center to access my data, even if I they didn't have any security and I knew exactly where my data is stored. Not because I could be seeing other people's data but because I'd be trespassing.

Reply on news.ycombinator.com