If a key is taped to the outside of the door that it opens, you still can't use it without committing a trespass. Not unless you got authorization to use it from the right person(s) first. Shitty security isn't a legal invitation.
You get to a door, and there is a postit note on the door saying "Keycode is 2424".
You know your job is in the building. Your keycard let you into the room with the door. Therefore, if this door lead to a "high-security" area, surely they wouldn't put a postit note there? Maybe, as the bug exterminator, or maintenance person, it is expected that I should be able to enter that room?
Once you start playing around with someone's remote API then I'd strongly advise you to consider it more like a door around the outside of a building. If you want to argue about that with me, then you may wind up arguing about that with a judge.
The “key” analogy though is a bit stretched.
It is clear that here, the credentials were used in a way other than intended.
The questions are now rather “is it reasonable to expect that a person interacting with a website normally would reasonably be permitted to use anything sent to them by that website in any way they choose?”
A lot of us here are more tech-minded and would likely say “yes, if you don’t want people using credentials, don’t provide them”. The courts on the other hand may take a different view and say “well we already restrict what people can do with content on a website through copyright laws, this person should not automatically have the right to use those credentials in any way other than the way provided”.
It will become even more complicated if the website has terms of service which clearly state something which has a similar technical meaning to “no trespassing”’s physical meaning.
The vendor put the master keys of the main database in a publicly-accessible package. It’s insane.
Of course the researchers tested the keys, to check whether it was true. If it can be proven that it was used for nefarious reasons, then ok for blaming him, but as far as we know, the researcher just used it to get convincing evidence and left the system.
The company is to blame 100%, and the research should get an encouraging award for white-hat reporting. Not this.
Now that we’ve made clear that no-one is doing its job, YES, free citizen should be able to try to poke into the awful security of corporate IT systems and report it in good faith without even spending a second dealing with trouble.
The right to pen test businesses doesn't actually exist.
then how does the analogy play out?