Hacker News Reader

German courts/laws seem to be very hostile to anyone exposing security flaws.

I remember a story posted here where someone found a hard coded SQL connection string in decompiled code, connected to the server with it, and notified the company. Then, the company took the person to court (claiming something nonsensical about circumventing security) and the courts agreed.

There was even people on HN siding with the courts that decompiling code and finding the key is circumventing their security which is madness.

> Why can't I personally test the security of my bank?

I don't understand this perspective. What's the difference between tihs and being allowed to try and walk into all the back rooms of your bank and read everything you can? Or do you think you should be able to do that?

Should I be prosecuted for walking up to my credit union after closing and trying to open the front door to see if it's really locked?

No, just as you should be able to type your bank's URL in your browser even if they've taken the website down.

If you proceed into the building? Almost certainly.

If you put the doors or windows through a stress test? Again, almost certainly.

What if you have money in the bank and the bank has been robbed thousands(!) of times because they forget to lock the windows. Assume nobody is going to do anything to make the bank change their window locking habits, or lack thereof.

At this point in the analogy, do you personally believe it is worrisome if an upstanding citizen thinks "I wonder if they forgot to lock the windows again?", and they check to just to see. Is the solution in this scenario to harshly punish the citizen while doing nothing to the bank or their windows?

(!): I say thousands because https://haveibeenpwned.com/ reports that my email address has appeared in almost 3,000 (three thousand!) data breaches.

This doesn't really help the scenarios, though? In fact, if you know that a place has been the source of a ton of crime, physically going there is a terrible idea. Not sure why similar wouldn't apply for this?

I'm... also very curious what expected numbers are there for data breaches? I'm seeing 12. How in the world are you at 3,000?!

I haven't given my email address to any websites that are involved with pornography or other disreputable things, nor have I given my email to any website with connections to illegal activities.

The number of leaks with my specific email address doesn't really matter. The point here is that there are thousand and thousands of data breaches happening all the time. These all affect real people. These all have wronged people, and these people have no redress.

Your gut reaction of "there's a problem, let's criminalize" seems to match the general consensus here in the USA. We'll criminalize and jail endlessly, but it's not working, the problem is getting worse, more data breaches happen all the time, airlines cancel all flights, hospitals cancel medical procedures, all because we can't build secure IT systems. The problem keeps getting worse despite our criminalization.

One thing we wont try is expecting competence and accountability (financial liability) from our wealthy and powerful organizations. Nor will we try empowering upstanding security researchers, and meanwhile criminal hackers continue to act with no regard for the law.

Where did I give my gut reaction? It would almost certainly be more inline with finding processes to improve things. I'm all for pen tests and similar. Bounty programs are also good ideas.

The topic here, though, was whether or not casing out a location would get you in trouble. And, yeah, if you are casing out a place you can get in trouble. Regardless of how much crime has or has not happened there. Indeed, I would stipulate you are less likely to get in trouble if you are checking out a place that has not had crime.

And apologies if you thought I was blaming you on the leaks. Not my intent, at all. Genuinely surprised to hear you get 3,000+ hits. Moreso with how few hits I get, relatively.

I apologies as well. It's easy to argue against comments as though they're all from one person, even though they come from different people.

You say the topic here is whether or not casing out a location would get you in trouble. This illustrates a problem with analogies, we are now several comments deep in a discussion about an analogy. I original spoke about the security of virtual IT systems, and an analogy was made to the security of physical buildings. A computer program and a physical building are quite different, but here we are talking about physical buildings. I don't want to talk about the security of physical buildings anymore.

Totally fair! In discussions this big, I often do not try and speak to multiple threads at the same time. If only to dodge this sort of confusion.

My specific entry to the thread was to say that you are likely to get in trouble if you try the door of a bank and walk on in if it is open.

IT systems on the internet are not like physical locations in a peaceful society. The analogy falls apart very quickly.

IT systems on the internet are constantly approached by millions of actors, good and bad, and if they are designed correctly then this is no problem and is not a burden on anybody. This is very unlike a comfortable office setting in a peaceful society.

You are making an analogy between modern banks and IT systems. Modern banks are almost never breached, while IT systems have major breaches every week. That's not a fair analogy.

> Why can't I personally test the security of my bank?

For the same reason your bank can't test how well you store your PIN and secret phrase, I imagine. It's not in the contract between you and the bank, and the general law doesn't allow for it ("I was not trying to burgle that house, Your Honour, I was testing its security" — "That's a nice joke, mister, so I won't you hold in contempt of the court. Still, guilty, five years").

> Why can't I ask an organization I trust to test the security of my bank?

For the same reason the bank can't ask an organization it trusts to test how well you store your PIN and secret phrase, I imagine: it's not in the contract.

And good luck trying to find a bank that would agree to let you inspect their security.

Trying locks on a house vs. sending payloads to an internet exposed server are not analogous.

I've seen this time and time again on HN. Making analogies that aren't clear doesn't result in useful discourse (people argue over the dumb analogies rather than the thing itself), kinda like I'm doing right now...

> Trying locks on a house vs. sending payloads to an internet exposed server are not analogous.

Well, go write your congressman about it (or however it's done whenever you are), because it sure does look like the lawmakers and the courts do seem those two things to be kinda analogous; but I doubt that arguing in the HN comment section about laws has ever improved (or will ever improve) those laws.

No, analogies are good. Calling them dumb instead of pointing out the difference is what's not useful.

Pointing out the difference? These two things (sending data over TCP/IP and testing physical locks on a house) are in two completely different realms.

I don't know what "different realms" means. It's an analogy, so it won't be two identical things. The question is: why doesn't the comparison make sense?

We need to include in this analogy that the bank is robbed every other week because they forgot to close the vault or they left a pile of cash sitting outside while they went to lunch. In such a situation if an upstanding citizen checks that the vault is actually locked--"did they remember to lock it today?"--the actions of that citizen don't concern me.

But let's set the analogy aside.

If companies want full control over their systems and who may test the security of those systems, that's fine with me, so long as their full control also comes with full liability. The problem is we currently give companies full control without any responsibility or liability.

Responsibility and liability are usually established in court, so go ahead and sue all the companies that have your data. Also you need to demonstrate that you incurred some tangible loss from a data breach.

Yes. To get redress I must pay hundreds of thousands of dollars in legal fees (try suing a company like Equifax or AT&T for less) and also provide detailed evidence of exactly what criminal organizations from all over the world have done with my data. Does this seem reasonable? If I fail to meet this standard does that really mean I wasn't harmed?

And does this standard apply the other direction? If I personally test the security of a company without permission, do they have to prove that I caused actual damage before I am punished? If the moral standard applies evenly, then I should be able to try opening the vault, and if I fail, no harm done. The bank must show actual harm before I am punished. But no, there is no even application of moral standards here; when it comes to individuals testing security the act itself is criminalized regardless of whether or not harm was done. It is even a felony to experiment with physical devices you own in many cases.

Analogies time!

I saw this big shiny vault had a side door unlocked, Your Honour. This vault stores my money as well, so I wanted to see - surely they wouldn't let burglars in just like that. I didn't break any lock, I didn't pass any sign. When I saw the door indeed led to the money, I left and wrote the bank a letter.