Hacker News Reader

Comment by formerly_proven | Hacker News Reader

Hard-coded, publicly available credentials are criminal to circumvent in germany. See https://www.heise.de/en/news/Modern-Solution-Court-of-Appeal... which is now settled, since the appeal was rejected. https://www.heise.de/en/news/Federal-Constitutional-Court-re...

> At the end of the trial, however, this had little impact on the verdict. The presiding judge stated for the record that the mere fact that the [publicly available] software had set a password for the connection meant that viewing the raw data of the [publicly available] program and subsequently connecting to the [publicly available] Modern Solution database constituted a criminal offense under the hacker paragraph.

Yes, taking publicly available data verbatim (no ROT13, nothing) and talking to a publicly available server on the internet can in fact be a criminal offense.

View on HN

Thank you for providing an example that is exactly showing how messed up this is:

> Der Vorsitzende Richter gab zu Protokoll, dass alleine die Tatsache, dass die Software ein Passwort für die Verbindung gesetzt habe, bedeute, dass ein Blick in die Rohdaten des Programms und eine anschließende Datenbankverbindung zu Modern Solution den Straftatbestand des Hackerparagrafen erfülle

> The Judge gave to protocol that just the fact that the software requires a password for the connection, implies that a look at the raw data of the program and a subsequent database connection is considered hacking.

So yes, entering an empty password can cause all of your electronic devices in all your registered residences to be seized as evidence.

Note that the decompilation is on the complexity level of "strings $binary".

Germany is the most contradicdory country I know of, and such a huge warning flag to anywhere else. For decades, half of children's education has been spent on hammering in "Never Again". Surely there are two huge lessons to learn there: 1. Do not judge the value of people based on their biological characteristics they were born with 2. "I was just following orders" is not an excuse, and one needs to instead do what is right regardless of protocol.

There is no European country which does a worse job at both of these. Germany is easily the number one country in the world for "protocol is everything". It doesn't matter how detrimental and damaging the rules are, the rules are the rules, and they must be followed. This case is the millionth example. The rules are interpretable as it being illegal to access data with a publically available password using this password, so we're going to apply them, despite it being patently absurd. For the first point, German's reponse to Gaza (the slowest in all of the West) said everything.

German government and courts are as opportunistic as everywhere else. German government ignores EU laws (ex: water protection), its own courts (ex: air pollution court orders, time record keeping for teachers) and worker protection (ex: false self employment of music teachers).

> The rules are interpretable as it being illegal to access data with a publically available password using this password, so we're going to apply them, despite it being patently absurd.

I very much agree. I do think that this kind of ethical hacking should have a legal framework around it, to protect both sides during such an access. But this should be more on the basis of responsibly minimizing access to protected data as well as minimizing foreseeable damage.

For example - running a select on a database may show you private and protected data, but if this is done to validate a problem, fine. Start digging for data on specific persons? Touch something called "Pump Controls"? This would however require technologically competent judges, and those are rare.

As I said, a frustrating topic and it will become very interesting if a hostile state starts pushing on this.

Reply on news.ycombinator.com