Hacker News Reader

Comment by stymaar | Hacker News Reader

> If it's auth-gated, it needs to be, well, authenticated.

AFAIK, there isn't an single auth scheme on earth that guarantee human intervention[1]. Anyone can set-up a robot creating new users on a whim using single-use email addresses and even phone numbers. In fact, we know that OpenAI's agent have been doing exactly that when attacking Rubygem. And all AI labs are likely doing it for scrapping social media as well.

Who are you gonna sue then?

[1] the closest thing is Altman iris scanning venture, but without a broad adoption it's remains functionally useless.

View on HN

By setting that up, you take on the liability for it. The defendant is whoever set it up. No different from "if I roll a car down a hill and it hits something at the bottom, how can you hold the car liable?"

That's not how ToS work though. ToS are contracts. If you don't sign the contract nobody can sue you for violating it.

> No different from "if I roll a car down a hill and it hits something at the bottom, how can you hold the car liable?"

That's the difference between criminal and civil justice. You don't need to sign a law for it to bind you, but for contracts you do.

> If you don't sign the contract nobody can sue you for violating it.

But terms of service are contracts which you sign by agreeing.

Courts have looked somewhat favorably on "I didn't read that" defenses, but accepting the agreement is a legal contract between you and the service provider.

My point is that you don't have to accept anything.

Sure. But then you don't get credentials and can't scrape.

Even if you get the credentials via middle man?

You keep saying that but unless company start doing KYC there's absolutely no link between auth and ToS.

The authentication mechanisms used by websites don't have a specific legal power, it's just a POST request among other GET requests sent during scraping. And we have jurisprudence saying scrapping is legal no matter what the ToS of the website says, because the scraping entity never signed up the contract.

The only protection against scrapping that auth is giving you isn't a legal one, it's a technical one (you can detect and ban the scraping user account).

*scraping

> That's the difference between criminal and civil justice. You don't need to sign a law for it to bind you, but for contracts you do.

Patently false: https://en.wikipedia.org/wiki/Implied-in-fact_contract

The person who sets up that robot is the person responsible and effectively signing the contract by those actions.

> Who are you gonna sue then?

The person who set up the robot.

It seems that simple, I agree, but digging in we're winding up in a bit of a "responsible party" black hole, at least it seems from my non-legal engineer perspective. If I ask an AI to find me articles on some arbitrary things and it hacks the Gibson to do it; and I am not a computer expert, it will be a struggle a bit to honestly put the blame on me. It's always been that way I think.. in what reasonable world can a non-lawyer agree to 100+ pages of a ToS and actually understand it? No world. But that's the point I think. What if I modify every TOS in HTML before I submit it and then agree by checking the box under my "redlined" version of the contract? I think this stuff is going to become exponentially murkier as time goes on.

Completely agree that the world is full of absolute nonsense, but legally determining responsible parties appears to be relatively straightforward (but does involve a judge or jury)

Yes, agreed. Except "involve a judge or jury" is where the wildcard comes in. I believe there will be reasons to doubt culpability as we move further into the nonsense. Justified or not. My point is really just that we're in some weird territory, so I guess I'm going to make popcorn and watch. Some deeper legal questions lurk in this mess, and I don't think the obvious answers will always necessarily be right.

Good luck finding them or proving it, esp. if done via third party contractors in another jurisdiction

It's much easier when they release huge PR whitepapers about how many felonies they've committed recently, I think. Makes the civil suit much more straightforward in my opinion.

> The person who sets up that robot is the person responsible and effectively signing the contract by those actions.

If that was true, then all scraping of a website with a ToS would be illegal, yet it's established by jurisprudence that it's not. And “authentication” doesn't change the picture here in Amy way, because it's not actually authentication.

> all scraping of a website with a ToS would be illegal, yet it's established by jurisprudence that it's not

Because terms of service require both parties to accept!

If I hold a contract outside your window and scream "you accept this contract" it doesn't bind you simply by looking out the window.

This is literally my point. A POST request on a roure called /login doesn't change anything to that fact.

Reply on news.ycombinator.com