Comment by throwaway420 | Hacker News Reader

Comment by throwaway420 | Hacker News Reader

Parent Full thread

I'm harping on this word choice because most non-technical people do not understand what technical people mean when they say "hack", yet every newspaper article on this is using the word "hack" or "hacker" in the title and coloring peoples' perceptions about this case in a negative and unfair fashion.

If you use the word "hack" in front of normal people, they would probably view it as some neckbeard breaking passwords and bypassing electronic safeguards in a dangerous fashion. They would view it as equivalent to that scene from Mission Impossible where Tom Cruise is dangling from wires to break into the CIA or that scene in Terminator 2 where young John Connor gets easy money from the ATM. I use those popular references because that's what most people think is involved when you use the word "hack" when that's not the case here.

This case, if I understand it correctly, literally involved somebody visiting a URL. Whether he did so by typing it into his browser or using an automated program or not doesn't change the nature of the action to me.

I think the standard counter to this is that, if it can be reasonably assumed that you're not welcome to do it and if you're not being entrapped, then the ease with which a crime is committed should have no bearing on the severity of the crime. Stealing someone's car doesn't become moral if the person leaves the car unlocked and running, even if it "only" involves opening a car door and driving a car. I don't see why computer systems should be different.

However, breaking into someone's car in order to roll up their windows and leave them a note telling them not to do it is perfectly good in my book. So I think it's better when people focus more on the severity of the actual crime committed, rather than on the ease of committing it.

It's not stealing a car if you ask for it and they give it to you. That's what typing a URL into your browser is. Asking the server for info. AT&T could have easily programmed it to say "no".

IMHO, it's more like the car was left running with the windows rolled down. The owner is an idiot, but you're still not supposed to steal the car.

The windows rolled down and the key in the ignition. Also note that you can see such a car and not steal it, but if you send a GET request to a server and it responds, you've already "stolen" the data. The mere act of looking at the car and seeing the windows down is criminal now.

So maybe the analogy works better like this: You're blind and walking around. Suddenly you get to some random car. Being a curious person you touch it to feel what kind of car it is and, in doing so, discover that the windows are rolled down. Reaching inside you also feel that the key is in the ignition. Then the question is, should you go to jail for attempting to steal the car (imagine that blind people are excellent drivers). You certainly did the exact same motions that a car thief would. Which are the exact same motions that a car enthusiast and curious person would do. The analogy breaks down about here, since the guy in the story copied the car by touching it, which we can't do yet.

If you accidentally find out you have access to someone else's private data that you aren't supposed to have access to, there is a big distinction between your next step being

1. walking away, maybe telling someone

2. sucking up as much private data as you can

No, because the server is a machine and cant give consent on att's behalf.

It can and did. That's why this isn't fraud.

No it can't. The server is an inanimate object. It's like saying a broken lock can give consent for someone to enter.

I don't think you really mean that. If your bank were open to an XSS attack that "only" required crafting a particular URL to allow access sufficient to transfer funds, I don't think you'd be consoled that the "hack" that drained your account was, at heart, only a matter of visiting some URLs.

Obviously this "hack" was simpler, and AT&T's security was lousy. But the simplicity of an attack is not an excuse for mounting it.

In this "attack" the URL was incremented by one.

I've written a lot of loops, and incremented a lot of numbers, and none of them have ever become properly escaped XSS exploits, or malformed YAML, etc. If your bar for "hack" is so low that we're training pre-schoolers to accomplish it, it may lack all descriptive power.

URLs are by design human readable and human editable. Simple discovered usage of these resources is not hacking, it is intended.

Imagine you're reading a story at example.com/stories/bears-part_1_of_3.html and just as it gets good, it's done. Without so much as a "The End".

Do you sit dumbfounded, or do you hack the bejeezus out of the website?

See how silly that sounds. So lets just say you "went to the next page".

Call it "Crafting a URL for $INTENT" and save all this talking past each other.

Gotta make it seem scary somehow.

>If your bank were open to an XSS attack that "only" required crafting a particular URL to allow access sufficient to transfer funds, I don't think you'd be consoled that the "hack" that drained your account was, at heart, only a matter of visiting some URLs.

But it's not the "hack" that you're worried about, it's the stealing. And stealing is separately illegal. Not all stealing is hacking just because a computer is involved, and something that isn't otherwise hacking shouldn't become hacking just because it involves theft or some other malicious activity that would itself be against the law.

Reply on news.ycombinator.com