Hacker News Reader

Comment by mseebach | Hacker News Reader

So, the actual sentencing is certainly overzealous, but are you arguing that "unauthorized access" shouldn't be illegal? Should it just be a free-for-all: if you can get into it, you're welcome, and you can do whatever you want with any data you can get your hands on? If not, what's the threshold? Are you allowed to guess a password? What if you bruteforce it? Can you use a zero-day vulnerability in Rails?

Both Weev and this guy clearly knew that they were accessing data they weren't supposed to access, even if the protection in place was/is clearly inadequate.

View on HN

Unauthorized Access should mean there is something that enforces authorization in front of it, and you circumvented that or forcefully passed through.

Legal actions based on security through obscurity is a silly idea.

Nope. If I leave my front door open and you walk in off the street, it's still trespassing. You don't have to make a reasonable effort to secure physical goods, why should you have to to secure virtual information?

People who complain that "that could make any URL illegal!" are being facetious: if you hit a site once and see personally identifiable information (PII), report it and leave! It's like if you were out hiking and you wandered onto someone's land: one incursion isn't going to get you thrown in jail, but repeated, systematic incursions will make it hard for you to argue that it was an accident.

If you really want more explicit laws on this sort of stuff, you're going to end up with a ton of very explicit cruft all over the web. You know those email footers saying "If you aren't the intended recipient, throw this away"? The best we can expect is to require sites to put those boilerplate warnings on pages you aren't supposed to access. These would be analogous to 'no trespassing' signs in real life.

Seems to me more like you leaving your door open and then trying to have someone arrested for looking through your doorway.

If someone physically circumvents your door in order to see what's inside there's a difference in culpability.

If they peek in once, they wouldn't go to jail. If they come in a thousand times and take pictures, that's very different.

He said "look". There's nothing criminal or morally wrong about looking through someone's open door, regardless of extent.

Nope. If I leave my front door open and you walk in off the street, it's still trespassing.

Don't laws about the physical world make a distinction between trespassing and breaking & entering?

if you hit a site once and see personally identifiable information (PII), report it and leave!

And get either ignored or sued.

> Don't laws about the physical world make a distinction between trespassing and breaking & entering?

Sure. In rough terms:

Trespassing is being on real property of another without permission or legal privilege.

Breaking and entering is entering a residence or other enclosed property through the use of even the slightest amount of force (including things like pushing open a door or window that is not locked -- or even one that is not fully closed.)

Burglary is the same as B&E, but with the intent to commit any other crime on the property.

Most importantly, though, in the physical world, all of them are still illegal; Why should "unauthorized access" being punishable in the digital world should require some kind of effective security system when "unauthorized presence" (trespassing) in the phjyiscal world does not?

The door analogy does not carry over well. Its more like I had a yard sale on my front lawn with an invisible line beyond which you are trespassing.

Reply on news.ycombinator.com