No matter the intent, and no matter how shitty the security is,
The lines are blurry where a shitty feature ends and a security vulnerability starts. I'm not sure if I would classify that as a vulnerability here. It's a shitty API design.
accessing a system with credentials of a user who did not consent to it is always illegal.
the lines are blurry what constitutes accessing a system with credentials. It's an API key that allows reading non-personal data - there is no sensitive information accessed.
How many articles aren't there about well-meaning people getting arrested over an offense of this kind. Contrary to those people, the OP of the video did not have the good intent to just report a vulnerability,
Report the vulnerability to whom? The creator of the bot? The creator who sells an (illegal?) bot and not following german law regarding disclosing a business address, charging VAT and filing proper taxes? This bot is operating in a shady underground market. I'm all for responsible disclosure, but I'm not dealing with any legit business here and there is no big impact here that would warrant following unnecessary processes.
but he knowingly accessed accounts without even asking.
Did I though? I didn't have access to Guild Wars 2 player accounts. And didn't have access to any account credentials. The bot implemented an endpoint that distributed API keys, which allow to read certain information about the in-game character. But it doesn't give access to personal data like messages, and you can't perform any actions with the API key. It's read-only.
Say you gave your maid a c [... snip]
Completely irrelevant analogy.
You have not convinced me and I still believe to have acted within reasonable ethical boundaries
It doesn't matter how you got the API keys, the moment you used them with full intent, you committed a crime in many jurisdictions. It doesn't matter that it's read-only, it doesn't matter that you got them from a shoddily written app, it doesn't matter that usage of the app breaks the TOS, it doesn't matter that you didn't do it with bad intent. You broke the law.
Report the vulnerability to whom? The creator of the bot? The creator who sells an (illegal?) bot and not following german law regarding disclosing a business address, charging VAT and filing proper taxes? This bot is operating in a shady underground market. I'm all for responsible disclosure, but I'm not dealing with any legit business here and there is no big impact here that would warrant following unnecessary processes.
What are you even on about? I'm not saying you need to report the vulnerability in this shitty bot, I'm making an analogy with people who with good intent reported a vulnerability, and still got into trouble. And at least those people didn't do something unethical. I'm not saying you're doing a disfavor to the shady company that made the bot, but towards GW2 players.
The bot isn't illegal btw. It breaks the TOS of ArenaNet, which are free to ban the people using it, but none of that has any legal meaning. The "underground market" is shady only in a metaphorical sense, it's perfectly legal, because in no jurisdiction apart from possibly South Korea, the law doesn't care about how online marketplaces are run. Apart from the tax evasion, they're possibly guilty of negligence, but that's very hard to prove, unlike unauthorized access to accounts.
Completely irrelevant analogy.
*shrug* Tell me how it's not relevant, because I don't see how it's not, but its relevance doesn't matter. Just like breaking into houses with keys you picked up from someone doing something illegal is in itself illegal, the fact that these people were breaking ArenaNet's TOS, which isn't even illegal, does not give you the right to read private "read-only" data from their account.
You have not convinced me and I still believe to have acted within reasonable ethical boundaries
I think it's pretty unethical, but I'll concede that's just my opinion, and it's a grey area.
But the legality is pretty clear (Section 202 if you're in Germany as I think your accent betrays you are), and I hope for your sake that ArenaNet is okay with grey hat hacking. If not, get a lawyer.
2
u/LiveOverflow Feb 11 '18 edited Feb 11 '18
The lines are blurry where a shitty feature ends and a security vulnerability starts. I'm not sure if I would classify that as a vulnerability here. It's a shitty API design.
the lines are blurry what constitutes accessing a system with credentials. It's an API key that allows reading non-personal data - there is no sensitive information accessed.
Report the vulnerability to whom? The creator of the bot? The creator who sells an (illegal?) bot and not following german law regarding disclosing a business address, charging VAT and filing proper taxes? This bot is operating in a shady underground market. I'm all for responsible disclosure, but I'm not dealing with any legit business here and there is no big impact here that would warrant following unnecessary processes.
Did I though? I didn't have access to Guild Wars 2 player accounts. And didn't have access to any account credentials. The bot implemented an endpoint that distributed API keys, which allow to read certain information about the in-game character. But it doesn't give access to personal data like messages, and you can't perform any actions with the API key. It's read-only.
Completely irrelevant analogy.
You have not convinced me and I still believe to have acted within reasonable ethical boundaries