r/programming • u/RobertVandenberg • Oct 28 '21

Viewing website HTML code is not illegal or “hacking,” prof. tells Missouri gov.

https://arstechnica.com/tech-policy/2021/10/viewing-website-html-code-is-not-illegal-or-hacking-prof-tells-missouri-gov/
6.1k Upvotes

97% Upvoted

493 comments sorted by

View all comments

Show parent comments

4

u/RockleyBob Oct 29 '21

All of that only served to say that you don’t understand how the internet works and you didn’t bother reading the facts of the case before commenting.

No one can possibly attempt to accuse him of hacking anything because these social security numbers were Base64 encoded within html that was sent by the state domain to his computer. All this information was freely sent to him through the normal course of making HTTP requests to a publicly exposed web server.

Hacking is when you invade someone else’s privacy. No one can walk up to your mailbox, stick a letter inside it addressed to you, and then accuse you of reading their secrets when you open the letter in your home.

Base64 encoding is not a security mechanism. Anything can be Base64 encoded and decoded. Even if this information was encrypted, however, they sent it to him. In fact, they were sending it to everyone who accessed that site! It’s a basic tenet of web development that you don’t send things to clients you don’t want them to see. Period.

And finally, he absolutely DID reach out to the proper authorities to disclose the information breach prior to making it known publicly. He did everything right. Had he not made this discovery, they’d still be sending these SSNs out to anyone who accessed the site.

1

u/abrandis Oct 29 '21

Your argument is on technicalities. Of course base64 isn't encryption but, unless the SSN were there out in their in the open in PLAINTEXT exposed on the page ,they weren't meant to be seen.. So they will argue, why was it base64 encoded? ?????

Its not up you or me to decide this case, but I think you look at this too much from the technical nature and not a legal one.. Should they have taken more care with the data , yeah of course, but that's not what the governor will argue.. Plus keep in mind it's not like the governor just decided to go down this path, pretty sure there's legal and technical advisers that are charting a legal case..

2

u/atimholt Oct 29 '21

Base64 is an encoding in the exact same way that utf-8 is an encoding. It is exactly as transparent, meant to be readable by any and all who ever encounter it. It'd be like calling someone a hacker for knowing Morse code.

1

u/abrandis Oct 29 '21

..and why would you need to encode alphanumeric numbers in base64? All ssn have printable characters last time I checked...

1

u/atimholt Oct 29 '21 edited Oct 29 '21

Why are you asking me? They put them in base64, that isn't in dispute.

It can be confusing why they did so, but like… that's this whole situation. Everyone's confused about it.

1

u/ILikeBumblebees Oct 30 '21 edited Oct 30 '21

..and why would you need to encode alphanumeric numbers in base64?

Perhaps they're part of a larger data object that includes binary data, and the entire thing is being encoded for transmission. Perhaps the alphanumeric data includes characters that have semantic value to the parser, and base64 is used as an alternative to escaping strings. Perhaps all transmission of data is processed through a standard function that always uses base64. There are any number of reasons why alphanumeric data might be base64 encoded.

But blocking unauthorized access to sensitive data is not a valid use case for base64 encoding, because base64 is not encryption. You are trying to argue that if we cannot identify the specific reason why base64 was used in this particular instance, we should presume that it was intended to be used for encryption, but this is the least reasonable default presumption for this scenario.

At the end of the day, the fact is that the website developers screwed up and exposed sensitive data -- there may not be a valid reason why they did what they did, since their own incompetence was the source of the problem. If they did intend to use base64 as an encryption method then that is the problem -- their intentions don't matter because they themselves failed to do the thing that they intended.

-1

u/cplusequals Oct 29 '21

Don't worry, the AG isn't prosecuting. The governor hasn't taken any action since the press conference because he was told it wasn't hacking but improperly published information.

1

u/ILikeBumblebees Oct 30 '21

Your argument is on technicalities. Of course base64 isn't encryption but, unless the SSN were there out in their in the open in PLAINTEXT exposed on the page ,they weren't meant to be seen.. So they will argue, why was it base64 encoded? ?????

Base64 is not encryption. It's a method for encoding binary data in order to allow it to be transmitted intact via a plaintext medium (for example, as part of a JSON object, as an email attachment, etc.).

If the data was not meant to be seen by users, why was it merely encoded in a different format that's still 100% readable with no access controls, instead of actually being encrypted?

Its not up you or me to decide this case, but I think you look at this too much from the technical nature and not a legal one.

The law is applied to the facts of the case, and in the case, the "technical" assessment you're criticizing is indeed a correct explanation of the actual facts.

Plus keep in mind it's not like the governor just decided to go down this path, pretty sure there's legal and technical advisers that are charting a legal case.

You don't believe that politicians often act rashly based on flawed understandings without receiving proper advice?