Comment by selcuka
11 hours ago
That's an arbitrary distinction. Your credit card number is not intended to restrict access, it's specifically intended to facilitate access, but it's not public information. If someone uses brute force to guess your credit card number, I would call this practice illegal too.
I'd advocate for actually believing the HTTPD in this case. In the main, if it says '403 Forbidden', then it is forbidden. If it says '200 OK', then it is ok.
I would argue that the web server's reply counts as a communication. The argument "but we didn't intend to grant access" goes so far, because what other information do I base myself on to guess that you didn't?
Roughly speaking, that is. Because, despite the fact that this would appear to be a straightforward uncontested and literal communication logged and timestamped by both sides and their respective server and user agents; lawyers somehow fall back to analogies instead.
If I repeat my credit card number example above:
Assume that an attacker generates a random credit number and attempts to make a purchase online. VISA honours the number and processes the payment. Is the attacker not guilty because VISA's server didn't return a 403 Forbidden (or 401)?
When you download a file from a public S3 bucket, for example, you get a signed URL that expires after a certain date. If someone guesses the signature and downloads the file, are they not guilty because the web server did not return a 200?
If someone guesses your password and reads your mail, is it ok because the IMAP server did not return an error?
Ah, you're coming at it from that angle. Fair enough in that scenario.
I agree that if you deliberately provide false credentials to the server, then the server was misled, and you probably knew you were misleading it, and you probably also know that that 200 OK is not really earned. So Mens Rea cuts against you.
On the other hand, what if you're just coming in blind, asking about URLs in general?
That's actually pretty typical these days where 'your'[1] view of the world at some point in time might be constrained to that HTTP traffic alone.
Accidents notwithstanding, you can't really blame me for believing what I'm told, at least.
"May I GET this, or this, or that?" -> "200 OK" ... it'd be a bit weird to get the cops after me, months later, after I've probably already even forgotten I ever did that wget or curl.
[1] via software/user agent/llm agent/all three
Guessing credit card numbers for the purpose of spending money that isn’t yours is openly malicious and illegal. I would also argue that credit card numbers are designed to restrict access. The company that issues them specifically says not to share the number and uses knowledge of that number to gate access to the spending function.
Sending get requests and having a server respond with a document is just how the internet works. If - big if - that is what happened, then someone is going to have to explain why those supposedly private documents were available to anyone who asked using a protocol designed to distribute documents publicly. Enumerating urls isn’t typically regarded as outright illegal.