Slashdot Mirror
Appeals Court To Test How the Law Looks at Shared Accounts and Unauthorized Access (washingtonpost.com)
schwit1 writes: On Monday, the Ninth Circuit will hear arguments in United States v. Nosal on an interesting legal question: If a person shares access to a computer account with somebody else, under what circumstances can the second person engage in unauthorized access under the Computer Fraud and Abuse Act? The case centers around the difference between having access to something and having permission to use it. In other words, if you give somebody a desktop password to your computer so they can watch Netflix, but they take advantage of that to read your email, how does the law look at it? What happens if they come back later and log in again without your explicit permission, but only watch Netflix? What happens if you give them your Netflix password to watch while at your house, but they go home and use it to watch Netflix at their house? Eugene Volokh has a forthcoming paper articulating the legal interpretations of computer trespass. It's a tricky set of rules, and one another court has already misapplied.
If you let somebody in (say a babysitter to watch your kids) that doesn't give them permission to peruse through a diary hidden in a drawer in a night stand.
Basically is it a DMCA violation AKA anti-hacking law crime, to use a password you legitimately know to use the computer system for things you weren't supposed to.
This really stretches it too far if you ask me as there are other remedies before applying a hacking law. But they went too far long ago by allowing companies to use DMCA to hide copies of copyrighted things you bought from your own sight, like firmware. "Your car's computer can read your copy you own, but you can't."
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
LOL what did /. do to piss off the cow guy? I see him in every thread.
In limited circumstances, I think that sharing a Netflix password is clearly OK. I base that statement on the fact that Netflix has a concept of users different users within one account.
The question is perhaps: what does "limited" mean in this context? Family member who lives with me? Family member who lives elsewhere? Friend?
The real "Libtards" are the Libertarians!
what about new email pop ups? that you can read at least some info from?
Open wifi where you can see, shared files/folders, shared printers, etc.
Files on the desktops
Have permission to use the printer and see other documents on it / next to it.
post it nodes with info on them on the display / desk
Wait by now you are looking at 20 to life need I go on?
If you lend it out to someone, you ask it back.
With a password you cannot do that, so you change it
If the password gets abused while lend out, laws similar as for the keys should apply.
Other than that, just don't be stupid with your passwords.
The case shouldn't even go to court. Modern OS's have guest accounts for a reason, and everyone knows you don't handout your password.
He's just pissed that he can't be a cow. MOOOOOO!
Share the password, and thereby grant access. You've given permission and lost control at the same time.
Change the password and don't share it. Problem solved.
Summary focused on legal ramifications for individuals on their personal computers. But this is actually a bigger issue for corporate use of cloud services. What if your company has an official Twitter feed or Facebook wall which needs to be updated by multiple people? Right now, the only way you can do that is to share the single password with all those people. Now what if one of those people gets fired and you're a little slow to change the password? People criticized Sony for making themselves easy to hack by keeping their passwords in a plain text file, but that's inevitably what happens when you need to share an account among multiple employees and the service providing the account only allows a single login. First the password gets posted on the refrigerator door. But one day an unauthorized employee uses it, and someone gets the "clever" idea of putting it in a text file on the file server in a directory where only the people who are authorized to use that account and password have read access. Right where hackers can get it.
You can't create a guest account because those services don't yet support that. What needs to happen is for these services to either allow logins with multiple revocable keys/passwords; or allow multiple sub-accounts under a master account, with the sub-accounts able to post as if they were the master account. The same concept applies for collaborative virtual spaces.
If every online service allowed this, then the issue in TFA becomes easy. If Netflix allows up to 4 family members to share the account, then each of those family members should have a separate login and password, with one being a master account which has the power to revoke login permissions for the sub-accounts. If you want to let a new "family member" temporarily use the account, you simply give them a sub-account. And when you no longer wish them to have access, you simply revoke the permissions of the sub-account. (And as you point out, for your home PC, you can simply log them into the guest account.)