Slashdot Mirror
Appeals Court To Test How the Law Looks at Shared Accounts and Unauthorized Access (washingtonpost.com)
schwit1 writes: On Monday, the Ninth Circuit will hear arguments in United States v. Nosal on an interesting legal question: If a person shares access to a computer account with somebody else, under what circumstances can the second person engage in unauthorized access under the Computer Fraud and Abuse Act? The case centers around the difference between having access to something and having permission to use it. In other words, if you give somebody a desktop password to your computer so they can watch Netflix, but they take advantage of that to read your email, how does the law look at it? What happens if they come back later and log in again without your explicit permission, but only watch Netflix? What happens if you give them your Netflix password to watch while at your house, but they go home and use it to watch Netflix at their house? Eugene Volokh has a forthcoming paper articulating the legal interpretations of computer trespass. It's a tricky set of rules, and one another court has already misapplied.
If you let somebody in (say a babysitter to watch your kids) that doesn't give them permission to peruse through a diary hidden in a drawer in a night stand.
Basically is it a DMCA violation AKA anti-hacking law crime, to use a password you legitimately know to use the computer system for things you weren't supposed to.
This really stretches it too far if you ask me as there are other remedies before applying a hacking law. But they went too far long ago by allowing companies to use DMCA to hide copies of copyrighted things you bought from your own sight, like firmware. "Your car's computer can read your copy you own, but you can't."
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
In limited circumstances, I think that sharing a Netflix password is clearly OK. I base that statement on the fact that Netflix has a concept of users different users within one account.
The question is perhaps: what does "limited" mean in this context? Family member who lives with me? Family member who lives elsewhere? Friend?
The real "Libtards" are the Libertarians!
what about new email pop ups? that you can read at least some info from?
Open wifi where you can see, shared files/folders, shared printers, etc.
Files on the desktops
Have permission to use the printer and see other documents on it / next to it.
post it nodes with info on them on the display / desk
Wait by now you are looking at 20 to life need I go on?
When I read your first sentence (slashdot collapsed section only presented that one line) I thought you were going to suggest bludgeoning them until the amnesia makes them forget the password... other stuff, too, but the password is the legally important bit.
Problem may be solved, but the legal question remains: did the person who abused your password do something illegal? If I leave my house unlocked, someone who comes in and steals stuff is still guilty of a crime. If I share my password, they *can* use my stuff, but there's still a legal bar that says they *should not*, and if they do, there may be criminal charges. This case is critical for determining what happens in various fraud and phishing scams. That's why in needs to go to court.
Summary focused on legal ramifications for individuals on their personal computers. But this is actually a bigger issue for corporate use of cloud services. What if your company has an official Twitter feed or Facebook wall which needs to be updated by multiple people? Right now, the only way you can do that is to share the single password with all those people. Now what if one of those people gets fired and you're a little slow to change the password? People criticized Sony for making themselves easy to hack by keeping their passwords in a plain text file, but that's inevitably what happens when you need to share an account among multiple employees and the service providing the account only allows a single login. First the password gets posted on the refrigerator door. But one day an unauthorized employee uses it, and someone gets the "clever" idea of putting it in a text file on the file server in a directory where only the people who are authorized to use that account and password have read access. Right where hackers can get it.
You can't create a guest account because those services don't yet support that. What needs to happen is for these services to either allow logins with multiple revocable keys/passwords; or allow multiple sub-accounts under a master account, with the sub-accounts able to post as if they were the master account. The same concept applies for collaborative virtual spaces.
If every online service allowed this, then the issue in TFA becomes easy. If Netflix allows up to 4 family members to share the account, then each of those family members should have a separate login and password, with one being a master account which has the power to revoke login permissions for the sub-accounts. If you want to let a new "family member" temporarily use the account, you simply give them a sub-account. And when you no longer wish them to have access, you simply revoke the permissions of the sub-account. (And as you point out, for your home PC, you can simply log them into the guest account.)