the ethics of curiosity

Not a question I've seen on here yet (forgive me if I've missed it) so what do you lains think of the ethics of security when it comes to networks and freedom of information? I'm just getting into ssh, and I have a naturally curious mind. In a similar way that I can request blueprints from my local town hall, I could easily go to a coffee shop and see which machines are connected to its public WiFi and what said machines are doing. However, institutions such as universities like to use firewalls which largely prevent scripts like nmap, wireshark, etc. from actually seeing that traffic. So what's your perspective on network data and architecture that would be easily visible to anyone with the knowledge to see it? Mostly only large private businesses have a legal framework for that kind of activity; there is certainly potential for harm that justifies protecting customers, employees, et. al. from the public eye. Naturally there are malicious parties willing to take advantage of any vulnerability they see, but for someone like me (and I'm sure there are plenty), is the self-imposed "look but don't touch" rule enough to morally forgive poking around? Consider that some networks disallow mapping but seem to have no problem with traceroute, which I see as a bigger potential risk in some cases. The current legal climate suggests no, but the question is whether this is warranted or not.

>>3298 Even if someone leaves a computer on the network with no password whatsoever, if you log in, that's unauthorized access, which is illegal. Often nmaping/scanning can be construed as intent to access a computer without authorization. Even nmap's documentation tells you only to use it on computers you own/have been authorized to scan

>>3299 what is legal and what is ethical aren't usually the same thing. I think that all non-personal information should be completely free for anyone to access.

>>3299 >no password protection still unauthorized & illegal you sure that's your law?Here password protection is mandatory to make the claim that foreign access was unwanted, you can even be blamed if someone uses your open system for illegal activity. >>3300 Hurdles are good. You don't want to give dangerous stuff to idiots cause regularly they will blow someone else up instead of just keeping it to themself.

>>3299 This is fair but as >>3300 puts it and as mentioned in the OP, there's often a divide between law and moral. ...if I understand this correctly, it seems it's no different than walking past someone and seeing what youtube video they are watching. Still this doesn't excuse breaching personal privacy, no matter how poorly protected. Reading a passage out of a book that someone left behind isn't the same as looking through a session they left open.

>>3301 maybe, but I guess what I mean is, there should be no repurcussions to accessing the information

>>3299 >Even if someone leaves a computer on the network with no password whatsoever, if you log in, that's unauthorized access, which is illegal. Is it illegal to smash someones window and go inside their house? If they didn't want you to go inside shouldn't they use concrete instead of something easy to break like glass? This is what technology people miss a lot of the time. Just because you can, doesn't mean it's ok from a social point of view.

>>3298 It's a moral grey area really. One could argue that today if due diligence hasn't been performed then it's free information for whoever cares to view. In places like coffee shops and at free WiFi hotspots users are often informed of the insecurity and potential dangers and still connect anyways. Curiosity is not really a crime provided you're authorized to be on a network. In my country we have a law that states if an individual believes they have "colour of right" which is the idea they were authorized to view information on systems or networks, then it can be argued whether or not they committed a crime by simply viewing information in the open. Now, if you're going out of your way to mitm someone or perform such attacks that is where I believe a line has been crossed and you're no longer a harmless observer. Legal action should rightfully be taken then. The problem is most people don't understand the technology and these incidents don't always fall within borders, such as in the Gary McKinnon case.

>>3306 THis is actually a very good point. depending on different places, differnert laws can be worded so as to render any tyoe of curiosity a crime. Another example would be provided in the book "the crime of reason." In it, the author discusses how nuclear weaposn secrets, while themselves not dangerous are treated as genocide incarnate when it comes to the law. In soem countries, there are even court cases ,and you can loose a job for being in possession of classified or controlled information, even if you put it together using public information, because the information that is considered "not for anybody but those who had it to begin with" can be nobody elses. these are extreme cases, but I think it goes along with the idea of stalking- see a pretty person on your way to work while riding on the train every day, and see a portion of that persons life and that's normal- go out of your way to try and find out as much about her life without her consent (i.e. following her, taking continuous pictures in public/covertly in private, and logging her every action in a diary) are not ok its somewhat paradoxical, most people who want to monitor the lives of others are also extremely upset about the government or other people/organizations monitoring them. by the logic of "should have been secured better", one would have to argue that the government paying tech companies to backdoor their goods is an approximation to someone honeypotting a local Starbucks WIFI, which also goes into the"intent" area of the law, which most people consider to be the defining point: in both cases, people are willingly using with the understanding that their systems are compromised, or are unknowing and still using the weakened systems. Authority bias also plays a huge role, somehow people think that just because government agents have titles does not make them the same as any other human being who may be making this action for the lulz

>>3300 >I think that all non-personal information should be completely free for anyone to access. according to my work, personal email addresses and social media handles are non-personal, that means that i can corroborate peoples online profiles with their real world counterparts, and it is not being malicious right? I also got convicted of a minor traffic crime and somehow my name, address, phone number, and birth date and every other place that I had lived were all on the internet (thank you court system) and I provided only my name and birth date to the court the only public information should be that which is shared in good faith. people captured as prisoners of war are entitled to more inherent anonymity than regular people web crawlers that gather public records and make searchable databases of people are another perfect example of the line between ethics and curiosity. if a rapist becomes tech savvy and chooses his victims based on information that they cannot control (i.e. information that is listed about them publicly such as marital status, age, address,) should his tech savvy actions be considered okay because "it was just out there?" likewise, what if someone tries to create dossier on all of his neighbors using the same technology in an attempt to foster better community interaction? is his behavior excusable because his intent was not negative, but some people do not want to have social engagement with their neighbors not to sound like some sort of SJW, but is there such thing, or should there be such a thing as >information consent?

>>3307 >In it, the author discusses how nuclear weaposn secrets, while themselves not dangerous are treated as genocide incarnate when it comes to the law. Interesting, something similar is going on with encryption being classified as a muntion in the states under the "Wassenaar Arrangement". Which essentially was supposed to stop "intrusion software" from falling into the wrong hands. It's very broad reaching and though I don't have all the details I think it's something worth looking into/keeping an eye on if you live there and plan to do the kinds of things OP is interested in. >by the logic of "should have been secured better", one would have to argue that the government paying tech companies to backdoor their goods is an approximation to someone honeypotting a local Starbucks WIFI, I can't say I agree completely. Tech companies often don't have our best interests at heart and play ignorant when inevitably caught. There's no transparency for example like with Lenovo's malware coming pre installed on their laptops, superfish if I remember among others. At that point if a consumer still purchases the hardware with the knowledge they participate in these types of things and makes no effort to remove it/secure themselves then I would agree that it's somewhat similar starbucks open wifi. >>3308 There is a much larger problem at play here and one we're slowly going to have to address as a society or suffer the consequences. Big data management and manipulation is a huge issue in security. Also partially why I think a large number of people don't care about where a lot of their information goes until it's too late. It's being leaked somewhere and if anyone is determined enough they will find it. Best you can do is not make yourself part of the low hanging fruit.

Wow, I didn't think the thread would get this many replies. Your replies helped me realize that the initial metaphor (freedom of information act) may be flawed due to my perspective; maybe in some cases it's more like carrying lockpicks then. >>3308 >not to sound like some sort of SJW I think as long as you don't confuse extremism and reason, you'll be fine >information consent Such a thing hadn't even occurred to me... and now I'm turning that over in my head trying to figure out how that might work. I'll have to get back to you on that. >>3319 There's also the issue of smart consumers knowing not to buy infected machines, but uninformed consumers still buy them, compromising not just themselves but potentially those around them.