The US 9th Circuit Court ruled that using someone else's password with their permission but without the permission of the site owner is a federal crime.

This showed up in Schneier's newsletter at
https://www.schneier.com/crypto-gram/archives/2016/0715.html:

    In a truly terrible ruling, the US 9th Circuit Court ruled that using
    someone else's password with their permission but without the
    permission of the site owner is a federal crime. This means that
    if you give someone else your Netflix password without Netflix's
    permission, you're a criminal.

There seems to be an intersection with the Web Security model, where
interception is a valid use case. It appears the box performing the
interception cannot proxy the request without the origin's permission.
Otherwise, it seems to be resue of the user's password without
permission or consent.

I'm guessing it will apply to other sensitive information, too.

Jeff

Received on Friday, 15 July 2016 18:11:23 UTC