Subject: RE: [Asrg] Its all over for Challenge Response

From: "Eric D. Williams" <[email-masked]>
Date: Tue, 3 Feb 2004 23:06:15 -0500

The existence of the lock and it's circumvention prove (or tends to prove mens 
re - intent, to violate the laws governing legal entry in this case).

So, in the example given (and IANAL either) it is a matter of whether the 
trespasser can be proven to have intent to violate the codes for entry, e.g. 
invitation ("come on in"), solicitation (i.e. a welcome mat), free access (an 
open door), etc.; under 'reasonable' circumstances.  Where reasonable is 
usually subjective OR defined by legislation (for a particular jurisdiction) in 
the eyes of a judge or jury.

On Sunday, February 01, 2004 12:36 AM, Paul Tenny [SMTP:[email-masked]] 
wrote:
> Alan DeKok wrote:
> >   You've got it 100% backwards.  Everyone knows (or should know) that
> > locks won't keep all criminals out.  So the locks obviously aren't
> > there to keep the criminals out.

Correct.

> They keep everyone out who doesn't have the ability to defeat them.
> For those who can, we have layered security (like firearms, dogs and
> electronic security systems).

No.  No lock or counter-measure system (access control) is 100% full-proof, 
additional access controls only prove additional diligence for maintaining 
access control.  It raises the bar it does not eliminate the risk associated 
with more lethal threats.  Think about internal threats, e.g. the insider. 
 What you are proving when you mention "For those who can...", I think, is the 
point of the previous statement.

> >   The locks are there as a public statement by you that people have no
> > legal right to enter your home.  When someone does, they get charged
> > with "break and enter", which is a serious crime.  If you did not have
> > a lock, or left your door open, they would have been charged with
> > "trespass", which is a lesser crime.  (obligatory IANAL)

Yes.

> >   So the conclusion is that locks are a legal statement which permit
> > the justice system to file more serious charges than they could have
> > without the locks.  In the same way, technological methods of fighting
> > spam should be not only used to stop the amateur spammer, they can be
> > used to leverage more serious charges against the professional
> > spammer.

I agree.

> This is one of the most silly statements I've seen in my life. Locks
> exist to prevent access to something. There is no public statement
> because privacy and private access is something you're taught as a
> child. My car doesn't have locks to remind you of something you
> already know, it's to keep YOU out of someplace you do not belong.

No it is to control access to the 'someplace'.  Violation of that 'legal' 
access control is breaking the law.  Being taught as a child does not make it 
the law.  You may have been taught 'always knock before entering a door', I may 
have been taught 'always call before visiting', still another may have been 
taught (or learned) 'if there is a door it's ok to walk inside'.  Each of these 
is something we are taught or learn but neither prepares you for a locked door. 

The 'public' statement, in the example, is one that demonstrates a desire by 
the 'owner' to maintain access control.  Locks are access controls as you 
indicate, however they also serve the purpose of 'proving' due diligence by the 
owner to limit access.  Thus, a lock proves such diligence and typically aids 
in the proof of a violators mens re (intent) to violate that control and have 
his way.

You may knock, I may say go away, if you break down the door that's violating 
typical jurisprudence concerning entering a domicile; if you open the door and 
walk inside that's trespass (you may not have heard my admonition.  I may call, 
if I get no answer I may visit anyway and walk into the place unexpectedly, 
that's trespass I did not have permission but nothing stopped me from walking 
in (its the same type of scenario with the last example).  But if there is a 
locked door and I pick the lock or break down the door, it is a violation of an 
obvious access control.  My 'intent' was to enter no matter what and can likely 
be proven as such.

This is at least the same as a banner for a telnet prompt.  One saying 'Welcome 
Login:' is a tenuous invitation to attempt entry, one saying 'Unauthorized 
access or attempts will be monitored and violators prosecuted Login:' is not.

I hope this clarifies, what I think was the example.

-e

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Paul Tenny <[email-masked]>
Date: Wed, 04 Feb 2004 10:01:38 -0500

> I hope this clarifies, what I think was the example.

You missed the point of it by about 500 miles.

Intent? Law? Violation? Did you even read what I said originally?

I wrote;
> It becomes exceptionally difficult when you rely on the law as part
> of the solution to a problem.

> I think our legal system has shown over and over it doesn't matter
> how much you punish or threaten someone, the only way to stop them
> is to put up a better defense against *them*, not their methods. 

I can't think of a reason someone would take something so wildly out 
of context for any reason unless they simply missed the point, so 
there it is.

It doesn't have anything to do with what you think, or what he thinks, 
or what I think. Trying to punish people after they've done something 
wrong is not a solution, it's a fix. We don't need fixes, we need 
solutions.

The answer's out there, trust me.