This seems weird to me.

If I go to, say, the twitter homepage, I will find an authentication page, and yet most content on twitter is obviously intended to be public.

That, exactly that.

If you have a secret document, when I come knocking on your door and ask for that document, you'll refuse to give it to me, or at least ask for something that convinces you that can access it. Nobody would be crazy enough to charge me by a crime if I ask you the document, and you give it to me without any kind of verification.

But now, configure a computer to do that exact thing, and suddenly you manufacture plenty of new criminals.

It's more like if you walk up and find the document on my doorstep, turn around to see the 'no trespassing' sign, then leave with the document anyway.

Again - I don't really agree with the ruling here - just trying to clarify.

Except I found the documents on Google. It's the equivalent to advertising a yard sale but not realising what you were selling / showing the public.

That sounds about right, actually. Half the yard is clearly free, but they failed to mention that you can't even view the other half.

But wasn't the quote indicating that it was made clear somehow? Looking at the anses.fr site isn't particularly helpful, if that's even the site in question.

I dunno, having a yard sale is 'opt-in', since you're putting up the signs etc, showing up on Google is more 'opt-out'.

Isn't it more opt-in because you need to put a link somewhere on the public www before Google can find it?

Yes but links can leak in the most accidental fashions. Google seems to find a lot of stuff that makes me wonder how Googlebot ever found such links. Part of the explanation might be referer logs, and such.

Anyway, the point is, it's smarter to be explicit and also opt-out using robots.txt or something similar.

If your side gate was open when the googlecar drove by and put it on streetview, does that mean that anyone else is entitled to wander in and take things should the gate be open as they pass by?

Except that advertising takes positive effort on your part, whereas it takes positive effort to avoid being listed on Google.

I don't know, but I think "putting up a web server" qualifies for "positive effort" ;-) And while it does take extra work to ensure an Intranet isn't available on the public web, or that it's correctly configured to require a login to view documents ... there has to be a line somewhere.

I mean, I've stumbled on FTP sites that allow anonymous users. By providing no password and still seeing content, would I have "hacked" them? It's a configuration issue, and password prompts are just that. Of course, where do you then draw the line? If you call it a security flaw that the documents were public, then accessing them could be an exploit. But... a very flimsy one, since we rarely execute injection attacks to visit websites, but we often click links on Google. The bar is clearly very low. ;-)

This might, of course, change if the access was not indicated on Google but instead on a site like shodanhq.com ...

More of a 'keep off the grass' sign. It's not at all obvious that the authentication is supposed to apply to other areas.

I don't know about France, but in many jurisdictions, a "reasonable person" standard is used. While I don't personally believe accessing publicly available files should be illegal in any case, I do think that in the situation as described (with the admission of traveling up the path hierarchy to find a login page), most "reasonable people" would indeed infer that the files were not intended to be publicly available.

Not really. If I found a page that redirected me to a login, I would assume that that page is not intended to be publicly available, and that other content that I don't know about exists which is not intended to be publicly available.

I wouldn't infer that just because (as noted by the parent comment) https://twitter.com/ requires a login, I shouldn't look at https://twitter.com/twrbrdg_itself

Now, if all those pages I looked at before finding the login page had a banner saying "private, not for public consumption, don't share this with anyone who doesn't have an account", then I might think "hmm, perhaps I'm not supposed to be here".

That's not a fair analogy though. I agree that I wouldn't expect every page on twitter to be protected. But if you find a direct link to a random document indexed by Google, then check and the page that links to that document is protected, I personally anyway would assume the document itself was exposed accidentally. Obviously not everyone agrees though, which makes the reasonable person thing difficult to decide.

As for the lock on the door comment, I'd say it's more like if you noticed a store is left unlocked in the middle of the night, and therefore assume you're welcome to go in and walk around. In fact, they probably didn't leave it unlocked as an intentional invitation.

And how would a "reasonable person" decide that? That is kind of like say "if there is a lock on the door, you should know that it was meant to be locked. Yeah 7/11, open 24 hours, has a lock on the door.

We don't even have to make analogies; if it is protected information a "reasonable person" expects some kind of _obligatory_ login authentication, not an optional one.

Yes we have that, its name has changed recently because it was something like "good family father" (it came from greek democracy) and was deemed sexist.

If you happened upon my 'protected' account with some mal-formed link, then saw the standard 'tweets are protected' message on my main page, you might be in a spot if you went back and save all those secret tweets. Under the interpretation being discussed anyway.

How so? Was it made clear that the authentication page was for the documents he subsequently downloaded?

Even if it was, this is ridiculous.

What kind of security let's you download documents without authentication?

It's a surprisingly common bug in custom web-based systems that handle documents or images - I've found this a number of times in systems I was reviewing (and I'm not a security expert).