Hacker News new | ask | show | jobs
by davidchua 5214 days ago
Isn't this fraud and an open admission of guilty?
6 comments

Disclaimer: IANAL, this is not legal advice.

The article mentions it is in the UK.

Relevant fraud statute appears to be this: http://www.legislation.gov.uk/ukpga/2006/35/section/2

It looks like all the criteria for it to be fraud are met.

However, it also looks like legislation in the UK disallows (and renders void) concerted practices which may affect trade within the United Kingdom, and have as their effect the distortion of competition within the United Kingdom, applying, in particular to practices which apply dissimilar conditions to equivalent transactions with other trading parties, thereby placing them at a competitive disadvantage. See http://www.legislation.gov.uk/ukpga/1998/41/section/2

A concerted practice of charging the owners of well-known brands of smartphones less than the owners of less-known brands for an equivalent transaction would have the effect of lessening competition, because people might eschew a lesser known smartphone (increasing the barriers of entry to the smartphone market in the UK).

So there appears to be a good defence that price discrimination practices like this are illegal and void, and therefore circumventing it is not fraudulent.

Of course, out of an abundance of caution, I don't think it would be wise to volunteer to be a test case for this.

There is no law that you have to send any user agent at all, or indeed a valid one that matches your device/browser. It is just a hint for the server.

Edit: and IMO, it's toxic to the hacker spirit to be too quick in condemning ideas as illegal or immoral

The wifi network never asked him what device type he was using, it just made an assumption based on something as unreliable as a user agent string. How is it fraud?
He knowingly manipulated their device detection system. Yes, it's true their device detection system is trivial to manipulate, but that doesn't change the legality. If a bank forgets to lock their vault, you still wouldn't want to clean them out and admit to it on your blog.
What if you just choose to change your user agent to something different because you prefer the experience? If you then get different offers as a result you can't be held liable.
In that case, you're right. Fraud requires knowledge and intent. This guy, knowing that changing the UA would result in lower fees, did just that. He also (presumably) knew the reason for the different price points--that mobile users are likely to use less data than laptop users* .

On the other hand, if he had simply forgotten to change his UA back to the default (say, after doing some development work), then he couldn't possibly know that he was benefiting from the lower price, and it wouldn't be fraud at that point.

Personally, I have no problem with breaking trivial locks on otherwise non-sensitive networks. The word "fraud" usually conjures up much more serious crime.

* This is very quickly becoming a false assumption I think. Between listening to music from remote servers and watching video on my phone, I think mobile data use, especially in a vacation situation, is fast approaching that of "traditional" data use.

It's plausible deniability, nothing more. Illegal stays illegal.
If there were an expensive nightclub which had a cheaper bar round the corner that only admitted people with the first name of "Dan", who then get full access to the nightclub and cheaper drinks all night, would it be criminal fraud to lie about your name to the doorstaff?
As someone named Dan I feel compelled to point out that such policies are really good and absolutely fair :-)
Should it be illegal to use different browsers to see if the price changes on Amazon? http://brightviolet.wordpress.com/2010/05/18/amazon-coms-pri...
"unreliable"? For 99.99% of the internet population the user agent string is accurate and reliable.
How is changing your UserAgent string fraud?
You are implying you are something you are not.
If that was enough for fraud, our whole society would have to be jailed.
"You are"? It's just a browser "identification". It's widely known to be approximate, random and unreliable. It's common to try different agents because the web is full of bad pages which try to use it for something inappropriate. That's why user agent switching is a feature in all these browsers in the first place. It's like disabling CSS.

Is it fraud to use a battery charger or electrical plug with an adapter? After all, the particular plug is a way of "identification", even when easily circumvented. How about using aftermarket parts for your car or camera. They are implying by their similarly spaced and shaped connections that they are genuine parts after all... What about console cartridge identification chips?

These are somewhat interesting questions, if the HN crowd could have other opinions between "fraud" and "not fraud".

A restaurant offers a 25% discount to seniors (65+), but you're only 60. You copy your friend's AARP card, changing the name, and present the cloned card to receive the discount. Is this fraud?
Probably.

It's interesting to think when a hack becomes a fraud or stealing.

When they get your identifying information and feel like hassling you.

The only immoral thing here is the wifi provider increasing the complexity of the transaction to extract as much money as possible. Should one be required to tell the supermarket their net worth so they can be charged "appropriately" for their food? Anonymity is the basis for a shared existence.

Two parties whose sole interaction consists of sending signals back and forth certainly don't need the outside law to mediate between them - if one party finds the relationship unfavorable, simply stop talking. It's a shame that people have been so brainwashed into thinking it's their responsibility to enforce someone else's desired business rules.

It's common to try different agents

No, it's common for highly technical web developers to do this. For 99.99% of the internet population, they do not even know what "user agent string" is or how to change it, or what to put in.

It isn't!
If anything this just seems like a violation of Terms of Service, the harshest punishment that should be allowed is them denying him internet.
Is it legal to charge people different rates for the same service on different devices? I would argue it certainly isn't moral.

Switching user agent is perfectly legal.

It's legal to price discriminate based on age (discounted cinema tickets for children and pensioners), gender (free entry to certain nightclubs for women), occupation (teachers get educational discounts on some software, even when they only use it at home), not to mention the tricks aeroplane/train companies pull. So why not legal to price discriminate net access based on the device you're accessing it with?
>occupation (teachers get educational discounts on some software, even when they only use it at home) //

Suppose they say "teachers" and you have a teaching license but aren't currently teaching. You present your teaching license and say "is this acceptable" and they say yes, you only need a teaching license to get the discount.

That seems pretty analogous to the current situation. You possess the token they request and that they subsequently use to give you a lower price. You've not committed fraud because you're legally allowed to use that UA string. It's up to the provider to decide if their requirement is "passes us this UA string" or "declares ownership of this device" (I don't consider those things identical by a long stretch).

Now if they say when you pass a particular UA string "do you confirm you're owner of $deviceType" or "this service is only for users of $deviceType" then I think things switch around in the direction of [rather minor] fraud.

Actually, not all of these are legal everywhere.

In the UK, price discrimination by gender (e.g. by nightclubs) is illegal: see http://www.equalityhumanrights.com/advice-and-guidance/your-...

I guess it probably isn't but in any case it isn't a robust discrimination method as this guy has shown ;-)