If you have an online account and forget the password, are you allowed to guess it? What if you automate the process, like in a brute force attack? Can other things, like the verification code be guessed too?

If relevant I'm wondering about Twitter in particular.

  • With no research I want to throw my own two cents in: The service provider might block your IP. If you're acting like an attacker he is likely allowed to do that. I guess things like verification-codes become invalid after a few incorrect guesses, as they are usually much shorter and easier to bruteforce. Can't say anything about Twitter in particular though.
    – JFBM
    Jun 21 '16 at 11:20

If the website and its login are designed competently, then experienced hackers can't in practice access your account without knowing your login, and therefore you can't. If they gain access, then by attacking the whole site in a way that would be illegal for you, when you're genuinely trying to access your own account.

You may be violating their terms of service by using a bot. And they may take counter measures, like banning your IP address, assuming it's a hacker trying to break into your account. "Guessing" should be fine, but don't try to be too smart: A bot isn't "guessing".

  • The TOS thing apparently doesn't apply to SE; I can't say I have actually seen a site that does, instead, I think it all relies on "unauthorized access", not "automated techniques". They do, however, reserve the right to smack anybody that is being a pain.
    – user6726
    Oct 4 '17 at 23:52

"Is X legal" questions are hard. At a guess, though: probably. In general.

The best we can generally do on an "is X legal" question is think about all of the ways in which X might not be legal. I'm going to assume US jurisdiction; know that most legal considerations here vary widely from one jurisdiction to another.

Criminal liability

Maybe you're violating some criminal law. Individual states may very well have some kind of weird laws, but on the federal level the main one to worry about is the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030. It proscribes a variety of acts, but the broadest is:

intentionally access[ing] a computer without authorization or exceed[ing] authorized access, and thereby obtain[ing]... information from any protected computer

The term "protected computer" has expanded to include virtually any computer connected to the internet. The question, then, is whether the access described in the question is "unauthorized," or constitutes "exceed[ing] authorized access." The law seems to be (see the DoJ's official guidance, https://www.justice.gov/sites/default/files/criminal-ccips/legacy/2015/01/14/ccmanual.pdf) that a ToS agreement constitutes a limit on access and, therefore, that access in violation of a ToS agreement is prohibited by the CFAA. This will in turn depend on the specific service with which we're concerned.

Civil liability: breach of contract edition

Maybe you've formed a legally binding contract with the service you're trying to "hack," which contract prohibits your conduct. Certainly, most ToS agreements purport to be contracts, and courts have generally held that clickwrap agreements (of the sort to which you agree when you create an account, for instance), can be legally binding. Such a contract is probably a "contract of adhesion," (see WEX: https://www.law.cornell.edu/wex/adhesion_contract_contract_of_adhesion), meaning that some terms can be voided for unconscionability more easily than in a normal contract. In this light, a term prohibiting brute-forcing an authentication credential would probably be held to be conscionable; a term prohibiting guessing your own might not.

Of course, as a practical matter, it's nearly impossible that a company could prove any damages resulting from the kind of unorthodox password recovery techniques described in your question.

So, for Twitter in particular, what violates the ToS?

Per the ToS itself:

You also agree not to misuse our Services, for example, by interfering with them or accessing them using a method other than the interface and the instructions that we provide. You may not do any of the following while accessing or using the Services: (i) access, tamper with, or use non-public areas of the Services, Twitter’s computer systems, or the technical delivery systems of Twitter’s providers; (ii) probe, scan, or test the vulnerability of any system or network or breach or circumvent any security or authentication measures;

Thus I would say that (probably) CFAA violations could arise with an automated bot attempting to brute-force any authentication credential (verification code or password).

I am not a lawyer. I am most especially not YOUR lawyer. If you want legal advice, hire a lawyer.

Also, as a practical matter, one assumes any decently-designed service has some protection in place against brute-forcing passwords via the web interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.