Recently came across a theoretical moral dilemma -
The Oxford dictionary defines the computer security form of 'hack'/'hacking' as:
"Gain unauthorized access to data in a system or computer"
With regards to modern computer systems, if one were implemented without authorization, but contains sensitive information that regular users assume is sufficiently protected against, with no real reassurance from the site they've been using, and a third party reverse-engineered the site to gain access to it, is it considered "hacking"?
- The system described does not immediately provide the regular users with any legal agreements or confidential documentation ensuring that their data is secure.
- They are however confident in this instance that the sensitive information provided to the site is somewhat secured.
- When I mentioned 'no authorization', I mean basic authentication and session handling, but information on the back-end does not conform to this, and the API is freely poll-able.