I saw in a thread somewhere else a while ago a bit more detailed explanation:
The web page used an old .NET framework that serialized the application state, base64 encoded it, then dumped it in a hidden form field at the bottom. When you navigate pages, the data is POSTd back to the server to achieve a "stateless" web app on the server side
The reporter had to view source and base64 decode the data
Obviously still trivial but I think the laws are also very ambiguous on "decoding" and "accessing"
> The web page used an old .NET framework that serialized the application state, base64 encoded it, then dumped it in a hidden form field at the bottom.
Wow. I was a C# developer for many years and I never realised that ViewState encryption was _opt in_[1].
Someone interviewed for my company last month. One of his previous experiences was listed as "dynamic SQL". My third question was how do you prevent SQL injection attacks. He didn't know.
> If those identifiers contain sensitive data, such as customer IDs, you should encrypt the view state data in addition to or instead of sending the page over SSL.
It would be hilarious if those docs got updated to say customer IDs or SSNs. Lol.
The craziest part is that if you had made that same mistake and leaked a bunch of SSNs the same government would be fining you and accusing you of being negligent. It's insane.
I can't believe the defense wouldn't be able to present an expert witness / cross-examine the prosecution's on the distinctions between "encoding" and "encrypting."
I guess base64 is cryptographically a substitution cipher with a public pad. Which... you'd think using a ~2000+ year old method in a known-harmful way would stretch the term.
The web page used an old .NET framework that serialized the application state, base64 encoded it, then dumped it in a hidden form field at the bottom. When you navigate pages, the data is POSTd back to the server to achieve a "stateless" web app on the server side
The reporter had to view source and base64 decode the data
Obviously still trivial but I think the laws are also very ambiguous on "decoding" and "accessing"