Actually, whether or not I broke any laws (in the US) is not clear. I deliberately did not look at anything in their account while I was in it, so privacy was not actually compromised.
The folks I recognized on my way out were people with large profile pictures of their faces. In general, this wasn't the case. I'd have had to do a lot more rifling through accounts to be able to identify someone face-to-face, and would have risked someone having a bad reaction.
So, unlike all the people who have used Firesheep in public to look at peoples' accounts and then not told anyone about it, I notified the users and then told the public about what happened. You're saying that's bad?
Ah, wow. This could not be further from the truth. This wasn't a "murky area." Its a big fat red zone.
Let's look at the Florida statute:
815.06 - Offenses against computer users. -
(1)Whoever willfully, knowingly, and without authorization:
(a)Accesses or causes to be accessed any computer, computer system, or computer network;... commits an offense against computer users.
(2)(a)Except as provided in paragraphs (b) and (c), whoever violates subsection (1) commits a felony of the third degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084.
So you committed a felony punishable by up to five years in prison, informed the victims, and documented your crime in explicit detail on your blog. That's a tad more dangerous than using unsecured cookies.
You've probably admitted to and documented multiple counts of Computer Trespass, knowingly using a computer service without authorization and knowingly gaining access to computer material. It's a Class E felony.
156.10 Computer trespass.
A person is guilty of computer trespass when he knowingly uses or causes to be used a computer or computer service without authorization and:
1. he does so with an intent to commit or attempt to commit or further the commission of any felony; or
2. he thereby knowingly gains access to computer material.
You also wrote '[I] then sent him a "no, seriously" message on Facebook from his account including the fun fact about his music choices.'
Viewing a person's music choices and sending them a message about them is a total violation of privacy. Or do you just attribute that to being another exception?
The folks I recognized on my way out were people with large profile pictures of their faces. In general, this wasn't the case. I'd have had to do a lot more rifling through accounts to be able to identify someone face-to-face, and would have risked someone having a bad reaction.
So, unlike all the people who have used Firesheep in public to look at peoples' accounts and then not told anyone about it, I notified the users and then told the public about what happened. You're saying that's bad?