alt Hacker NewsThat's an arbitrary distinction. Your credit card number is not intended to restrict access, it's specifically intended to facilitate access, but it's not public information. If someone uses brute force to guess your credit card number, I would call this practice illegal too.
I'd advocate for actually believing the HTTPD in this case. In the main, if it says '403 Forbidden', then it is forbidden. If it says '200 OK', then it is ok.
I would argue that the web server's reply counts as a communication. The argument "but we didn't intend to grant access" goes so far, because what other information do I base myself on to guess that you didn't?
Roughly speaking, that is. Because, despite the fact that this would appear to be a straightforward uncontested and literal communication logged and timestamped by both sides and their respective server and user agents; lawyers somehow fall back to analogies instead.