Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When you browse Instagram and find Tony Abbott's passport number

mango.pdf.zone

Post reply on HN
Print view View original

211–220 of 354 posts

Re: When you browse Instagram and find Tony Abbott's passport number

#211

Post by carlmr »

abixb wrote: post #204

Great post, thoroughly enjoyed reading it. BTW, on a side note, when you try and visit the blog's homepage[0] and scroll down to the bottom, you find a link to an actual (password protected) PDF file called Mango.pdf[1]. The author 'Alex' says the password for the PDF has been embedded in the page and it didn't take me a lot of time to figure the password out from the HTML source[2]. But when I opened the PDF, I was…

There are two layers to that encoding. When you see a random string of characters and numbers ending with one or two equals signs, think of base64. Then when you see something that seems like word groups with spaces, think of rot* (* = 13 being the most common version) encoding.

Re: When you browse Instagram and find Tony Abbott's passport number

#212

Post by thrwyoilarticle »

kccqzy wrote: post #26

Nice. Here's a similar personal story with a PSA that sometimes blurring is NOT sufficient. A friend of mine posted on Instagram a picture of a U.S. visa (or something similar; it was probably five years ago) to announce her trip to the U.S., and she took care to blur out sensitive information such as her passport number. But a Gaussian blur is easy to reverse and I successfully unblurred it and told her my discovery…

>a Gaussian blur is easy to reverse

That's the most surprising thing I've read today. I assumed it was destructive.

Re: When you browse Instagram and find Tony Abbott's passport number

#213

Post by [deleted] »

abixb wrote: post #204

Great post, thoroughly enjoyed reading it. BTW, on a side note, when you try and visit the blog's homepage[0] and scroll down to the bottom, you find a link to an actual (password protected) PDF file called Mango.pdf[1]. The author 'Alex' says the password for the PDF has been embedded in the page and it didn't take me a lot of time to figure the password out from the HTML source[2]. But when I opened the PDF, I was…

[deleted]

Re: When you browse Instagram and find Tony Abbott's passport number

#214

Post by rbinv »

abhiminator wrote: post #210
nbgl wrote: post #207

Earlier quoted context omitted.

Hint: try ROT13.

Thank you. Tried that as well, still throws up a string of letters and numbers. But the frequency this time seemed a bit more consistent, so the trick is to apply some sort of frequency analysis, I guess. Still on it. BTW, are there any more of such 'puzzle hunt' websites where you could play around and sharpen your decoding skills? Thanks!

Here's a list: https://gist.github.com/numberwhun/d85075f4f63411bafa1c6e40e...

Re: When you browse Instagram and find Tony Abbott's passport number

#215

Post by namdnay »

bostik wrote: post #122
fphhotchips wrote: post #38

I feel like this buries the lede massively: Qantas' system was run by Amadeus, who also run the booking system for some 200 other airlines [0]. If you could do this with Qantas and get all those notes, you could probably do it to any other airline and get them too. That would be bad enough, but it also appears that this issue (or one very much like it) has been reported widely at least back in early 2019. So, either…

The underlying issues have been known for quite a while. There was a fantastic talk in CCC at 2016 about the airline booking systems and the various bits of information you can glean from them.[0] 0: https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carme...

The underlying issue is that PNR+Last Name has always been the "secuirty" to access a booking, and no airline or travel agency wants to enforce stronger measures unilaterally, for fear of increasing friction for their customers

Re: When you browse Instagram and find Tony Abbott's passport number

#217

Post by abixb »

carlmr wrote: post #211
abixb wrote: post #204

Great post, thoroughly enjoyed reading it. BTW, on a side note, when you try and visit the blog's homepage[0] and scroll down to the bottom, you find a link to an actual (password protected) PDF file called Mango.pdf[1]. The author 'Alex' says the password for the PDF has been embedded in the page and it didn't take me a lot of time to figure the password out from the HTML source[2]. But when I opened the PDF, I was…

There are two layers to that encoding. When you see a random string of characters and numbers ending with one or two equals signs, think of base64. Then when you see something that seems like word groups with spaces, think of rot* (* = 13 being the most common version) encoding.

Thank you. I solved it. My decoding sequence was wrong before (I was trying to decode in reverse), but your pointers helped me.

Re: When you browse Instagram and find Tony Abbott's passport number

#218

Post by rntksi »

hdi8534 wrote: post #171
vishnugupta wrote: post #104

I accidentally discovered a way to get hold of passport details of random people by applying for Visa on arrival to Vietnam. There are these online portals which do some document pre processing which is legit. And on landing in Vietnam we are expected to show that we have already applied for Visa. It so happens that these portals do batch processing. Which means my application is processed along with a half a dozen o…

The same when you apply to give up vietnamese citizenship, all your info are public on the goverment website (pdf files with name, birthday, current addresss...)

with the way how the government over there works, even if you have those information... there's really nothing much to do with it.

Re: When you browse Instagram and find Tony Abbott's passport number

#219

Post by barbs »

nbgl wrote: post #207
abixb wrote: post #204

Great post, thoroughly enjoyed reading it. BTW, on a side note, when you try and visit the blog's homepage[0] and scroll down to the bottom, you find a link to an actual (password protected) PDF file called Mango.pdf[1]. The author 'Alex' says the password for the PDF has been embedded in the page and it didn't take me a lot of time to figure the password out from the HTML source[2]. But when I opened the PDF, I was…

Hint: try ROT13.

Quick posix shell rot13 tip: pipe it into:

tr '[A-Za-z]' '[N-ZA-Mn-za-m]'

Post reply on HN