Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

One million passports leaked online

theverge.com

Post reply on HN
Print view View original

11–20 of 264 posts

Re: One million passports leaked online

#11

Post by Kuinox »

real_chudson wrote: post #6
dgellow wrote: post #3

Oh god that’s pretty bad > The documents were hosted by systems used by cannabis clubs and a company called Nefos, which operates PuffPal, a platform that manages membership and age verification for cannabis retailers and clubs across Europe. The infrastructure storing these identity documents—full passport scans, driver’s licenses with photos, names, and identifying numbers—was left completely unprotected on publicl…

The EU's verification laws will ensure much more of these leaks in the future, and therefore much more fines

How so, are you purely speculating or you found a hole in the zero knowledge proof system some countries are implementing ?

Re: One million passports leaked online

#12

Post by forestry »

real_chudson wrote: post #6
dgellow wrote: post #3

Oh god that’s pretty bad > The documents were hosted by systems used by cannabis clubs and a company called Nefos, which operates PuffPal, a platform that manages membership and age verification for cannabis retailers and clubs across Europe. The infrastructure storing these identity documents—full passport scans, driver’s licenses with photos, names, and identifying numbers—was left completely unprotected on publicl…

The EU's verification laws will ensure much more of these leaks in the future, and therefore much more fines

Is it requirement to retain the documents? Many are waiting for gatekeeper tech companies to organise around attestation rather than submission to third parties. I hope they are making progress.

Re: One million passports leaked online

#13

Post by wolvoleo »

dgellow wrote: post #8
ericpauley wrote: post #7

Earlier quoted context omitted.

CA article is just AI;dr on a two week old Verge article: https://www.theverge.com/tech/947157/passports-data-breach-c...

Ok, then changing the link to the verge article. Thanks for pointing that out

The verge is not a good source as it's pay walled

Re: One million passports leaked online

#15

Post by rationalist »

gertrunde wrote: post #9

The lack of security is one thing, but why have they retained the information at all ! iirc, one of the elements of GDPR is "storage limitation", i.e. you must not keep personal data for longer than you need it - and in this case, the data is only needed to verify the age of the user, and shouldn't ever be required again (unless people can now get younger). Once a document has been used to verify a person's identity…

10 years after I took the ACT, I received a letter from a university that I never went to, saying my SSN was leaked.

WHY THE F**k ARE THEY HOLDING ON TO THAT 10 YEARS LATER!?!?!?

Of course now I know better than to give out my SSN to anyone who asks for it, but I didn't know that as a teenager.

Until stupid s**t like this becomes illegal, it will just keep continuing.

Re: One million passports leaked online

#16

Post by vrsgjye »

rationalist wrote: post #15
gertrunde wrote: post #9

The lack of security is one thing, but why have they retained the information at all ! iirc, one of the elements of GDPR is "storage limitation", i.e. you must not keep personal data for longer than you need it - and in this case, the data is only needed to verify the age of the user, and shouldn't ever be required again (unless people can now get younger). Once a document has been used to verify a person's identity…

10 years after I took the ACT, I received a letter from a university that I never went to, saying my SSN was leaked. WHY THE F**k ARE THEY HOLDING ON TO THAT 10 YEARS LATER!?!?!? Of course now I know better than to give out my SSN to anyone who asks for it, but I didn't know that as a teenager. Until stupid s**t like this becomes illegal, it will just keep continuing.

[dead]

Re: One million passports leaked online

#18

Post by voakbasda »

dgellow wrote: post #3

Oh god that’s pretty bad > The documents were hosted by systems used by cannabis clubs and a company called Nefos, which operates PuffPal, a platform that manages membership and age verification for cannabis retailers and clubs across Europe. The infrastructure storing these identity documents—full passport scans, driver’s licenses with photos, names, and identifying numbers—was left completely unprotected on publicl…

Show me the consequences. I hear there are supposed to be repercussions, but these asshats never seem to pay for their crimes.
Post reply on HN