Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

One million passports leaked online

theverge.com

Post reply on HN
Print view View original

81–90 of 264 posts

Re: One million passports leaked online

#81

Post by VladVladikoff »

shmoobadge wrote: post #29

Much as passports are very important for proving identity etc, people who travel have had their passport scanned, photographed or photocopied by pretty much every hotel they've stayed in. I'm not sure the shoebox in the backroom in Koh Samui with the photocopies in constitutes good storage hygiene protocols. How that doesn't turn into rampant identity theft I don't know, or maybe it does? Not, happily, for me... yet.

I am working on hotel software. And we are doing an automated kiosk check in with identity scanning. I’m seriously stressed about holding on to this kind of toxic waste. I am trying to limit it as much as possible. For example throwing away scans as fast as possible (within regulatory allowances). But I would love to hear any ideas anyone has in terms of further security. Obviously the documents are not just on a public bucket. But I’m considering maybe encrypting each document with a separate key, or something along those lines.

Re: One million passports leaked online

#82

Post by lazide »

subscribed wrote: post #68
lazide wrote: post #49

Earlier quoted context omitted.

Not if there is no law about it. If there is a law about verifying buyers, how else are they going to pass that audit?

There's a law forbidding storage beyond necessary minimum and law punishing such behaviour unless another law necessitated storage of the original document in the unsecured, unencrypted form. Doubtful. There's also laws mandating secure systems design. Separately there's no _need_ to store the original document if the verification system is sound (and audit real, not some phony crap like in some of the scandals poste…

If you need to prove you sold to real people, storing their credentials is a necessary thing, for as long as your need to prove that. At least with the way things currently are.

How else do you expect it to work? ‘Honest, we checked’ checkboxes?

Re: One million passports leaked online

#83

Post by recursivecaveat »

cute_boi wrote: post #51
rationalist wrote: post #15

Earlier quoted context omitted.

10 years after I took the ACT, I received a letter from a university that I never went to, saying my SSN was leaked. WHY THE F**k ARE THEY HOLDING ON TO THAT 10 YEARS LATER!?!?!? Of course now I know better than to give out my SSN to anyone who asks for it, but I didn't know that as a teenager. Until stupid s**t like this becomes illegal, it will just keep continuing.

I think every SSN is already leaked and government is doing nothing. I tried to change SSN and they told me it is not possible.

100s of millions have definitely been exposed already. The best defence is probably to be a baby so your risk window is minimal. I haven't been able to pull that off personally, so I follow the other recommended piece of advice which is to keep your credit checks permanently frozen with the agencies and only temporarily thaw it for specific usages.

https://www.upguard.com/breaches/social-insecurity-billions-...

Re: One million passports leaked online

#84

Post by edoceo »

mothballed wrote: post #78
edoceo wrote: post #76

Earlier quoted context omitted.

It's not like this in USA for cannabis. States with medical programs issue medical cards and the dispensary uses that as the only form of ID. For adult-recreational the dispensary can choose their ID verification system. Many use ID scanners connected to their online POS provider. The State run system doesn't track retail sales to an individual.

Medical marijuana is linked to the PMP in my state. https://azcir.org/news/2025/04/10/are-az-medical-marijuana-c...

OMG, I forgot that AZ and VT have very unique programs. Basically everyone else is on BioTrack or Metrc which are dedicated cannabis "track and trace" - ex-pharmacy infrastructure

Re: One million passports leaked online

#85

Post by TZubiri »

rationalist wrote: post #15
gertrunde wrote: post #9

The lack of security is one thing, but why have they retained the information at all ! iirc, one of the elements of GDPR is "storage limitation", i.e. you must not keep personal data for longer than you need it - and in this case, the data is only needed to verify the age of the user, and shouldn't ever be required again (unless people can now get younger). Once a document has been used to verify a person's identity…

10 years after I took the ACT, I received a letter from a university that I never went to, saying my SSN was leaked. WHY THE F**k ARE THEY HOLDING ON TO THAT 10 YEARS LATER!?!?!? Of course now I know better than to give out my SSN to anyone who asks for it, but I didn't know that as a teenager. Until stupid s**t like this becomes illegal, it will just keep continuing.

I'm not american, but the idea that your SSN, which is effectively a (federal) unique identifier for a person, would be secret, is very foreign.

In most countries, like most databases, our primary keys do not hold an expectation of secrecy.

I would even argue that the expectation of secrecy is what creates it's secret semantics, that is, it's secret because you make it secret. I get that it's a collective action thing, if you just publish your own SSN, a bank in another state might not be aware it's a public thing for YOU, and might open an account for a stranger.

Interestingly enough, for corporations, their identifiers, EIN, are not assumed to be private, in many states these are available through the DoS public records. So it turns out the system works just fine if you make the ID of a person (juristic or legal) public.

Re: One million passports leaked online

#86

Post by baliex »

tartoran wrote: post #21

> Note what happened. A high-value credential—a passport—was used in an ancillary low-value authentication system: ID verification for cannabis dispensaries. And it’s the low-value system that got hacked, putting the high-value credential at risk. Why do these systems hold onto user's data post verification?

In a word: complaints.

It’s somewhat understandable but also part of the problem.

Re: One million passports leaked online

#87

Post by ashley95 »

VladVladikoff wrote: post #81
shmoobadge wrote: post #29

Much as passports are very important for proving identity etc, people who travel have had their passport scanned, photographed or photocopied by pretty much every hotel they've stayed in. I'm not sure the shoebox in the backroom in Koh Samui with the photocopies in constitutes good storage hygiene protocols. How that doesn't turn into rampant identity theft I don't know, or maybe it does? Not, happily, for me... yet.

I am working on hotel software. And we are doing an automated kiosk check in with identity scanning. I’m seriously stressed about holding on to this kind of toxic waste. I am trying to limit it as much as possible. For example throwing away scans as fast as possible (within regulatory allowances). But I would love to hear any ideas anyone has in terms of further security. Obviously the documents are not just on a pub…

Encrypt the data with an asymmetric key; and keep the decryption key somewhere offline. You can get a hardware token to store the key on (I think a yubikey can do this).

Re: One million passports leaked online

#88

Post by cebert »

> PuffPal, a platform that manages membership and age verification for cannabis retailers and clubs across Europe.

At least we’re keeping the children safe though by verifying ages. It’s worth giving up privacy for that…

Re: One million passports leaked online

#89

Post by throwaway692675 »

I'm aware of another batch of leaked passports, from a few years ago.

A family member was booking a school tour, when he noticed the URL of the Travel CRM included an id number. Sure enough, the CRM would return all his details given only the (sequential) id number without a need for credentials: high resolution passport scan, and all the other details provided when booking an overseas trip.

He notified the CRM company, and that email was ignored. He emailed again, proposing disclosure, and the problem was silently fixed with no response.

A few months later he mentioned it to the school, along with the fact that he had followed up and had the vulnerability fixed. The school went straight into panic mode, called him to the principal's office and forced him to write a statement so they could refer him to the Feds. I intervened, explaining that he was the good guy who got the vulnerability fixed, and the problem was the school's, since they had supposedly vetted the CRM for security when choosing a tour company.

All of a sudden from the school's point of view there was no problem and no need to mention it to any of the people whose information had been disclosed, despite my insistence. The people still haven't been notified. The school did acknowledge that the family member had done the right thing and verbally thanked him, but would not put anything in writing.

The people involved in the tour had their details leaked, but there was nothing special about those people in the system, so realistically every person whose details were in that CRM had their details, including passports, leaked. It was a major travel CRM provider, so the number of people in the system would have been 6 or 7 figures.

The kicker is that the family member was employed by a software company that had the school system as a customer. The IT person who was responsible for vetting the travel CRM (and had verbally thanked him) arranged for the school system to phone his employer and deliver an ultimatum: that the family member be sacked or they would risk losing a customer. The family member got the sack.

Re: One million passports leaked online

#90

Post by ishouldstayaway »

tartoran wrote: post #21

> Note what happened. A high-value credential—a passport—was used in an ancillary low-value authentication system: ID verification for cannabis dispensaries. And it’s the low-value system that got hacked, putting the high-value credential at risk. Why do these systems hold onto user's data post verification?

> Why do these systems hold onto user's data post verification?

Depending on the company, you could rate the reasons on a scale from "incompetence/naivete" to "revenue stream".

Post reply on HN