Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When you browse Instagram and find Tony Abbott's passport number

mango.pdf.zone

Post reply on HN
Print view View original

131–140 of 354 posts

Re: When you browse Instagram and find Tony Abbott's passport number

#131

Post by taneq »

Agentlien wrote: post #112
Namidairo wrote: post #51

Earlier quoted context omitted.

> and if it is a PDF, convert to an image afterwards because too many PDF editors use non-destructive operations to add a new object instead of changing what's underneath. You'd be surprised at how many times this happens on Government documents with redaction. :S

A friend of mine once had to review some (Swedish) court document with redacted witness names. It was a word document with history intact. Just undoing a few steps was all it took.

One of my lecturers did that back at university - they generated an Excel spreadsheet containing everyone's marks, then for each student, deleted all but that student and saved as a different file.

Document history was turned on and anyone who hit ctrl+z got the full class marks.

(The same lecturer initially failed me because they forgot to add my final exam score to my assignments score, and then took four months to fix it. They weren't very competent.)

Re: When you browse Instagram and find Tony Abbott's passport number

#133

Post by saberdancer »

robjan wrote: post #41
fphhotchips wrote: post #38

I feel like this buries the lede massively: Qantas' system was run by Amadeus, who also run the booking system for some 200 other airlines [0]. If you could do this with Qantas and get all those notes, you could probably do it to any other airline and get them too. That would be bad enough, but it also appears that this issue (or one very much like it) has been reported widely at least back in early 2019. So, either…

The issue isn't Amadeus, it's that some airlines don't bother to use accounts with lower levels of privileges for operations which don't need full access. There are a number of different levels which are intended to be used for different purposes: for example, the credit card numbers are not visible to booking agents but can be accessed by the anti fraud department. Some airlines just use a single "god mode" account…

Could you explain how returning all data to the frontend is connected with "god mode" usage? Is the Amadeus system such that it created/masks different fields in the data depending on the access level you have?

In this case, "hacker" logged in a customer facing portal, this is probably not even an user account in the strict sense of the word.

I am asking as I fail to see how it is not a development issue. If they returned only the data that was needed on the page, it wouldn't expose internal comments or passport IDs.

Re: When you browse Instagram and find Tony Abbott's passport number

#134

Post by cgriswald »

nikanj wrote: post #109
kccqzy wrote: post #26

Nice. Here's a similar personal story with a PSA that sometimes blurring is NOT sufficient. A friend of mine posted on Instagram a picture of a U.S. visa (or something similar; it was probably five years ago) to announce her trip to the U.S., and she took care to blur out sensitive information such as her passport number. But a Gaussian blur is easy to reverse and I successfully unblurred it and told her my discovery…

My all-time favourite recommendation is "print, cut out the sensitive parts with an exacto knife, rescan". Firstly because it's a nice mix of analog and digital, and secondly because it's short enough to fit in a tweet - yet extremely secure.

...shred cut out parts, burn remains, mix with water, encase in cement, explode, divide rubble into four parts, disperse one part each in Lake Superior, Pacific Ocean, Atlantic Ocean, and the Great Salt Lake; assume an alias, move to Alaska...

Re: When you browse Instagram and find Tony Abbott's passport number

#135

Post by thdrdt »

Lately I am thinking about building a framework for web APIs where the database stores the owner, group and other's rights for each entity. The framework will then fetch data based on the user and fills the models based on the rights set for each field.

Exactly for the reason shown in the article.

I believe right now it is still too difficult to do this in any framework. That's why developers take shortcuts and just expose all entity data or just make a mistake and forget about it.

Does anyone know if such a framework already exists? So per field rights, not per entity rights.

Re: When you browse Instagram and find Tony Abbott's passport number

#136

Post by throwawaynothx »

thdrdt wrote: post #135

Lately I am thinking about building a framework for web APIs where the database stores the owner, group and other's rights for each entity. The framework will then fetch data based on the user and fills the models based on the rights set for each field. Exactly for the reason shown in the article. I believe right now it is still too difficult to do this in any framework. That's why developers take shortcuts and just…

or... GraphQL.

Re: When you browse Instagram and find Tony Abbott's passport number

#138

Post by jhealy »

tomerico wrote: post #95

I found his advice to Tony on how to get better with computers remarkably insightful: > I said there probably was a book out there about “the basics of IT”, but it wouldn’t help much. I didn’t learn from a book. 13 year old TikTok influencers don’t learn from a book. They just vibe. > My mum always said when I was growing up that: > There were “too many buttons” She was afraid to press the buttons, because she didn’t…

A similar anecdote from my family.

My uncle (a sheep farmer) and I discovered that:

1. I was afraid to touch anything in a car engine, but happy to muddle through unfamiliar computer issues

2. He was afraid to click unknown buttons on a computer screen, but comfortable pulling apart and rebuilding an unfamiliar car engine.

In both cases, we were confident because we knew whatever mistake we made we'd be able to reverse it. And in both cases, we were afraid of making a mistake that we couldn't reverse.

Re: When you browse Instagram and find Tony Abbott's passport number

#140

Post by [deleted] »

sellyme wrote: post #66
mroche wrote: post #60

Earlier quoted context omitted.

> is one of the most HN comments I've come across recently :) That gave me a laugh. I don't have any experience with Mathematica, but everytime I see it mentioned (usually on HN) I'm amazed at the sheer breadth the system is capable of. The amount of use cases and possibilities blows my mind.

The top solution on this Code Golf question is possibly the most comical example of Mathematica's scope that I've ever seen: https://codegolf.stackexchange.com/questions/71631/upgoat-or...

[deleted]
Post reply on HN