Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When you browse Instagram and find Tony Abbott's passport number

mango.pdf.zone

Post reply on HN
Print view View original

151–160 of 354 posts

Re: When you browse Instagram and find Tony Abbott's passport number

#151

Post by stubish »

tomerico wrote: post #95

I found his advice to Tony on how to get better with computers remarkably insightful: > I said there probably was a book out there about “the basics of IT”, but it wouldn’t help much. I didn’t learn from a book. 13 year old TikTok influencers don’t learn from a book. They just vibe. > My mum always said when I was growing up that: > There were “too many buttons” She was afraid to press the buttons, because she didn’t…

You missed the corresponding footnote:

“Nobody gives the baby a knife. You give them a spoon” - Mum, when I showed her this.

(which is also insightful, because the 'Mums' I've dealt with are mostly worried that pushing the wrong button will permanently break something, as if they used to sell blenders without safety features or something back in the day)

Re: When you browse Instagram and find Tony Abbott's passport number

#152

Post by strange_aeons »

chrismorgan wrote: post #148

A few years back when I was looking to buy a house, I was interested in how long the property had been on the market. (I was looking in country towns and their outskirts, where six months is a typical time for a property to be on the market; I even saw one or two blocks of land that seemed to have been for sale for at least five or six years.) Few real estate agents tell you this on their websites (though if you ask,…

That's interesting. The time on market is always listed on Danish real estate websites. And the aggregator sites also have previous listings.

Re: When you browse Instagram and find Tony Abbott's passport number

#154

Post by Biganon »

bobthepanda wrote: post #91
searchableguy wrote: post #80

Earlier quoted context omitted.

Yeah same. It's pretty common for restaurants and households to have raw onion in the salad (at least in north India). Unusual for someone to eat them with the skin though.

But that would be chopped or otherwise separated onion right? Not eating an onion the way one would eat an apple.

My fiancée has been to the Azores and told me she's seen old people eat onions like apples there

Re: When you browse Instagram and find Tony Abbott's passport number

#156

Post by cricalix »

Zealotux wrote: post #129

>I personally recommend blacking out (add a black rectangle) instead of blurring This can be reversed as well, if you do black things out this way: please make sure you're using 100% opacity black. I've managed to retrieve data from plenty "blacked-out" documents simply by playing with contrast and exposure filters in Photoshop because the opacity wasn't set correctly.

Black it out, print it to paper, scan it back in, embed the image in a Word document, and print to PDF. Wait, that's just how "most" people do it anyway..

Re: When you browse Instagram and find Tony Abbott's passport number

#157

Post by taneq »

coagmano wrote: post #71
boyter wrote: post #35

Earlier quoted context omitted.

Yes and no. It was the pinnacle in a series of bizzare behaviour from Tony while he was the Prime Minister. Certainly its the one people most remember of him. Keep in mind he ate it with the skin on as well. I think its also something people look out for, with the previous PM Kevin Rudd being somewhat infamous for eating his own ear wax on live TV. When I was working on an archive project for the ABC, "tony eating on…

The earwax thing was during a long boring session in parliament, so not exactly Live TV

Oh, well that explains it, then. Perfectly legitimate behaviour. /s

Re: When you browse Instagram and find Tony Abbott's passport number

#158

Post by thdrdt »

throwawaynothx wrote: post #136
thdrdt wrote: post #135

Lately I am thinking about building a framework for web APIs where the database stores the owner, group and other's rights for each entity. The framework will then fetch data based on the user and fills the models based on the rights set for each field. Exactly for the reason shown in the article. I believe right now it is still too difficult to do this in any framework. That's why developers take shortcuts and just…

or... GraphQL.

How does GraphQL fix the problem of showing different fields depending on rights?

Re: When you browse Instagram and find Tony Abbott's passport number

#159

Post by DanBC »

TwoBit wrote: post #100
kccqzy wrote: post #26

Nice. Here's a similar personal story with a PSA that sometimes blurring is NOT sufficient. A friend of mine posted on Instagram a picture of a U.S. visa (or something similar; it was probably five years ago) to announce her trip to the U.S., and she took care to blur out sensitive information such as her passport number. But a Gaussian blur is easy to reverse and I successfully unblurred it and told her my discovery…

A pedophile ringleader was once caught by reversing a graphical swirl he used to try to hide his face in a picture.

Yes. Wikipedia has an article about him here: https://en.wikipedia.org/wiki/Christopher_Paul_Neil

Re: When you browse Instagram and find Tony Abbott's passport number

#160

Post by robjan »

saberdancer wrote: post #133
robjan wrote: post #41

Earlier quoted context omitted.

The issue isn't Amadeus, it's that some airlines don't bother to use accounts with lower levels of privileges for operations which don't need full access. There are a number of different levels which are intended to be used for different purposes: for example, the credit card numbers are not visible to booking agents but can be accessed by the anti fraud department. Some airlines just use a single "god mode" account…

Could you explain how returning all data to the frontend is connected with "god mode" usage? Is the Amadeus system such that it created/masks different fields in the data depending on the access level you have? In this case, "hacker" logged in a customer facing portal, this is probably not even an user account in the strict sense of the word. I am asking as I fail to see how it is not a development issue. If they ret…

There are of course two errors that the developer of the backend made. The first is not filtering what came back from the Amadeus API, but the second one - the one I am referring to - is using an Amadeus API key with too much access.

Amadeus filters the booking record depending on the level of access that the user accessing it has (the user being the backend in this case). In a previous life for another airline, I have experienced this problem before when a vendor tried to get something through to production which was retuning credit card numbers and expiry dates to the frontend (but not the CV3). This was all because the vendor tried to use the highest privilege API key rather than the one with access to the specific info they needed. It never got past UAT thanks to thorough security review in this case.

Post reply on HN