Live data from Hacker News

Database containing personal info of 106M visitors to Thailand exposed online

comparitech.com

21–30 of 50 posts

Re: Database containing personal info of 106M visitors to Thailand exposed online

#21

Earlier quoted context omitted.

The database included full names, passport numbers, arrival dates, and more.

Yes, but it's been taken down. I can't query the dataset to see if I, personally, have been exposed.

Tell me your passport number, names, DOB and I will look it up and let you know… /s

Re: Database containing personal info of 106M visitors to Thailand exposed online

#22
post #7

Earlier quoted context omitted.

What can you do with a passport number?

Some crypto websites accept Passport as a means to verify you before you can withdraw funds.

A new passport number comes with each replacement/renewal so I would suspect this is just security theater and you can upload any sample passport with the text changed. If they are insisting on the same exact passport again they could accept a fax of a random artwork and it would be more secure and just as permanent.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#23
I guess I'm in there too. But passports get copied and provided to so many institutions these days that I wouldn't even consider nationality and passport number as private.

Now, if someone is traveling to Thailand to partake of some of the more controversial options, then I can see how this would be damaging.

We should all do our best to maintain privacy, but at the same time we should understand that the concept of privacy is changing. And by that I mean that we have less - and will have even less in the future - privacy than people did 10+ years ago.

It won't be long before biometric and other personally identifiable scanners will be integrated into much of what we touch or where we go. It may not be publicly known or even legal, but it will (and probably already does) happen. Just look at the NFC and facial recognition systems in much of our shopping places...

Re: Database containing personal info of 106M visitors to Thailand exposed online

#24

Earlier quoted context omitted.

I'm literally in Thailand right now and really can't say this bothers me. None of that info is sensitive

Name -> passport # isn't concerning?

If you travel much, or nowadays if you register on just about any legitimate cryptocurrency exchange, you've already shared this information - and usually with a photo.

And with the new COVID stuff/vaccinations, it's being shared more often even if you don't travel.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#25
post #7

Earlier quoted context omitted.

What can you do with a passport number?

Some crypto websites accept Passport as a means to verify you before you can withdraw funds.

Which ones? The ones I've used use passport (and often photo holding passport) to enable certain features or raise limits, but they're not used for withdrawl. 2FA and email verification is.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#27

Earlier quoted context omitted.

Name -> passport # isn't concerning?

No, why would it be? I've provided it to hotel staff, Airbnb hosts, condo security, car rental places, airline staff, and more over the years. They all make copies of it digitally and physically so it's floating around out there in lots of places. Next time I get a passport it will change anyways so I'm not sure I see the big deal even if it was a unique, never changing number.

15 years ago a foreigner couldn't even get a hotel room in Thailand without handing over passport information for each guest. I can't imagine it's changed much since then. If the Thai police want to track you down it wouldn't be very hard.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#28
post #8

What dangers are associated with this type of data becoming public? I can imagine burglars using this info to decide which houses and apartments to rob. Anything else that comes to mind? Any first / second hand experiences of what can happen if private data like this becomes public?

This is useful to attackers in social engineering scenarios for sure. Additionally, some KBA authentication schemes might still be in place which make leaks like this one particularly problematic. Eg. one of my banks still asks relatively easy to answer questions to authenticate me when I call to unlock my card. The most infamous KBA incident was the large scale IRS's tax returns fraud that occurred in 2014-2015: - h…

(In the US) passport info is not typically used for KBA, none of the common providers do it.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#29

Earlier quoted context omitted.

The database included full names, passport numbers, arrival dates, and more.

I'm literally in Thailand right now and really can't say this bothers me. None of that info is sensitive

Yet.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#30
post #27

Earlier quoted context omitted.

No, why would it be? I've provided it to hotel staff, Airbnb hosts, condo security, car rental places, airline staff, and more over the years. They all make copies of it digitally and physically so it's floating around out there in lots of places. Next time I get a passport it will change anyways so I'm not sure I see the big deal even if it was a unique, never changing number.

15 years ago a foreigner couldn't even get a hotel room in Thailand without handing over passport information for each guest. I can't imagine it's changed much since then. If the Thai police want to track you down it wouldn't be very hard.

I can't think of a single country (other than my own, and maybe in the rest of the EU) where I've gone to a hotel and not had to give my passport and credit card. Passport is photocopied, credit card is checked. Passport number is like a US social security number, it's public information.
Post reply on HN