Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When you browse Instagram and find Tony Abbott's passport number

mango.pdf.zone

Post reply on HN
Print view View original

231–240 of 354 posts

Re: When you browse Instagram and find Tony Abbott's passport number

#231

Post by underwater »

robjan wrote: post #160
saberdancer wrote: post #133

Earlier quoted context omitted.

Could you explain how returning all data to the frontend is connected with "god mode" usage? Is the Amadeus system such that it created/masks different fields in the data depending on the access level you have? In this case, "hacker" logged in a customer facing portal, this is probably not even an user account in the strict sense of the word. I am asking as I fail to see how it is not a development issue. If they ret…

There are of course two errors that the developer of the backend made. The first is not filtering what came back from the Amadeus API, but the second one - the one I am referring to - is using an Amadeus API key with too much access. Amadeus filters the booking record depending on the level of access that the user accessing it has (the user being the backend in this case). In a previous life for another airline, I ha…

The API key shouldn't change what type of data an API call returns. The developer should explicitly request data and that either succeeds or fails based on authorisation. Making assumptions about the use case from the key will of course lead to this kind of error.

Re: When you browse Instagram and find Tony Abbott's passport number

#234

Post by NamTaf »

anon9001 wrote: post #29
POiNTx wrote: post #20

Apart from the really interesting content, this is an extremely good read, strikes me as the right kind of balance of information and keeping you entertained. I really enjoyed this writing style!

This was really a delight to read. I wonder if the author was raised on 2600. Fantastic stuff. Also visited his page. Does not disappoint: https://mango.pdf.zone/

Ah, he was the guy who wrote the facebook sleep time stalker script! It hits the same style of prose very closely.

Re: When you browse Instagram and find Tony Abbott's passport number

#235

Post by jooize »

powersnail wrote: post #96
exikyut wrote: post #75

Earlier quoted context omitted.

If you do that, look at the document, hit CTRL+Z, then look at the document again, it will likely look identical, thanks to the fact that rendering a PDF to a JPEG with 70-90% quality... at ~600DPI... then scaling it back out to a 75-150DPI screen... is going to look visually lossless. So, not only do you have the energy-investment thing noted in the/a sibling comment, you have the issue that there's no giant "THIS I…

There will be no CTRL + Z, as it can only be used to save to a new document (just like scanning). Under the hood, you created a new document, rasterize the original document page by page as JPEG, and insert the JPEGs back to the new document. You can even create a fake "printer", that outputs a PDF with rasterized images as pages, so you don't have to teach the office clerks to anything extra. To me, it seems to be i…

It is probably still easier to screw up on a computer than by looking at physical documents to verify them and then scanning them.

Re: When you browse Instagram and find Tony Abbott's passport number

#237

Post by astura »

philliphaydon wrote: post #117

I still find it strange you can manage a booking with just a reference and name. About ~5 years ago someone I follow on twitter posted their boarding pass and I replied to them with a screen shot asking if I should cancel the booking. They removed their post and I removed mine. But all it took was the reference on the boarding pass and their last name...

I understand why... A lot of business travelers have a third party book their flights, so there isn't always a username/password. Airlines and travel agencies don't make it clear that it's sensitive information though.

Re: When you browse Instagram and find Tony Abbott's passport number

#239

Post by logifail »

In some countries, identity documents are in relatively frequent use. The number of authorised strangers who would have access to one's identity document might be significantly higher in these jurisdictions than, say, the number who would be able to view Tony Abbott's passport number. I'm thinking of - for instance - the 'personnummer' in Sweden (I've heard friends recite theirs in public when asked for them).

Q: Should (merely) the number from your passport really be considered a secret?

Re: When you browse Instagram and find Tony Abbott's passport number

#240

Post by eru »

Freak_NL wrote: post #123
Someone1234 wrote: post #57

Earlier quoted context omitted.

That's why some even departments now have policies of printing and re-scanning retracted documents. It is dumb, but yet pretty hard to get wrong. Both MS Word and PDF have leaked redacted/removed information in the past. Wasting paper given the severity of some of these leaks is minimal cost.

If it is hard to get wrong, is it still dumb? Being able to verify with your own eyes that the redacted parts are indeed redacted is a pretty strong benefit to that process. You'll need to train staff to properly black out stuff (no idea what they do, heavy cardboard cut-outs or cutting out the censored content and using a black background for the scan?), but once that process is in place, it works. With software you…

Incidentally, you just wrote a pretty good argument for (political) voting on paper instead of via machines.
Post reply on HN