Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When you browse Instagram and find Tony Abbott's passport number

mango.pdf.zone

Post reply on HN
Print view View original

251–260 of 354 posts

Re: When you browse Instagram and find Tony Abbott's passport number

#251

Post by robjan »

underwater wrote: post #231
robjan wrote: post #160

Earlier quoted context omitted.

There are of course two errors that the developer of the backend made. The first is not filtering what came back from the Amadeus API, but the second one - the one I am referring to - is using an Amadeus API key with too much access. Amadeus filters the booking record depending on the level of access that the user accessing it has (the user being the backend in this case). In a previous life for another airline, I ha…

The API key shouldn't change what type of data an API call returns. The developer should explicitly request data and that either succeeds or fails based on authorisation. Making assumptions about the use case from the key will of course lead to this kind of error.

The PNR (passenger name record) is the data record which represents your booking on Amadeus. It's basically a semi-structured flat text file. Each line is an entry which may represent a leg of your journey, your name, the payment method used to make the booking or various remarks (which themselves are arbitrarily structured).

These lines are filtered / redacted depending on your role. You have to remember that this is a legacy system which has remained pretty much unchanged for 40-50 years. It's hard to change because hundreds of airlines have their own legacy systems which rely on bookings being structured this way. And when you book a multi-carrier itinerary, the airlines often all access this same record directly on Amadeus.

There has been some movement in recent years in a platform called NDC[0] (new distribution capability) but most airlines still rely on the PNR at the moment.

[0]: https://www.iata.org/en/programs/airline-distribution/ndc/

Re: When you browse Instagram and find Tony Abbott's passport number

#252

Post by ErikAugust »

kccqzy wrote: post #26

Nice. Here's a similar personal story with a PSA that sometimes blurring is NOT sufficient. A friend of mine posted on Instagram a picture of a U.S. visa (or something similar; it was probably five years ago) to announce her trip to the U.S., and she took care to blur out sensitive information such as her passport number. But a Gaussian blur is easy to reverse and I successfully unblurred it and told her my discovery…

Sure. I would go a step further - just don’t post any photos of these sorts of documents ever. The risk and reward ratio is too skewed.

Re: When you browse Instagram and find Tony Abbott's passport number

#253

Post by pessimizer »

powersnail wrote: post #96
exikyut wrote: post #75

Earlier quoted context omitted.

If you do that, look at the document, hit CTRL+Z, then look at the document again, it will likely look identical, thanks to the fact that rendering a PDF to a JPEG with 70-90% quality... at ~600DPI... then scaling it back out to a 75-150DPI screen... is going to look visually lossless. So, not only do you have the energy-investment thing noted in the/a sibling comment, you have the issue that there's no giant "THIS I…

There will be no CTRL + Z, as it can only be used to save to a new document (just like scanning). Under the hood, you created a new document, rasterize the original document page by page as JPEG, and insert the JPEGs back to the new document. You can even create a fake "printer", that outputs a PDF with rasterized images as pages, so you don't have to teach the office clerks to anything extra. To me, it seems to be i…

> It's pretty easy to verify if the page contains nothing but an image, programmically, especially if you also wrote the software that rasterize it in the first place.

It's pretty easy for a computer to verify any of this, the point is making it idiot proof. You don't have to be much of an idiot, if you process hundreds of documents a year where there's no way to visually verify the difference between a badly redacted document and a well redacted document, to screw up once. Especially when the difference between them is that you remembered to push the "redact correctly button", and if you forgot that, remembered to push the "verify if is redacted correctly programmatically" button before hitting send.

What you do is create a ritual where you have to walk across the room and use a physical machine. You'll remember doing that. And if you don't, since the output will look a bit crap, you can confirm it trivially.

Creating a process that has to be done perfectly every time or it fails catastrophically, and has few indications of failure during the process, is worse than having no process at all.

Re: When you browse Instagram and find Tony Abbott's passport number

#254

Post by pessimizer »

undebuggable wrote: post #162
kccqzy wrote: post #26

Nice. Here's a similar personal story with a PSA that sometimes blurring is NOT sufficient. A friend of mine posted on Instagram a picture of a U.S. visa (or something similar; it was probably five years ago) to announce her trip to the U.S., and she took care to blur out sensitive information such as her passport number. But a Gaussian blur is easy to reverse and I successfully unblurred it and told her my discovery…

> I personally recommend blacking out (add a black rectangle) instead of blurring Real life document workflows can be really tricky. What if one is required to print or photocopy the obscured document? Devastating for printer's toner or cartridge lifetime... In some cases opaque grayish rectangle does the job.

> Devastating for printer's toner or cartridge lifetime

Which could result in thousands of dollars of loss over decades. Is that really a significant concern? Charge the client for it.

Re: When you browse Instagram and find Tony Abbott's passport number

#255

Post by aneutron »

sygma wrote: post #226

Great talk [0] given during the 2016 congress touching on the Amadeus flight booking system and the danger of posting your boarding pass on social media [0]: https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carme...

This was an amazing watch. Thank you very much for the link.

Re: When you browse Instagram and find Tony Abbott's passport number

#256

Post by kortex »

Sysosmaster wrote: post #205
kccqzy wrote: post #26

Nice. Here's a similar personal story with a PSA that sometimes blurring is NOT sufficient. A friend of mine posted on Instagram a picture of a U.S. visa (or something similar; it was probably five years ago) to announce her trip to the U.S., and she took care to blur out sensitive information such as her passport number. But a Gaussian blur is easy to reverse and I successfully unblurred it and told her my discovery…

The thing to remember here is that the only way to hide (real world) data in an image is to reduce the amount of data in the picture... a blur or swirl leaves most if not all data just in the picture (although distorted) Any filter that removes data (such as pixelate or blacking out / whiting out) can be used to safely hide this data... Just remember to also strip out any unwanted meta data (Exif-data) and do not use…

Pixelation is also attackable. Generate input (e.g. GAN) and apply pixelation until it converges. Probably won't be super accurate but enough to probably ID someone.

Black/delete (and flatten/rebroadcast) is the only way.

Re: When you browse Instagram and find Tony Abbott's passport number

#257

Post by Freak_NL »

eru wrote: post #240
Freak_NL wrote: post #123

Earlier quoted context omitted.

If it is hard to get wrong, is it still dumb? Being able to verify with your own eyes that the redacted parts are indeed redacted is a pretty strong benefit to that process. You'll need to train staff to properly black out stuff (no idea what they do, heavy cardboard cut-outs or cutting out the censored content and using a black background for the scan?), but once that process is in place, it works. With software you…

Incidentally, you just wrote a pretty good argument for (political) voting on paper instead of via machines.

Absolutely. A system you can see and understand garners a lot more trust than a black-box (even if the box runs vetted and open software).

Re: When you browse Instagram and find Tony Abbott's passport number

#258

Post by userbinator »

undebuggable wrote: post #162
kccqzy wrote: post #26

Nice. Here's a similar personal story with a PSA that sometimes blurring is NOT sufficient. A friend of mine posted on Instagram a picture of a U.S. visa (or something similar; it was probably five years ago) to announce her trip to the U.S., and she took care to blur out sensitive information such as her passport number. But a Gaussian blur is easy to reverse and I successfully unblurred it and told her my discovery…

> I personally recommend blacking out (add a black rectangle) instead of blurring Real life document workflows can be really tricky. What if one is required to print or photocopy the obscured document? Devastating for printer's toner or cartridge lifetime... In some cases opaque grayish rectangle does the job.

White (with a black border) is fine too. Black is popular, but the goal is to make it an image with no residual data.

Re: When you browse Instagram and find Tony Abbott's passport number

#259

Post by jrochkind1 »

POiNTx wrote: post #20

Apart from the really interesting content, this is an extremely good read, strikes me as the right kind of balance of information and keeping you entertained. I really enjoyed this writing style!

Yes. I want to subscribe to his newsletter for sure.

Re: When you browse Instagram and find Tony Abbott's passport number

#260

Post by dbt00 »

prawn wrote: post #113
rswail wrote: post #106

Earlier quoted context omitted.

I wouldn't say he was our Trump. Our Trump is Clive Palmer, down to the grifting and ripping off subcontractors and employees and suing people. Abbott was more our McConnell, happy to tear down political norms and standard parliamentary practice while claiming to defend it. He was a "good" opposition leader in that he basically was in opposition to everything proposed by the government, not for good reason, just beca…

I think your Trump-Palmer comparison is decent, but not sure about McConnell. Something that seemed key to Abbott was his focus on very repetitive and simple statements - the three word slogans (stop the boats, axe the tax; hardly discouraged "ditch the witch"). Not saying there hasn't been similar before, but he was particularly effective with it. Trump has used similar tactics (build the wall, lock her up, etc), wh…

Sounds like GW Bush.
Post reply on HN