Post a boarding pass on Facebook, get your account stolen • Hacker News Board

Re: Post a boarding pass on Facebook, get your account stolen

#291

Post by mod » Sun, Sep 24, 2017, 4:37 AM UTC

DougWebb wrote: post #163

It's not just posting photos that can cause this kind of trouble. I get a lot of email intended for other Doug Webbs sent to my gmail account, with variations on the presence/location of periods, or CC'd with another gmail account that's the same but with numbers on the end. For a while I was getting boarding passes from a major airline for a Doug that was frequently flying up and down the US west coast. Those emails…

I have a guy doing this to me. I have firstname.lastname@gmail.com

He lives in Texas and teaches a sport. I got a reminder that he had to visit the doctor a while back. I replied and got a real human and asked her to tell him he was giving the wrong email. I don't think it happened, something new showed up later.

I had never considered doing anything to mess up something he had done (like canceling his appointment) to get his attention.

Overall it's not that big of a hassle. It peeves me a bit, but I guess I'll let it continue.

Re: Post a boarding pass on Facebook, get your account stolen

#292

Post by thaumasiotes » Sun, Sep 24, 2017, 4:38 AM UTC

JumpCrisscross wrote: post #132

JupiterMoon wrote: post #36

Earlier quoted context omitted.

> My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager The problem with this is that the "security" question will often be asked over the phone. At this point an answer of "Oh I just mash the keyboard for those" is probably going to get an attacker access to your account..

> The problem with this is that the "security" question will often be asked over the phone. At this point an answer of "Oh I just mash the keyboard for those" is probably going to get an attacker access to your account I used to do this and then lost my password file. Fast forward to a call with AT&T. I told them I forgot my secret answers. They offered that it was "a super weird answer," which let me use the "mashed…

I can confirm that "I'm not going to be able to tell you the secret answer" was accepted by Blizzard when they locked my account and made me apply to have it unlocked.

I'm still bitter about that. I put garbage in the answer to the secret question because I planned not to forget my password. I didn't forget my password, but Blizzard nevertheless locked me out of my account, for the crime of using a payment card that was listed on my account, but wasn't listed as my "preferred" payment option.

Re: Post a boarding pass on Facebook, get your account stolen

#293

Post by teddyh » Sun, Sep 24, 2017, 4:43 AM UTC

quesera wrote: post #279

teddyh wrote: post #250

Earlier quoted context omitted.

A user-chosen password have exactly 0 bits of guaranteed randomness. A randomly generated password has X bits of randomness, and a list of Y passwords of X bits each, where the user is allowed to choose exactly one of the passwords, has exactly X−(log2(Y)) bits. So, to answer your questions: Your intuition is correct – since user-chosen passwords do not contain any guaranteed randomness, generated passwords are bette…

FWIW, I see several examples with two numbers and up to four uppercase letters. There's a clear bias toward lowercase letters though.

You’re right. Looking at the source code (https://github.com/tytso/pwgen/blob/master/pw_phonemes.c#L59), the algorithm seems to be rather complicated, so I can’t say what the exact number of bits is. But we could certainly calculate an upper bound:

7 letters a-z which are either upper or lower case, plus an unknown digit at an unknown location, gives:

(26+26)⁷×10×8 = 82245736202240 possible passwords, giving log2(82245736202240) = 46.225006121875005 bits. Subtracting the bits for the 8×20 choices of passwords gives

log2((26+26)⁷×10×8)−log2(8×20) = 38.90307802698764 bits as an upper bound of the security of a password chosen by a user from the default output of pwgen(1). This is a bit more than the 34.7 bits I first thought it was, but not much more. And this is an upper bound; since I can see that the source code does not choose each character completely randomly and does, as you say, seem to prefer lower case letters, the correct number of bits is guaranteed to be lower than 38.9.

Re: Post a boarding pass on Facebook, get your account stolen

#294

Post by pishpash » Sun, Sep 24, 2017, 7:30 AM UTC

DougWebb wrote: post #163

It's not just posting photos that can cause this kind of trouble. I get a lot of email intended for other Doug Webbs sent to my gmail account, with variations on the presence/location of periods, or CC'd with another gmail account that's the same but with numbers on the end. For a while I was getting boarding passes from a major airline for a Doug that was frequently flying up and down the US west coast. Those emails…

I get this all the time and initially have been nicely replying/forwarding, but after a while you have to figure they don't care, so it's either spam or account take over. After all, "I" own the identity, and "I" want my email back.

Re: Post a boarding pass on Facebook, get your account stolen

#295

Post by Fnoord » Sun, Sep 24, 2017, 12:48 PM UTC

developer2 wrote: post #219

gecko wrote: post #207

Earlier quoted context omitted.

It's also built into 1Password. And before that, I just used what I think was literally a one- or two-line Perl script that just grabbed four words from /var/dict. Why yes, my mother's maiden name was indeed pathetic xylophone tootsie wasp, how did you know?

The entire point of security questions is that their answers are supposed to be things that are permanently stored in your memory, that you are physically incapable of forgetting because they are so ingrained. If you store these in a password manager, it is possible to lose them - and that is unacceptable. These are supposed to be the very last line of defense for security, including if lose your password manager. As…

> The entire point of security questions is that their answers are supposed to be things that are permanently stored in your memory, that you are physically incapable of forgetting because they are so ingrained. If you store these in a password manager, it is possible to lose them - and that is unacceptable.

With a password manager such as Lastpass or 1Password you only need one very strong password you as human can remember. The passwords it manages don't need to be human-rememberable. They can have as high entropy as allowed.

> Anything relying on tech (like a password manager) is a bad idea for the general public. The average person does not have multiple off-site backups to guarantee that the information is physically impossible to lose.

2FA of the strong password plus physical OTP (like YubiKey) with one backup key is more than suffice. Sure, its not 3 letter agency proof. They can easily break in your house and steal your backup key temporarily, whilst recording you typing in your password, or catching you on the go. But against most criminals (a much more common vector for the general public) this is going to work just fine.

Re: Post a boarding pass on Facebook, get your account stolen

#296

Post by jackemupguy2 » Sun, Sep 24, 2017, 12:49 PM UTC

The most notable information here is the dumpster diving at airports .. and what it can get you. Namely - people discarding their airline passes at airports. "Barcodes can also be found on “forgotten” boarding passes in aircraft or other locations." ... holy shit, I never thought about that ... wow.

Re: Post a boarding pass on Facebook, get your account stolen

#297

Post by PretzelFisch » Sun, Sep 24, 2017, 12:58 PM UTC

developer2 wrote: post #219

gecko wrote: post #207

Earlier quoted context omitted.

It's also built into 1Password. And before that, I just used what I think was literally a one- or two-line Perl script that just grabbed four words from /var/dict. Why yes, my mother's maiden name was indeed pathetic xylophone tootsie wasp, how did you know?

The entire point of security questions is that their answers are supposed to be things that are permanently stored in your memory, that you are physically incapable of forgetting because they are so ingrained. If you store these in a password manager, it is possible to lose them - and that is unacceptable. These are supposed to be the very last line of defense for security, including if lose your password manager. As…

why not just offer a snail mail reset?

Re: Post a boarding pass on Facebook, get your account stolen

#298

Post by _asummers » Sun, Sep 24, 2017, 1:29 PM UTC

flashman wrote: post #280

DougWebb wrote: post #163

It's not just posting photos that can cause this kind of trouble. I get a lot of email intended for other Doug Webbs sent to my gmail account, with variations on the presence/location of periods, or CC'd with another gmail account that's the same but with numbers on the end. For a while I was getting boarding passes from a major airline for a Doug that was frequently flying up and down the US west coast. Those emails…

My Gmail account was one of the first created. Here's a quick list of emails I've received intended for other people: - Thailand holiday itineraries and airline tickets - A PayPal money request for $1800 - Congratulations from someone's godfather that I am now able to play the opening riff of AC/DC's "Hells Bells" - South African real estate quotes - A bar mitzvah invitation - A reply to a Thanksgiving invitation sen…

You should decide to do some of these one day! Show up to a bar mitvah with gifts and stuff and when people ask who you are, you just show them the invitation. "I dunno man, they told me it was a party, so I showed up... Mazel tov!"

Re: Post a boarding pass on Facebook, get your account stolen

#299

Post by _asummers » Sun, Sep 24, 2017, 1:31 PM UTC

exodust wrote: post #61

babuskov wrote: post #18

Just to clarify in case someone assumes the same thing I did from the headline: it isn't the Facebook account that gets stolen, but the airline website account.

And really this has nothing to do with Facebook at all, it's not a good title.

I've seen that meme get passed around Facebook for several different airlines, several times. It's always so lazy too "this company that's been around for 60 years is turning 88! Wow get your free tickets because thats what companies do when they turn 88!"

Re: Post a boarding pass on Facebook, get your account stolen

#300

Post by _asummers » Sun, Sep 24, 2017, 1:36 PM UTC

atomwaffel wrote: post #135

hoschicz wrote: post #75

Earlier quoted context omitted.

This image contains the following info: (long line of gibberish, the boarding pass ID) User: srsly fb? OK

Detecting if the embedded data is from a boarding pass is not difficult, nor is parsing it[0] and displaying it in a human-friendly format to "prove" that it's probably sensitive ("The boarding pass you posted belongs to John Smith and contains their American Airlines frequent flyer number. Are you sure you want to share this?") [0] https://www.iata.org/whatwedo/stb/Documents/BCBP-Implementat...

Could also very easily link to documents explaining why that could be bad for the user.