Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Database containing personal info of 106M visitors to Thailand exposed online

comparitech.com

Post reply on HN
Print view View original

31–40 of 50 posts

Re: Database containing personal info of 106M visitors to Thailand exposed online

#31

Post by weird-eye-issue »

bpoyner wrote: post #27
weird-eye-issue wrote: post #9

Earlier quoted context omitted.

No, why would it be? I've provided it to hotel staff, Airbnb hosts, condo security, car rental places, airline staff, and more over the years. They all make copies of it digitally and physically so it's floating around out there in lots of places. Next time I get a passport it will change anyways so I'm not sure I see the big deal even if it was a unique, never changing number.

15 years ago a foreigner couldn't even get a hotel room in Thailand without handing over passport information for each guest. I can't imagine it's changed much since then. If the Thai police want to track you down it wouldn't be very hard.

I checked into two hotels this past week while getting out of the city without giving any info. My Thai gf booked and paid for them so I'm not sure if that had anything to do with it. A couple years ago I had to give my passport to all hotels that I can remember

Re: Database containing personal info of 106M visitors to Thailand exposed online

#32

Post by barbazoo »

blunte wrote: post #24
zachberger wrote: post #5

Earlier quoted context omitted.

Name -> passport # isn't concerning?

If you travel much, or nowadays if you register on just about any legitimate cryptocurrency exchange, you've already shared this information - and usually with a photo. And with the new COVID stuff/vaccinations, it's being shared more often even if you don't travel.

> And with the new COVID stuff/vaccinations, it's being shared more often even if you don't travel.

What does that have to do with anything? How is your passport information shared any more than before because of "COVID stuff/vaccinations"?

Re: Database containing personal info of 106M visitors to Thailand exposed online

#33

Post by vmception »

marcus_holmes wrote: post #17
vmception wrote: post #13

Earlier quoted context omitted.

Identity fraud open bank accounts and launder money and lead a mile long paper trail to the wrong person

Are you sure you just need the number for that and not a copy of the actual document? Like gp says, I've handed my actual passport to every hotel I've stayed at, and they usually make a photocopy. If anyone is assuming that a photocopy of a passport is good evidence that someone is who they say they are, they're wrong. If someone is assuming that just the number proves anything, then they're more wrong. The times I'v…

What you are explaining to me is why you feel comfortable being able to prove your innocence if necessary. To that, good luck and it’s a pleasant way to view the world.

That has nothing to do with someone else leveraging gaps in the financial system and acknowledging those gaps exist. To that i would say AML/KYC/OFAC is the joke and should just be dropped since anyone can transfer any amount of value under someone else’s ID on a computer near where the compromised ID owner is expected to live.

There are open source tools to wear someone else’s face over webcam while holding up a doctored passport at 240p resolution. Even easier with a still image. And many places do not ask for more than just the ID itself.

I don’t really understand who the denial here is helping.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#34

Post by ericbarrett »

TekMol wrote: post #8

What dangers are associated with this type of data becoming public? I can imagine burglars using this info to decide which houses and apartments to rob. Anything else that comes to mind? Any first / second hand experiences of what can happen if private data like this becomes public?

I get spam emails all the time which claim to have webcam pics of the recipient in flagrante delicto, oh and here’s a Bitcoin address you should send to if you don’t want them public. Rubbish, of course, as there’s nothing targeted about them; just a cleverly-worded mass email disguised as an individual extortion attempt. The next obvious step, however, is sprinkling enough details in to make it more convincing. “I have pics of what you did in Thailand in January 2019” would surely generate a lot more concern in a subset of the recipients.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#35

Post by blunte »

barbazoo wrote: post #32
blunte wrote: post #24

Earlier quoted context omitted.

If you travel much, or nowadays if you register on just about any legitimate cryptocurrency exchange, you've already shared this information - and usually with a photo. And with the new COVID stuff/vaccinations, it's being shared more often even if you don't travel.

> And with the new COVID stuff/vaccinations, it's being shared more often even if you don't travel. What does that have to do with anything? How is your passport information shared any more than before because of "COVID stuff/vaccinations"?

Sorry, sometimes I forget my expat living abroad situation is uncommon. I guess that could be considered “very long term travel”.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#36

Post by marcus_holmes »

vmception wrote: post #33
marcus_holmes wrote: post #17

Earlier quoted context omitted.

Are you sure you just need the number for that and not a copy of the actual document? Like gp says, I've handed my actual passport to every hotel I've stayed at, and they usually make a photocopy. If anyone is assuming that a photocopy of a passport is good evidence that someone is who they say they are, they're wrong. If someone is assuming that just the number proves anything, then they're more wrong. The times I'v…

What you are explaining to me is why you feel comfortable being able to prove your innocence if necessary. To that, good luck and it’s a pleasant way to view the world. That has nothing to do with someone else leveraging gaps in the financial system and acknowledging those gaps exist. To that i would say AML/KYC/OFAC is the joke and should just be dropped since anyone can transfer any amount of value under someone el…

I was thinking about this more...

If I say my passport number is 134563543, how does anyone check that? Is there a database of passport numbers and identities that can be checked?

I get that the ID process of camera-and-passport can be spoofed, but in the context of this particular data breach, that's irrelevant. If I can dummy up a passport that looks good enough over 240p resolution then it doesn't matter if it's my actual number or whatever. The process I've been through checks for the watermark/sheen on the passport, but if you can dummy a face then you can dummy some glittery lights fine.

My original question stands: do you just need the passport number to prove identity? Because I've never had to provide just that as proof of identity.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#37

Post by tekstar »

ericbarrett wrote: post #34
TekMol wrote: post #8

What dangers are associated with this type of data becoming public? I can imagine burglars using this info to decide which houses and apartments to rob. Anything else that comes to mind? Any first / second hand experiences of what can happen if private data like this becomes public?

I get spam emails all the time which claim to have webcam pics of the recipient in flagrante delicto , oh and here’s a Bitcoin address you should send to if you don’t want them public. Rubbish, of course, as there’s nothing targeted about them; just a cleverly-worded mass email disguised as an individual extortion attempt. The next obvious step, however, is sprinkling enough details in to make it more convincing. “I…

When I get those I like to look up the bitcoin address on block explorer. Last time I checked one, two people had paid it out. No clue how many messages the spammer had sent, but there was at least a bit of payoff

Re: Database containing personal info of 106M visitors to Thailand exposed online

#38

Post by vmception »

marcus_holmes wrote: post #36
vmception wrote: post #33

Earlier quoted context omitted.

What you are explaining to me is why you feel comfortable being able to prove your innocence if necessary. To that, good luck and it’s a pleasant way to view the world. That has nothing to do with someone else leveraging gaps in the financial system and acknowledging those gaps exist. To that i would say AML/KYC/OFAC is the joke and should just be dropped since anyone can transfer any amount of value under someone el…

I was thinking about this more... If I say my passport number is 134563543, how does anyone check that? Is there a database of passport numbers and identities that can be checked? I get that the ID process of camera-and-passport can be spoofed, but in the context of this particular data breach, that's irrelevant. If I can dummy up a passport that looks good enough over 240p resolution then it doesn't matter if it's m…

The number has to corroborate whats on the picture of the passport.

Beyond what you asked though:

Most financial institutions are just covering their own ass and do not care. They just want the record in order to say they checked the box, and be able to look at that record when the government comes looking. Investigations rarely are high profile enough get stonewalled by a customer account that was fictional in order to ensnare the financial institution about how good/bad their KYC processes are. Money mule accounts are extremely prevalent, but this is limited to the actual person being tricked into using their own account for a ridiculous and shady purpose.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#39

Post by q-rews »

weird-eye-issue wrote: post #31
bpoyner wrote: post #27

Earlier quoted context omitted.

15 years ago a foreigner couldn't even get a hotel room in Thailand without handing over passport information for each guest. I can't imagine it's changed much since then. If the Thai police want to track you down it wouldn't be very hard.

I checked into two hotels this past week while getting out of the city without giving any info. My Thai gf booked and paid for them so I'm not sure if that had anything to do with it. A couple years ago I had to give my passport to all hotels that I can remember

By law the hotel has to register your arrival online, as a foreigner.

Obviously this is easily skirted by having another person do the check in and you arriving later. I've also stayed in some guest houses in Thailand last month and they did not register me, but that doesn't mean they should have done so.

If they don't, technically you're on the hook for not registering.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#40

Post by ericbarrett »

tekstar wrote: post #37
ericbarrett wrote: post #34

Earlier quoted context omitted.

I get spam emails all the time which claim to have webcam pics of the recipient in flagrante delicto , oh and here’s a Bitcoin address you should send to if you don’t want them public. Rubbish, of course, as there’s nothing targeted about them; just a cleverly-worded mass email disguised as an individual extortion attempt. The next obvious step, however, is sprinkling enough details in to make it more convincing. “I…

When I get those I like to look up the bitcoin address on block explorer. Last time I checked one, two people had paid it out. No clue how many messages the spammer had sent, but there was at least a bit of payoff

I haven’t looked in a while but I think every example, even though the text was identical, had a different address. So if the one you saw already had two transactions...
Post reply on HN