When you browse Instagram and find Tony Abbott's passport number • Hacker News Board

Re: When you browse Instagram and find Tony Abbott's passport number

#331

Post by Aeolun » Thu, Sep 17, 2020, 7:37 AM UTC

pathseeker wrote: post #284

underwater wrote: post #231

Earlier quoted context omitted.

The API key shouldn't change what type of data an API call returns. The developer should explicitly request data and that either succeeds or fails based on authorisation. Making assumptions about the use case from the key will of course lead to this kind of error.

This is pretty standard when fetching entire complex objects from many backends. You get the full object with all of the fields the authorization layer allows you to see. Something like "GET /reservation/ " would rarely require you to specified the 50 fields that you would like included in the response. Many offer fields to explicitly filter for specific things, but the default is almost always to return the full obj…

You shouldn’t arbitrarily include or exclude information. The response to a given input should always be the same output, and not depend on what API key you are calling with.

Re: When you browse Instagram and find Tony Abbott's passport number

#332

Post by [deleted] » Thu, Sep 17, 2020, 7:56 AM UTC

warent wrote: post #190

POiNTx wrote: post #20

Apart from the really interesting content, this is an extremely good read, strikes me as the right kind of balance of information and keeping you entertained. I really enjoyed this writing style!

Interesting, I liked the story but got the opposite impression you did. At first the humor was amusing but I felt like the relentless, extremely heavy sarcasm dripping off every sentence quickly turned it into a slog and even started to make me wonder which parts were genuine vs. joking. Not great.

[deleted]

Re: When you browse Instagram and find Tony Abbott's passport number

#333

Post by poutrathor » Thu, Sep 17, 2020, 9:18 AM UTC

giarc wrote: post #267

warent wrote: post #190

Earlier quoted context omitted.

Interesting, I liked the story but got the opposite impression you did. At first the humor was amusing but I felt like the relentless, extremely heavy sarcasm dripping off every sentence quickly turned it into a slog and even started to make me wonder which parts were genuine vs. joking. Not great.

I agree... when you listen to a great comedian, it's not 1 joke/sentence. This article was too much. I still read it all since the overall topic was entertaining but the attempt at humour was overkill.

Have you actually listen to nowadays comedians ? It _is_ one joke/sentence nowadays (at least in my country).

More exactly, they separate each sentence. Each has a tiny bit of funny in it (in the words, in the way they say it, because they stay in character, whatever) and they let audience lol. Rinse and repeat.

Look I just googled "up and coming standupers" and picked the first video (new laptop, not connected to Gaccount) https://www.youtube.com/watch?v=s6uW1odtjPc

Check the 36 first seconds.

Humour changed without you (us) realizing ¯\_(ツ)_/¯

Re: When you browse Instagram and find Tony Abbott's passport number

#334

Post by city41 » Thu, Sep 17, 2020, 9:29 AM UTC

vishnugupta wrote: post #104

I accidentally discovered a way to get hold of passport details of random people by applying for Visa on arrival to Vietnam. There are these online portals which do some document pre processing which is legit. And on landing in Vietnam we are expected to show that we have already applied for Visa. It so happens that these portals do batch processing. Which means my application is processed along with a half a dozen o…

I recently bought a used phone on ebay. When I turned it on it had the previous owner's data in tact and no passcode. I opened Gmail and was in their account.

I immediately factory reset the phone. My point being sensitive data leaks all over the place in many ways in today's world.

Re: When you browse Instagram and find Tony Abbott's passport number

#335

Post by mickotron » Thu, Sep 17, 2020, 9:33 AM UTC

lysp wrote: post #101

kccqzy wrote: post #26

Nice. Here's a similar personal story with a PSA that sometimes blurring is NOT sufficient. A friend of mine posted on Instagram a picture of a U.S. visa (or something similar; it was probably five years ago) to announce her trip to the U.S., and she took care to blur out sensitive information such as her passport number. But a Gaussian blur is easy to reverse and I successfully unblurred it and told her my discovery…

> I personally recommend blacking out (add a black rectangle) instead of blurring, and if it is a PDF, convert to an image afterwards because too many PDF editors use non-destructive operations to add a new object instead of changing what's underneath. We had a similar issue in Australia as well. Politicians phone bills are published on the government website in summary form. Someone in 2017 decided to blank out thei…

I used to work in IT for a state based police force in Australia. Traffic reports can be requested by those involved in traffic accidents, which includes parties to the accident and their details.

People used to be able to get the personal information of police officers if they were involved, intentionally or not, in a traffic accident with a police car. They would request for the traffic accident report, and that included the personal information (including home address) of the police officers in the car. I was in QA and I tested the change when it was fixed. It now includes the address of Police HQ when a police officer is involved in a traffic incident.

Re: When you browse Instagram and find Tony Abbott's passport number

#336

Post by saberdancer » Thu, Sep 17, 2020, 9:37 AM UTC

Aeolun wrote: post #331

pathseeker wrote: post #284

Earlier quoted context omitted.

This is pretty standard when fetching entire complex objects from many backends. You get the full object with all of the fields the authorization layer allows you to see. Something like "GET /reservation/ " would rarely require you to specified the 50 fields that you would like included in the response. Many offer fields to explicitly filter for specific things, but the default is almost always to return the full obj…

You shouldn’t arbitrarily include or exclude information. The response to a given input should always be the same output, and not depend on what API key you are calling with.

I agree. Using API key to determine what kind of information is returned is a strange solution. It would effectively mean that if the airline is developing an application that has multiple levels of users (airline employees, customers, admins) it would need to store and use multiple API keys to retrieve the data.

Ofcourse, real solution here is that the airline software should not just pass along everything it received from Amadeus but rather that they should convert it and return only the relevant subset. This would avoid these type of issues.

Re: When you browse Instagram and find Tony Abbott's passport number

#337

Post by saberdancer » Thu, Sep 17, 2020, 9:38 AM UTC

robjan wrote: post #160

saberdancer wrote: post #133

Earlier quoted context omitted.

Could you explain how returning all data to the frontend is connected with "god mode" usage? Is the Amadeus system such that it created/masks different fields in the data depending on the access level you have? In this case, "hacker" logged in a customer facing portal, this is probably not even an user account in the strict sense of the word. I am asking as I fail to see how it is not a development issue. If they ret…

There are of course two errors that the developer of the backend made. The first is not filtering what came back from the Amadeus API, but the second one - the one I am referring to - is using an Amadeus API key with too much access. Amadeus filters the booking record depending on the level of access that the user accessing it has (the user being the backend in this case). In a previous life for another airline, I ha…

OK, thank you for the explanation. I was not aware that Amadeus is some type of backend system that airline software integrates with.

Re: When you browse Instagram and find Tony Abbott's passport number

#338

Post by dTal » Thu, Sep 17, 2020, 1:21 PM UTC

arh68 wrote: post #197

tomerico wrote: post #95

I found his advice to Tony on how to get better with computers remarkably insightful: > I said there probably was a book out there about “the basics of IT”, but it wouldn’t help much. I didn’t learn from a book. 13 year old TikTok influencers don’t learn from a book. They just vibe. > My mum always said when I was growing up that: > There were “too many buttons” She was afraid to press the buttons, because she didn’t…

Yes! I call it cat-like thinking , after watching our cat walk all over the keyboard. She wouldn't look at the keys or the screen. I can't remember how many times I've heard "I can't log in, the machine is locked" , when there is literally 1 button Switch User, and clicking that 1 button does it. "Oh, I didn't think to try that, it said it was locked.." Entering newlines in a textbox? It's.. shift-enter, or alt-enter…

In fairness, the "Switch User" button is a terrible interface on many levels. Apart from the complete lack of feedback on the actual situation (an active desktop session), it conveys a muddled mental model in which someone who has logged out and walked away from the computer is still considered to be "The User". A better interface would simply have the normal login prompt, along with some information about any active desktop sessions. The computer is no more "locked" than it is on first boot.

Re: When you browse Instagram and find Tony Abbott's passport number

#339

Post by freeone3000 » Thu, Sep 17, 2020, 3:50 PM UTC

kortex wrote: post #256

Sysosmaster wrote: post #205

Earlier quoted context omitted.

The thing to remember here is that the only way to hide (real world) data in an image is to reduce the amount of data in the picture... a blur or swirl leaves most if not all data just in the picture (although distorted) Any filter that removes data (such as pixelate or blacking out / whiting out) can be used to safely hide this data... Just remember to also strip out any unwanted meta data (Exif-data) and do not use…

Pixelation is also attackable. Generate input (e.g. GAN) and apply pixelation until it converges. Probably won't be super accurate but enough to probably ID someone. Black/delete (and flatten/rebroadcast) is the only way.

I'd worry about hallucinations when applying a GAN to a pixellated image. You'll get out a face, but who's to say that it's the correct face? Lots of people look similar.

Re: When you browse Instagram and find Tony Abbott's passport number

#340

Post by jwong_ » Thu, Sep 17, 2020, 4:45 PM UTC

vishnugupta wrote: post #104

I accidentally discovered a way to get hold of passport details of random people by applying for Visa on arrival to Vietnam. There are these online portals which do some document pre processing which is legit. And on landing in Vietnam we are expected to show that we have already applied for Visa. It so happens that these portals do batch processing. Which means my application is processed along with a half a dozen o…

Foreign visitors to China staying in non-hotels are required to register at the local police station. The police in the city I visit use their personal cellphones to take pictures of your passport, use their personal WeChat accounts to send them who-knows-where, and then store them in paper form on the top of their desks. Anyone who walks in to register can see what kinds of foreigners are staying, where they're staying, their jobs, passport numbers, etc.