Post a boarding pass on Facebook, get your account stolen • Hacker News Board

Re: Post a boarding pass on Facebook, get your account stolen

#41

Post by johannes1234321 » Sat, Sep 23, 2017, 9:47 AM UTC

csomar wrote: post #33

tinus_hn wrote: post #25

Earlier quoted context omitted.

The problem is not barcodes and it is not Facebook. The problem is airlines with security systems that went out of style in the 90’s. You don’t print a paper with all the information you need to hijack accounts. You don’t use ‘secret questions’. You don’t treat birthdays as secrets. You don’t use a number as a secret if it’s on the ticket.

I was traveling with a friend and we could benefit from changing flights. So my friend went to the counter to just ask about the possibility. He had my boarding pass but not my passport. He returned 20 minutes later with both boarding passes changed. The counter stuff just took his "word" for "he is my friend". Edit: An hour later driving and thinking about it, I think it is the right move from the airline. The risk…

The question is: What's the higher risk for the airline - that a bad person shows up in person, with a valid foreign boarding pass, to do some fraud with the risk of you coming to the counter shortly after or to have an unhappy customer if they resist (well yeah, airlines do much to avoid having happy customers ...)

The risk of someone doing real harm there is quite low ...

Re: Post a boarding pass on Facebook, get your account stolen

#42

Post by cyberferret » Sat, Sep 23, 2017, 9:55 AM UTC

I wonder just how much of the barcode should be obscured to render it unscannable? Is it enough to cover the check digit? (If indeed that symbology has a check digit verification). e.g. With QR Codes, is 25% obscuration enough, etc.?

Re: Post a boarding pass on Facebook, get your account stolen

#43

Post by mrhappyunhappy » Sat, Sep 23, 2017, 9:57 AM UTC

tinus_hn wrote: post #25

fredley wrote: post #6

It's amazing that with the algorithmic power Facebook brings to bear on every photo you upload, finding faces etc., that they can't spare a few cycles for security. It would be simple to run barcode detection over any post and blur the result (maybe prompt the user just in case they actually wanted to post one?). Almost any barcode is assumed to be private information, even a barcode on a store receipt can be used fo…

The problem is not barcodes and it is not Facebook. The problem is airlines with security systems that went out of style in the 90’s. You don’t print a paper with all the information you need to hijack accounts. You don’t use ‘secret questions’. You don’t treat birthdays as secrets. You don’t use a number as a secret if it’s on the ticket.

You are correct sir.

Re: Post a boarding pass on Facebook, get your account stolen

#44

Post by mrhappyunhappy » Sat, Sep 23, 2017, 9:59 AM UTC

kossae wrote: post #35

csomar wrote: post #33

Earlier quoted context omitted.

I was traveling with a friend and we could benefit from changing flights. So my friend went to the counter to just ask about the possibility. He had my boarding pass but not my passport. He returned 20 minutes later with both boarding passes changed. The counter stuff just took his "word" for "he is my friend". Edit: An hour later driving and thinking about it, I think it is the right move from the airline. The risk…

This is the case I've seen the most. It also really speaks to what is the ultimate security hole which is human error and social engineering. Granted your friend was not being malicious, the fact that it was that easy is scary.

Exactly. I lost count how many times I was able to sweet talk my way past regular phone security measures while trying to access my own account after having forgotten security details. Now imagine I was a bad actor trying to get someone else's info.

Re: Post a boarding pass on Facebook, get your account stolen

#45

Post by grogenaut » Sat, Sep 23, 2017, 10:01 AM UTC

csomar wrote: post #33

tinus_hn wrote: post #25

Earlier quoted context omitted.

The problem is not barcodes and it is not Facebook. The problem is airlines with security systems that went out of style in the 90’s. You don’t print a paper with all the information you need to hijack accounts. You don’t use ‘secret questions’. You don’t treat birthdays as secrets. You don’t use a number as a secret if it’s on the ticket.

I was traveling with a friend and we could benefit from changing flights. So my friend went to the counter to just ask about the possibility. He had my boarding pass but not my passport. He returned 20 minutes later with both boarding passes changed. The counter stuff just took his "word" for "he is my friend". Edit: An hour later driving and thinking about it, I think it is the right move from the airline. The risk…

So what's going to happen is that 2 of the same person show up to the plane... and the copy cat goes on the plane and then you check in, and they say, nope, not you. And then you pull your passport. And then they go get the other person off the plane.

Re: Post a boarding pass on Facebook, get your account stolen

#46

Post by llukas » Sat, Sep 23, 2017, 10:01 AM UTC

dredmorbius wrote: post #26

raverbashing wrote: post #19

Earlier quoted context omitted.

Yes, I try to make the fake answer sound legitimate though City you were born? Just pick any (random/unrelated) city instead of 2DXSDGREDV@#! It's easier if you have to go through a person (which is usually forced to go through a script) also easier on the phone

The search space for city names is tragically finite. There are ~35,000 cities and towns in the U.S., but if you start weighting those by populating (and birthing hospitals and centres), you're going to reduce that count considerably. https://www.reference.com/geography/many-cities-united-state...

Why pick name of U.S. city or more general city in country you live/are related to?

There are a lot of lovely and easy to remember names in other countries ;)

Re: Post a boarding pass on Facebook, get your account stolen

#47

Post by Deestan » Sat, Sep 23, 2017, 10:06 AM UTC

noobermin wrote: post #10

I get it, be aware of what you post on facebook, but does this not rub anyone else the wrong way? Imagine you break into your friend's car, and rewrire the stereo system so the left speaker doesn't work. Then, you say, "yo, I broke into your car and rewired things. The locks on this car are faulty, better let the car manufacturer know. I should contact them myself and collect my bug bounty." And when your friend, a d…

> Imagine you break into your friend's car

Bad comparison. Breaking into a car is a locally constrained high-risk attack vector.

This is a low-risk unconstrained attack vector. A bored person anywhere in the world could fuck their shit up with no risk or consequence.

Re: Post a boarding pass on Facebook, get your account stolen

#48

Post by oblio » Sat, Sep 23, 2017, 10:10 AM UTC

jacquesm wrote: post #28

oblio wrote: post #27

Earlier quoted context omitted.

If something is a security issue for 99% of users, the 1% will have to just accept it. Case in point: app sandboxing. I, for one, don't want it, but it's everywhere.

What if it turns out to be 70/30 or 50/50? Stuff like this should be configurable or over-ridable, especially when it has legitimate uses. There will always be a balancing act between features, security and usability, to ram the needle one way and to say 'tough luck' to everybody else is not a solution because then people will try to find ways around the block.

They should make it opt-out.

Re: Post a boarding pass on Facebook, get your account stolen

#49

Post by noir_lord » Sat, Sep 23, 2017, 10:11 AM UTC

jacquesm wrote: post #28

oblio wrote: post #27

Earlier quoted context omitted.

If something is a security issue for 99% of users, the 1% will have to just accept it. Case in point: app sandboxing. I, for one, don't want it, but it's everywhere.

What if it turns out to be 70/30 or 50/50? Stuff like this should be configurable or over-ridable, especially when it has legitimate uses. There will always be a balancing act between features, security and usability, to ram the needle one way and to say 'tough luck' to everybody else is not a solution because then people will try to find ways around the block.

As a programmer the problem with feature toggles is this, lets say we have 1 feature toggle with on been 1 and off been 0.

For one feature that means we have

    1,0 states (two states).

For two features we have

    1,0/1,0 (four states).

By the time you get to 10 feature toggles you have

    1111111111 (1024 possible states).

In case I wasn't clear hammering home this obvious (to us but sadly not managers usually) point, feature flags are binary and when you have 16 of them you have 65536 possible states.

Now as a programmer that frightens me because the possible paths through the system has become incredibly large for us to handle and it's a UX/UI disaster unless handled very carefully, you end up with features that interact with other features (set a do not back up flag on a file, then a different flag for always back up all files) in unpredictable ways for us and for users.

You see this complexity in things like hierarchical role based permission systems and the like.

Not sure what the solution is but I can understand why programmers and users push back on adding features (not least because as a programmer I know that doubling the complexity for 1-5% of users just seems like a poor trade off in general - there are of course specific cases where it makes sense like the 5% of users is roughly the percentage who are paying for your product etc.).

Re: Post a boarding pass on Facebook, get your account stolen

#50

Post by KGIII » Sat, Sep 23, 2017, 10:13 AM UTC

I am not a lawyer, but I think most of the author's actions would be considered illegal in the US. While he didn't do any harm, his actions were still probably a violation of at least the CFAA.

Anyhow, Aztec code? It looks, the one on the watch, pretty much like a QR Code. I've never seen the Aztec code before today. It makes me wonder how many of these barcode things we really need. A quick Google didn't reveal any information demonstrating why this Aztec code is any better than the other options out there.

It does make me grateful that I don't have to work on implementing all these things or, really, even deal with them. I know a bunch of you are developers and I hope you're not the ones stuck with dealing with all these different 'standards,'