Live data from Hacker News

Database containing personal info of 106M visitors to Thailand exposed online

comparitech.com

41–50 of 50 posts

Re: Database containing personal info of 106M visitors to Thailand exposed online

#41
post #37

Earlier quoted context omitted.

I get spam emails all the time which claim to have webcam pics of the recipient in flagrante delicto , oh and here’s a Bitcoin address you should send to if you don’t want them public. Rubbish, of course, as there’s nothing targeted about them; just a cleverly-worded mass email disguised as an individual extortion attempt. The next obvious step, however, is sprinkling enough details in to make it more convincing. “I…

When I get those I like to look up the bitcoin address on block explorer. Last time I checked one, two people had paid it out. No clue how many messages the spammer had sent, but there was at least a bit of payoff

Same here. I noticed they in the early days of the scam there were very payments (cannot say obviously if all were talked to that scam).

Then it was mostly empty wallets with the occasional one or two transactions.

The early scammers made a lot of money.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#42
post #39

Earlier quoted context omitted.

I checked into two hotels this past week while getting out of the city without giving any info. My Thai gf booked and paid for them so I'm not sure if that had anything to do with it. A couple years ago I had to give my passport to all hotels that I can remember

By law the hotel has to register your arrival online, as a foreigner. Obviously this is easily skirted by having another person do the check in and you arriving later. I've also stayed in some guest houses in Thailand last month and they did not register me, but that doesn't mean they should have done so. If they don't, technically you're on the hook for not registering.

I was present at check in, I didn't arrive later

Re: Database containing personal info of 106M visitors to Thailand exposed online

#43
post #30
post #27

Earlier quoted context omitted.

15 years ago a foreigner couldn't even get a hotel room in Thailand without handing over passport information for each guest. I can't imagine it's changed much since then. If the Thai police want to track you down it wouldn't be very hard.

I can't think of a single country (other than my own, and maybe in the rest of the EU) where I've gone to a hotel and not had to give my passport and credit card. Passport is photocopied, credit card is checked. Passport number is like a US social security number, it's public information.

I don't think I've ever not been asked for my passport (or some other form of government ID) when staying in hotels in the EU. Two weeks ago I stayed at a large chain and I was asked for passports of my whole family.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#44

Earlier quoted context omitted.

I was thinking about this more... If I say my passport number is 134563543, how does anyone check that? Is there a database of passport numbers and identities that can be checked? I get that the ID process of camera-and-passport can be spoofed, but in the context of this particular data breach, that's irrelevant. If I can dummy up a passport that looks good enough over 240p resolution then it doesn't matter if it's m…

The number has to corroborate whats on the picture of the passport. Beyond what you asked though: Most financial institutions are just covering their own ass and do not care. They just want the record in order to say they checked the box, and be able to look at that record when the government comes looking. Investigations rarely are high profile enough get stonewalled by a customer account that was fictional in order…

> The number has to corroborate whats on the picture of the passport.

Yeah, so knowing the passport number alone is useless.

And yeah, lots of the "security" around us is theatre and easily bypassed.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#45
post #43
post #30

Earlier quoted context omitted.

I can't think of a single country (other than my own, and maybe in the rest of the EU) where I've gone to a hotel and not had to give my passport and credit card. Passport is photocopied, credit card is checked. Passport number is like a US social security number, it's public information.

I don't think I've ever not been asked for my passport (or some other form of government ID) when staying in hotels in the EU. Two weeks ago I stayed at a large chain and I was asked for passports of my whole family.

Been a while since I stayed in the EU, but I was in Brussels in October 2019 and stayed at an Aloft at the time of an EU summit. I distinctly remember remonstrating with the clerk about the embarrassment of my British passport when I handed it over.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#46

Earlier quoted context omitted.

The number has to corroborate whats on the picture of the passport. Beyond what you asked though: Most financial institutions are just covering their own ass and do not care. They just want the record in order to say they checked the box, and be able to look at that record when the government comes looking. Investigations rarely are high profile enough get stonewalled by a customer account that was fictional in order…

> The number has to corroborate whats on the picture of the passport. Yeah, so knowing the passport number alone is useless. And yeah, lots of the "security" around us is theatre and easily bypassed.

you superimpose it onto the picture of the passport, because you know the number.

that's like saying an exploit is useless because the pentester still has to privilege escalate. wrong forum to hold that opinion.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#47

Earlier quoted context omitted.

> The number has to corroborate whats on the picture of the passport. Yeah, so knowing the passport number alone is useless. And yeah, lots of the "security" around us is theatre and easily bypassed.

you superimpose it onto the picture of the passport, because you know the number. that's like saying an exploit is useless because the pentester still has to privilege escalate. wrong forum to hold that opinion.

You don't need to. If the verifier has no way of verifying that any given passport number is correct, or associated with the identity you're trying to steal, then you can make up any number you like. Like you said, the only thing they can do is verify that the number on the (faked) passport matches the number the fraudster typed in the form.

If anything, this breach improves security because now there is a list of passport numbers matched to identities that verifying companies can use to make sure that the passport number claimed by a potential imposter matches the number known for that identity (from this breach). Then you'd have to do what you said and alter the passport in some way to match the breach.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#48
post #23

I guess I'm in there too. But passports get copied and provided to so many institutions these days that I wouldn't even consider nationality and passport number as private. Now, if someone is traveling to Thailand to partake of some of the more controversial options, then I can see how this would be damaging. We should all do our best to maintain privacy, but at the same time we should understand that the concept of…

> we have less - and will have even less in the future - privacy than people did 10+ years ago

ok, but hunter-gatherers had only minimal privacy so we can adapt to a wide range of "privacies".

yes, it is true that the possibility of "increasingly impersonal threats from far away" has risen dramatically in recent history and it's not clear how well we will adapt to that.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#49
post #48
post #23

I guess I'm in there too. But passports get copied and provided to so many institutions these days that I wouldn't even consider nationality and passport number as private. Now, if someone is traveling to Thailand to partake of some of the more controversial options, then I can see how this would be damaging. We should all do our best to maintain privacy, but at the same time we should understand that the concept of…

> we have less - and will have even less in the future - privacy than people did 10+ years ago ok, but hunter-gatherers had only minimal privacy so we can adapt to a wide range of "privacies". yes, it is true that the possibility of "increasingly impersonal threats from far away" has risen dramatically in recent history and it's not clear how well we will adapt to that.

> hunter-gatherers had only minimal privacy

What's your definition of privacy?

Post reply on HN