And this is also why I almost never give my real birth date when registering on websites (except on financial websites or websites where I'm legally obligated to) and I never ever give real answers to the security question..<p>My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager<p>Security questions weakens the security of an account, they are easily found information that people can just guess.
It's not just posting photos that can cause this kind of trouble. I get a lot of email intended for other Doug Webbs sent to my gmail account, with variations on the presence/location of periods, or CC'd with another gmail account that's the same but with numbers on the end. For a while I was getting boarding passes from a major airline for a Doug that was frequently flying up and down the US west coast. Those emails gave me the confirmation number, and a link directly to the page that would let me make changes to the reservation, with no security barrier at all.<p>Granted, this most likely was caused by that other Doug providing my email address to the airline, but the airline is at fault too for assuming that access to a given email address is proof of identity. That's a <i>very</i> common mistake, often made intentionally to provide a more "user-friendly" experience. Had I been malicious, I could have caused that other Doug a lot of un-friendly grief.<p>I was not able to see any contact information on the reservation, and I didn't have full access to his account. (I don't know if a "Forgot Password" request would have given me that, though it probably would have.) I contacted the airline customer support to tell them they had the wrong email address on the reservation and they should contact their customer through some other means if they could. I think I got a form-letter thank you and never heard from them again, but I did get a few more boarding passes for a while.<p>I also get a lot of online shopping order/shipment confirmations, and plenty of personal correspondence. I try to tell the senders to fix their address books, and when I get a CC with the real address I contact the other Dougs too, but most of the time there's no response. I've had to set up a filter that puts all email with TO addresses that aren't the one I use into an "Other Dougs" folder, which I treat like spam.
33c3 talk related to this topic: <a href="https://www.youtube.com/watch?v=n8WVo-YLyAg" rel="nofollow">https://www.youtube.com/watch?v=n8WVo-YLyAg</a> - "Where in the World Is Carmen Sandiego?"
Just to clarify in case someone assumes the same thing I did from the headline: it isn't the Facebook account that gets stolen, but the airline website account.
Recently saw a viral tweet with a picture of a political mailing posted on twitter with the address blacked out, but the USPS bar code (<a href="https://en.m.wikipedia.org/wiki/Intelligent_Mail_barcode" rel="nofollow">https://en.m.wikipedia.org/wiki/Intelligent_Mail_barcode</a>) showing (looks like a comb with broken teeth).<p>They obviously didn't know the barcode contained the precise house address of the recipient (presumably the user's home address). Anonymization is hard!
It's amazing that with the algorithmic power Facebook brings to bear on every photo you upload, finding faces etc., that they can't spare a few cycles for security.<p>It would be simple to run barcode detection over any post and blur the result (maybe prompt the user just in case they actually wanted to post one?).<p>Almost any barcode is assumed to be private information, even a barcode on a store receipt can be used for return fraud in certain circumstances.<p>Saying 'don't post barcodes online' is all well and good, but that message will never reach the general public.
Not the first time airlines have had poor security with boarding passes:<p><a href="https://medium.com/@da/need-a-last-minute-flight-45af88ec8df3" rel="nofollow">https://medium.com/@da/need-a-last-minute-flight-45af88ec8df...</a>
<a href="https://www.wired.com/2016/08/fake-boarding-pass-app-gets-hacker-fancy-airline-lounges/" rel="nofollow">https://www.wired.com/2016/08/fake-boarding-pass-app-gets-ha...</a>
<a href="https://puckinflight.wordpress.com/2012/10/19/security-flaws-in-the-tsa-pre-check-system-and-the-boarding-pass-check-system/" rel="nofollow">https://puckinflight.wordpress.com/2012/10/19/security-flaws...</a>
<a href="http://www.washingtonpost.com/national/experts-warn-about-security-flaws-in-airline-boarding-passes/2012/10/23/ed408c80-1d3c-11e2-b647-bb1668e64058_story.html" rel="nofollow">http://www.washingtonpost.com/national/experts-warn-about-se...</a><p>And what the OP article is basically copying: <a href="https://www.theverge.com/2017/1/10/14226034/instagram-boarding-pass-security-problem-bad-idea" rel="nofollow">https://www.theverge.com/2017/1/10/14226034/instagram-boardi...</a><p>I don't see this changing anytime soon (although there are some tests to move towards facial recognition).
Remind me of my ex-gf I had on my Facebook for a while. She liked to be show off, which I think nowadays is not that big of as deal. But she would literally invite crime to her house! On her public Facebook profile she didn't post her address, BUT she had bunch of photos: her with the Living Complex sign, her next to her doors (with apartment number on it), photos of her inside house with beautiful 85" TV and other equipment including expensive bikes, then finally her photo with the car showing license plate (revealing her state name).<p>I told her numerous times its not a good idea but she never listened! Then I told her publicly on her car photo that she should at least wipe out the plate number, which created a long trail of comments where basically all her friends thought I'm weird and creepy and why would I be warning her (perhaps I want to commit some crime??). No amount of explaining helped. Even telling cops will tell her the same thing got me bunch of her "friends" answering "you ain't a cop, bro". And then one fine Friday I saw her posting they leaving for another state to visit family. Boy it was a discovery when they come back Monday morning their house was cleaned out from every possible valuable belongings. And thieves must have came with a large enough truck to fit that 85" TV screen.<p>Not long after she removed me from her FB even though I never told her "told you so".<p>The bottom line is I don't believe people will learn not to give a clues online and I think in these days of age it should be an hour mandatory lesson at the school what NOT to post online.
Why do Facebook and Twitter and etc. permit posting of airline QR codes and credit card photos <i>without</i> a safety warning and an option to safely blur out the sensitive bits?
the risk digest: <a href="http://catless.ncl.ac.uk/Risks/" rel="nofollow">http://catless.ncl.ac.uk/Risks/</a> is also pretty cool resource for these kind of things :)
I don't know if it's the case elsewhere but starting 2019 all invoice payments in Switzerland will use mandatory QR codes. <a href="https://www.paymentstandards.ch/en/home/softwarepartner/qr-bill.html" rel="nofollow">https://www.paymentstandards.ch/en/home/softwarepartner/qr-b...</a>
That promises to be challenging too in terms of publication of sensitive data.
I get it, be aware of what you post on facebook, but does this not rub anyone else the wrong way?<p>Imagine you break into your friend's car, and rewrire the stereo system so the left speaker doesn't work. Then, you say, "yo, I broke into your car and rewired things. The locks on this car are faulty, better let the car manufacturer know. I should contact them myself and collect my bug bounty." And when your friend, a decent chap, thinks you're joking, and finds out you're not kidding, is his response supposed to be, <i>"Oh shit, you're right. You could have just [rewired my speaker system]. This is crazy."</i> or instead, would he no longer be your friend, and probably report you to the police?
I wonder just how much of the barcode should be obscured to render it unscannable? Is it enough to cover the check digit? (If indeed that symbology has a check digit verification). e.g. With QR Codes, is 25% obscuration enough, etc.?
Fun alternative: create a honeypot website that looks semi-legit and publish QR codes to social networks to analyze the traffic to those.<p>For big-name corps, do the same to catch IPs of script kiddos who don't know/bother to mask those.
Something I also do which guards against social engineering attacks is that I have a set of fake answers for common "secret questions". These exist nowhere but in my head. I figure it's a extra obfuscation step and could very well be a blocker if anyone <i>was</i> trying to get into any of my accounts.
do the barcodes in the authors examples, which they did not bother to fuzz and anonymize, do they also convey the details they did anonymize? I'm curious
To help increase security through action, whenever friends send me their flight details that include a PNR I logon to the airline website and book them a middle seat and special meal choice 'bland meal'. Just doing my part.
how about just don't post stuff like boarding pass online >.> don't need to share every detail on the PUBLIC INTERWEBZ. dm someone if u want to tell them. saves hastle of getting your shit stolen by some 12 year old. in holland we say 'voorkomen is beter dan genezen' -> to prevent is better than to cure. We all know these kind of weakeneses exist everywhere, yet we post our boarding pass on a public page on the internet... bit silly. you can say 'shit should be secure' but thats being said since the dawn of the interwebz and it never has been... so dont bank on it ever being secure is better than to assume it is and point fingers once you're a victim.
Do a thoroughly stupid thing, reap the consequences. Post publicly a bunch of private info, like your complete contact details, get your account (or more of your identity) stolen.<p>There is nothing surprising about that, nothing hard to understand.<p>What is hard is actually thinking about what you are doing. Maybe, well, showing off your sophisticated and aesthetically perfect password is not such a good idea due to other considerations.
The weakest link in infosec has fingers and thumbs that uses a device.<p>This is nothing short of yelling sensitive information through a megaphone. USERFAIL
>"I've known Petr Mára for few years now, he's a nice guy. He's a speaker, trainer, video blogger, and deploys iOS & macOS wherever possible."<p>Why are any of these facts relevant? He deploys macOS? What? What does this have to do with anything?<p>And then author makes the reference to his friend Petr a link to his personal website? Seriously?<p>Incidentally, Petr's webiste is really entertaining as there are no less than 5 pictures of him that take up the entire background. Clicking on the Petr link, is the most entertaining part of the article.
I am not a lawyer, but I think most of the author's actions would be considered illegal in the US. While he didn't do any harm, his actions were still probably a violation of at least the CFAA.<p>Anyhow, Aztec code? It looks, the one on the watch, pretty much like a QR Code. I've never seen the Aztec code before today. It makes me wonder how many of these barcode things we really need. A quick Google didn't reveal any information demonstrating why this Aztec code is any better than the other options out there.<p>It does make me grateful that I don't have to work on implementing all these things or, really, even deal with them. I know a bunch of you are developers and I hope you're not the ones stuck with dealing with all these different 'standards,'
>"When you want to brag about your final destination, be careful of what you post on Facebook and Instagram. Leave your boarding passes (and other barcodes) for yourself (and get a shredder)."<p>It's funny that for a piece intended to warn other's on identity security the author had no problem reproducing the the unredacted boarding pass picture in question, which incidentally also tells us that he is a member of the One World Club with Saphire status. They also go onto let us know their nationality and profession.<p>The author also has no problem publishing his friend's full name and linking to their personal website which features 5 large high resolution pictures available of his friend's face as well as well as detailing exactly which Apple certifications they posses.
The most notable information here is the dumpster diving at airports .. and what it can get you. Namely - people discarding their airline passes at airports. "Barcodes can also be found on “forgotten” boarding passes in aircraft or other locations." ... holy shit, I never thought about that ... wow.
Real deal - DEFCON part about this. The research is deep for sure. <a href="https://www.youtube.com/watch?v=qnq0UfOUTlM" rel="nofollow">https://www.youtube.com/watch?v=qnq0UfOUTlM</a>
post a boarding pass on facebook, get your account stolen?<p>there's an alternate title for this one.<p>post about commandeering accounts on your blog, get the CFAA thrown at you and go to jail.<p>this is anything but responsible.
>"Users often publish data that they don't know what they mean. Because at first sight, it's not possible to see what's the data, or what the data is for"<p>No its more like people are so obsessed with curating their "fabulous" lifestyle for social media that they don't care.<p>The boarding passes are a carefully arranged prop in that picture, intended to reinforce the fact to social media that "yes I lead a fabulous life."<p>If their intention had only been to communicate to others that they were going on vacation, an "On our way to ____" message would have sufficed.