News for hackers. Stuff that matters.

A comment on Post a boarding pass on Facebook, get your account stolen. Parent comment

Re:Post a boarding pass on Facebook, get your account stolen by mulmen on Saturday September 23, 2017 @04:54AM (#15318876)
Isn't embedding QR codes the reason they were created in the first place? It's an optical data format designed to be easy for computers to read.

You're basically evaluating the cryptographic merits of CSV.

[ Parent | on HN ]
Re:Post a boarding pass on Facebook, get your account stolen by sitkack on Saturday September 23, 2017 @09:13AM (#15319578)
> You're basically evaluating the cryptographic merits of CSV.

I am not. I am weighing features vs unintended harm. Yes, the airlines shouldn't be including this data in the barcodes. It is improper to expose end users to this liability. And simply telling them not to expose them isn't a solution.

But if FB can detect harmful barcodes in an image, by all means they should remove the photo.

This is no different than Github scanning for AWS creds or MongoDB passwords in repos.

[ Parent | on HN ]
Re:Post a boarding pass on Facebook, get your account stolen by always_good on Saturday September 23, 2017 @01:31PM (#15320749)
>This is no different than Github scanning for AWS creds or MongoDB passwords in repos.

But Github doesn't do that either.

Amazon pays a contractor to scan Github repos for keys.

[ Parent | on HN ]
Re:Post a boarding pass on Facebook, get your account stolen by FabHK on Saturday September 23, 2017 @04:22PM (#15321521)
Is there any data in the barcode that's not also printed (in plain text) on the boarding pass?
[ Parent | on HN ]
Re:Post a boarding pass on Facebook, get your account stolen by sitkack on Wednesday September 27, 2017 @09:53AM (#15347786)
There is, that is issue. DoB specifically which in the US is used (dumbly) as PII.
[ Parent | on HN ]
Re:Post a boarding pass on Facebook, get your account stolen by bogomipz on Saturday September 23, 2017 @07:14AM (#15319241)
Yes, they were meant for efficient consumption. The 'Q" is for quick.
[ Parent | on HN ]