Post a boarding pass on Facebook, get your account stolen

Re:Post a boarding pass on Facebook, get your account stolen by sitkack on Saturday September 23, 2017 @09:13AM (#15319578)

> You're basically evaluating the cryptographic merits of CSV.

I am not. I am weighing features vs unintended harm. Yes, the airlines shouldn't be including this data in the barcodes. It is improper to expose end users to this liability. And simply telling them not to expose them isn't a solution.

But if FB can detect harmful barcodes in an image, by all means they should remove the photo.

This is no different than Github scanning for AWS creds or MongoDB passwords in repos.

[ Parent | on HN ]

Re:Post a boarding pass on Facebook, get your account stolen by always_good on Saturday September 23, 2017 @01:31PM (#15320749)

>This is no different than Github scanning for AWS creds or MongoDB passwords in repos.

But Github doesn't do that either.

Amazon pays a contractor to scan Github repos for keys.

[ Parent | on HN ]

Re:Post a boarding pass on Facebook, get your account stolen by FabHK on Saturday September 23, 2017 @04:22PM (#15321521)

Is there any data in the barcode that's not also printed (in plain text) on the boarding pass?

[ Parent | on HN ]

Re:Post a boarding pass on Facebook, get your account stolen by sitkack on Wednesday September 27, 2017 @09:53AM (#15347786)

There is, that is issue. DoB specifically which in the US is used (dumbly) as PII.

[ Parent | on HN ]