[IP] more on Get a boarding pass, steal someone's identity
Begin forwarded message:
From: "Steven M. Bellovin" <smb@xxxxxxxxxxxxxxx>
Date: May 8, 2006 10:01:13 AM EDT
To: "Perry E. Metzger" <perry@xxxxxxxxxxxx>
Cc: cryptography@xxxxxxxxxxxx
Subject: Re: Get a boarding pass, steal someone's identity
On Sun, 07 May 2006 12:53:41 -0400, "Perry E. Metzger"
<perry@xxxxxxxxxxxx> wrote:
I got this pointer off of Paul Hoffman's blog. Basically, a reporter
uses information on a discarded boarding pass to find out far too much
about the person who threw it away....
http://www.guardian.co.uk/idcards/story/0,,1766266,00.html
The story may be exaggerated but it feels quite real. Certainly I've
found similar issues in the past.
These days, I shred practically anything with my name on it before
throwing it out. Perhaps I'm paranoid, but then again...
I read the article. What bothers me is the focus on CAPS II, Secure
Flight, and all the other US government-mandated initiatives. I saw
nothing in it that seemed in any way related to security. Every one of
those database entries could have been there -- and probably were
there --
for the convenience of airline passengers. In particular, I'm referring
to the ability to check in online and print your own boarding pass. For
business travelers who use only carry-on baggage, it's a *major*
timesaver. I've been on flights where I had to wait 45-60 minutes (or
more) just to get my boarding pass, independent of any security
screening.
Passport numbers? I've always had to present my passport when
checking in
for an international flight; the difference now is that I see what's
happening. (Yes, US immigration is fussier about passport and customs
inspections than most other countries I've visited -- but in my personal
experience, that dates back to 1971. It's also less fussy about
emigration -- I remember having to listen to fundamentalist religious
preaching from an Australian emigration officer some years ago.)
The real point here is carelessness with access controls. *That's* what
we have to fight. It's certainly better if databases don't exist; as I
said, I think that these exist because of customer demand, not
government
mandates.
--Steven M. Bellovin, http://www.cs.columbia.edu/~smb
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to
majordomo@xxxxxxxxxxxx
-------------------------------------
You are subscribed as roessler@xxxxxxxxxxxxxxxxxx
To manage your subscription, go to
http://v2.listbox.com/member/?listname=ip
Archives at: http://www.interesting-people.org/archives/interesting-people/