Hacker News Reader

Comment by IshKebab | Hacker News Reader

What can malicious people do with my passport number?

Create a fake passport to travel under your name and commit crimes. Try not to be surprised when you discover an arrest warrant in your name for sex trafficking in Belarus.

Not that one wants this sort of information to be leaked of course, but it's hard to see information that is routinely copied by hotel desk clerks and which is written down on countless forms is deeply sensitive information that will cause dire outcomes if it gets out.

You mean like your bank account number, which is constantly typed into online forms of all sorts of websites. Or your credit card number, which you probably say verbally into the phone to pay your bills?

Truth is, lots of extremely sensitive data exists in insecure states all the time.

For that matter, your bank account number goes on pieces of paper called checks that many of us give to individuals and companies all the time to pay bills.

So, yes, I draw a distinction between numbers that we hand out willy-nilly and truly sensitive information. There's a big difference between my checking account number and my health records.

>Create a fake passport to travel under your name and commit crimes. Try not to be surprised when you discover an arrest warrant in your name for sex trafficking in Belarus

This would only require a name, not a passport number. A passport number would simply be of no use here, there doesn't exist any¹ automated mechanism for Belarus to verify foreign passport numbers.

¹Well OK, with biometric passports it is possible to cryptographically verify some data.

Not really. Most passports contain NFC chips now. There's an NFC app for Android that can extract all your passport details from a UK passport, including your photo, and it's all digitally signed by the passport office.

Those exist but are rarely read except at the gates specifically for biometric passports. Nobody will question you for having a passport with a broken chip.

At least right now the NFC chips simply have no effect on passport forgeries.

You definitely can't create a passport just from a name and passport number.

Almost certainly nothing at all.

They're currently admitting to losing passport #s, but what else - like credit card info which they aren't supposed to keep in any case - might have been compromised?

Reply on news.ycombinator.com