Hacker News Reader

Comment by shmoobadge | Hacker News Reader

Much as passports are very important for proving identity etc, people who travel have had their passport scanned, photographed or photocopied by pretty much every hotel they've stayed in. I'm not sure the shoebox in the backroom in Koh Samui with the photocopies in constitutes good storage hygiene protocols.

How that doesn't turn into rampant identity theft I don't know, or maybe it does? Not, happily, for me... yet.

View on HN

the whole "not being an automatable remote sql injection away from everything" quality of physical objects grants a filing cabinet a tremendous amount of inherent security compared to anything digital.

Much like that old quip about the bandwidth of a vehicle full of tapes: "Never underestimate the at-rest security of a room full of filing cabinets."

Friction and delay have always been aspects of security.

Not sure if they're still doing this, but as of a few years ago, the IRS was still using literal trucks full of tapes to transport data to backup facilities. Tapes are good for this because they don't degrade as quickly as hard drives, so if you're actually looking to do archival storage that will outlast the cloud provider of the decade, they are surprisingly practical.

Does tape still burn really easily?

Or has that been fixed?

Compared to what what option, clay tablets of cuneiform? :p

In terms of significant danger, perhaps you're thinking of nitrocellulose movie film that was phased out in the '50s.

Working with tape storage was part of my high school education. So was mainframe job scheduling...

Europe is as much ahead as it is behind.

As long as the janitors aren't using electric floor buffers, like NASA used to do, the tapes will last forever. However NASA ended up losing the data (from 1960s space missions) on the bottom 2 rows of tapes. It took a couple decades though.

Example of those mag tapes: https://www.computerhistory.org/revolution/memory-storage/8/...

How they were stored: https://www.hewlettpackardhistory.com/item/an-attractive-sol...

The newer stuff is a heck of a lot better than the olden stuff.

It depends on the stakes?

In the 90s, the French IRS seized massive amounts of files from Elf, then a major French oil company under investigation for various frauds.

Their offices where burglarized maybe a couple nights after that. All that was seized disappeared.

Nothing says “we’re watching you” like the wifi password at the hotel I stayed at in Shanghai being my passport number.

Stealing a shoebox of photocopied passports from every hotel in the city sounds like way more work and way riskier than downloading an already aggregated trove of digital data.

Ok, how about the google photos archive from the hotel next door with 1000s of pictures of passports taken on the shared unlocked $100 android phone that sits on the front desk? Not millions I grant you, but again, there doesn't seem to be an issue with active exploitation of these.

There is an issue with active exploitation of passports, of course the scale can change. Due to banking KYC / other KYC laws there's a market for these copied identities and of course so criminals don't even get a speedbump by KYC whereas the boot is used up the ass of the normal person trying to pass KYC when they're missing some stupid document like proof of address.

> the boot is used up the ass of the normal person trying to pass KYC when they're missing some stupid document like proof of address.

We are not there yet, Sir. First you must provide inheritance document showing the amount inherited and deed of purchase and sale of real estate. This is the law.

Yeah, that should be criminalised.

I never have seen it happen thought, usually hotels dont even copy the passport, they just make you fill a form and then check your passport to see if that's correct. Taking a photocopy is already next level.

Is it a region specific thing? Where did you see hotels like that?

I had my identity stolen this way before.

Since then, I do not allow the scans anymore. It is a dreadful feeling showing up to a hotel not knowing if you'll get turned away at the last minute because you take a stand for your privacy. So far, none have been willing to lose the bookings, but I know sooner or later my luck will run out and I'll have to find last minute accomodations.

I am working on hotel software. And we are doing an automated kiosk check in with identity scanning. I’m seriously stressed about holding on to this kind of toxic waste. I am trying to limit it as much as possible. For example throwing away scans as fast as possible (within regulatory allowances). But I would love to hear any ideas anyone has in terms of further security. Obviously the documents are not just on a public bucket. But I’m considering maybe encrypting each document with a separate key, or something along those lines.

Encrypt the data with an asymmetric key; and keep the decryption key somewhere offline. You can get a hardware token to store the key on (I think a yubikey can do this).

My guess is that the machine readable chip standards and the production quality required to replicate a physical passport are high enough that only the most organized of organized crime can fake the highest value passports effectively, and if a passport is easy to replicate, it is less likely to have visa free access to most countries.

To second the photographed/photocopied requirements, as an expat, I am frequently asked to send a scan of my passport to people or entities that are not necessarily the most secure.

I also have a couple of important documents that are literally PDFs. My Canadian citizenship certificate is a PDF with a barcode in it, that I can print off a copy of if I need to mail it, or show on my phone to a consular office or a border guard if needed. My work visa here in New Zealand is a PDF with my passport number and a visa number, which my workplace and bank checked with an online database. Fundamentally, these and my passport are pointers to a row in various databases.

AFAIK not all NFC-enabled passports support Active Authentication. E.g least before US passports did not support it so cloning them is as easy as reading them via NFC.

So you cant fake non-existing passport because of issuer signature, but cloning is not a rocket science for many countries passports.

Nowadays, for US passports (I don't know about other countries), the number/key needed to let the chip talk to you is printed on the photo page, so the older way of reading the NFC from afar won't work without that number.

Yes for other countries, it’s a standards thing not something unique to the US!

This has nothing to do with ability to clone the passport. E.g anyone who held your passport for 10 seconds can still create clone with exactly the samw data on NFC chip.

Active Authentication is when NFC chip itself hold cross-signed signing key thar is not exportable so its possible to confirm passport wasnt cloned.

It's far worse than that. In a lot of cases when you pay on booking.com, they don't charge your card. Instead, they send all your information (including CVV) along to the hotel where they can charge you how they want. A hotel I visited in Austria, had my card details printed out on a piece of A4 paper.

At smaller hotels or hostels I've had the staff take photos of ID with their own personal devices.

Nothing starts better a stay at a new place, than (most likely) illegal immigrant working (most likely) illegally at the reception of a grubby hotel or hostel taking photo of my passport with their private smartphone. Then I really fell that everything will go well and that I'm safe.

Same. Many times. This cat is out of the bag.

that shoebox would prob be thrown or burnt at some point tho, rather than being accessed by savvy hackers from across the globe.

> people who travel have had their passport scanned, photographed or photocopied by pretty much every hotel they've stayed in.

This. I hate it. People expect you to send your documents on messaging apps and god only knows where they end up. Unfortunately, I fear there's nothing we can do to stop this as govs enforce this kind of operations.

Reply on news.ycombinator.com