3 ms·

> Hogg said no passwords were compromised in the breach and the company was contacting affected passengers to give them information on how to protect themselves

> Hogg said no passwords were compromised in the breach and the company was contacting affected passengers to give them information on how to protect themselves. Well that's good! My precious password that can be easily changed wasn't leaked! > Cathay in a statement said accessed data includes names of passengers, their nationalities, dates of birth, telephone numbers, email and physical addresses, passport numbers, identity card numbers and historical travel information. oh...

noobermin 8y ago
I hear you. One issue is that most people use similar passwords for all their services, which yes is problematic and a travesty but that's how it is. So getting someone's name and personal information (that yes, can also be used for identity theft) is not as bad as now having a list of names and passwords to try to use on bank websites, for example.
- nicolas_t 8y ago
  Passport number + date of birth and name is enough for a social engineering attack against a lot of banks (hopefully they didn't like my credit card BIN to make it extra helpful to identify my bank). So my passport number leaking is personally much worse for me than if my password leaked (which I'm very careful to protect).
  - jfaat 8y ago
    Do a lot of banks have access to your passport number and use that as identifying info or is there another leg like passport -> ssn -> bank?
    - culturestate 8y ago
      If you live (and are opening a bank account) in a country other than your own, your passport is one of the only ways to prove your identity for KYC. I had to show both my HKID and my passport to get an account at HSBC, and I can use either of them as ID at the teller window.
      - tacostakohashi 8y ago
        Sure, although in that case it's having a passport in your possession that serves as ID, as distinct from merely knowing the number. I suspect you might find that a different passport with a different number, expiry date, or even nationality but the same name and date of birth would work equally well.
        culturestate 8y ago
        > I suspect you might find that a different passport with a different number, expiry date, or even nationality but the same name and date of birth would work equally well Nope. All of the information must match, and they even (excruciatingly) compare the signature in my passport to the one they have on file. At another bank where I used only my HKID to open the account, I'm not permitted to use my passport.
        nicolas_t 8y ago
        Banks and signatures in HK, that's a true love story in itself. I've never seen banks that are so obsessed with signatures and will reject documents because the signature doesn't exactly match the one they have on file... Which means you need to have a photo of any signature you register with a bank there or later on forms you sign will be rejected.
    - nicolas_t 8y ago
      As a foreigner living in South East Asia, in my experience asking for a passport number + date of birth + trivial questions (do you have a mortgage? Do you have a loan?, etc...) is used to prove your identity over the phone. The questions are easily bruteforced through so I'd say it's a real issue. I'm deeply concerned by that leak because of that. And I find it more concerning than BA leaking my financial details without my passport number (which also recently happened and led me to cancel one of my credit card)
- hrktb 8y ago
  At this point it can be virtually the same, or worse though. To expand on the identity theft part, all the leaked info are enough to open an online low tier bank account (one might need to forge random images to prove identify and residency, but that’s super basic photoshopping, as it only needs to be scan quality). In particular the passport informations makes it a ton easier. From there we move from simple identity theft, to possessing a bank account under the name of the victim, which opens the door to so many money schemes (no service will double check when asked to change bank info to another account with the same owner)

noobermin 8y ago

I hear you. One issue is that most people use similar passwords for all their services, which yes is problematic and a travesty but that's how it is. So getting someone's name and personal information (that yes, can also be used for identity theft) is not as bad as now having a list of names and passwords to try to use on bank websites, for example.

nicolas_t 8y ago
Passport number + date of birth and name is enough for a social engineering attack against a lot of banks (hopefully they didn't like my credit card BIN to make it extra helpful to identify my bank). So my passport number leaking is personally much worse for me than if my password leaked (which I'm very careful to protect).
- jfaat 8y ago
  Do a lot of banks have access to your passport number and use that as identifying info or is there another leg like passport -> ssn -> bank?
  - culturestate 8y ago
    If you live (and are opening a bank account) in a country other than your own, your passport is one of the only ways to prove your identity for KYC. I had to show both my HKID and my passport to get an account at HSBC, and I can use either of them as ID at the teller window.
    - tacostakohashi 8y ago
      Sure, although in that case it's having a passport in your possession that serves as ID, as distinct from merely knowing the number. I suspect you might find that a different passport with a different number, expiry date, or even nationality but the same name and date of birth would work equally well.
      - culturestate 8y ago
        > I suspect you might find that a different passport with a different number, expiry date, or even nationality but the same name and date of birth would work equally well Nope. All of the information must match, and they even (excruciatingly) compare the signature in my passport to the one they have on file. At another bank where I used only my HKID to open the account, I'm not permitted to use my passport.
        nicolas_t 8y ago
        Banks and signatures in HK, that's a true love story in itself. I've never seen banks that are so obsessed with signatures and will reject documents because the signature doesn't exactly match the one they have on file... Which means you need to have a photo of any signature you register with a bank there or later on forms you sign will be rejected.
  - nicolas_t 8y ago
    As a foreigner living in South East Asia, in my experience asking for a passport number + date of birth + trivial questions (do you have a mortgage? Do you have a loan?, etc...) is used to prove your identity over the phone. The questions are easily bruteforced through so I'd say it's a real issue. I'm deeply concerned by that leak because of that. And I find it more concerning than BA leaking my financial details without my passport number (which also recently happened and led me to cancel one of my credit card)
hrktb 8y ago
At this point it can be virtually the same, or worse though. To expand on the identity theft part, all the leaked info are enough to open an online low tier bank account (one might need to forge random images to prove identify and residency, but that’s super basic photoshopping, as it only needs to be scan quality). In particular the passport informations makes it a ton easier. From there we move from simple identity theft, to possessing a bank account under the name of the victim, which opens the door to so many money schemes (no service will double check when asked to change bank info to another account with the same owner)