6 ms·

I visited Thailand about six times in the last four years so this is a bit concerning to me. I really wish there were more details and hope that I can find out

I visited Thailand about six times in the last four years so this is a bit concerning to me. I really wish there were more details and hope that I can find out if my data was exposed as a part of this.

vmception 5y ago
The database included full names, passport numbers, arrival dates, and more.
- weird-eye-issue 5y ago
  I'm literally in Thailand right now and really can't say this bothers me. None of that info is sensitive
  - zachberger 5y ago
    Name -> passport # isn't concerning?
    - cm2187 5y ago
      What can you do with a passport number?
      - vmception 5y ago
        Identity fraud open bank accounts and launder money and lead a mile long paper trail to the wrong person
        marcus_holmes 5y ago
        Are you sure you just need the number for that and not a copy of the actual document? Like gp says, I've handed my actual passport to every hotel I've stayed at, and they usually make a photocopy. If anyone is assuming that a photocopy of a passport is good evidence that someone is who they say they are, they're wrong. If someone is assuming that just the number proves anything, then they're more wrong. The times I've needed my passport online to prove my identity, it was usually one of those ID processes where I need to be in front of a camera holding my actual passport.
        vmception 5y ago
        Forge the document with the correct number. Click upload. You have way too much respect for the security and redundancies of the system. Only need one account anywhere to be approved. Then you can just do a completely clearnet illicit source transfer to a crypto exchange and disappear the money into tornado.cash or Monero or whatever. The problem stays with the person whose name is on the account. Alternatively, on Dread, people brag about maintaining funded brokerage accounts opened under other people’s names and accessed over compromised windows machines near where the physical person lives. They trading stocks and options with dollars, with the intent to deal with actual laundering later with a larger amount. There are market places for compromised windows machines by postal code and bandwidth.
        ourmandave 5y ago
        In the Ocean's Fourteen script writer's room: "Wait, what?"
        vmception 5y ago
        What you are explaining to me is why you feel comfortable being able to prove your innocence if necessary. To that, good luck and it’s a pleasant way to view the world. That has nothing to do with someone else leveraging gaps in the financial system and acknowledging those gaps exist. To that i would say AML/KYC/OFAC is the joke and should just be dropped since anyone can transfer any amount of value under someone else’s ID on a computer near where the compromised ID owner is expected to live. There are open source tools to wear someone else’s face over webcam while holding up a doctored passport at 240p resolution. Even easier with a still image. And many places do not ask for more than just the ID itself. I don’t really understand who the denial here is helping.
        marcus_holmes 5y ago
        I was thinking about this more... If I say my passport number is 134563543, how does anyone check that? Is there a database of passport numbers and identities that can be checked? I get that the ID process of camera-and-passport can be spoofed, but in the context of this particular data breach, that's irrelevant. If I can dummy up a passport that looks good enough over 240p resolution then it doesn't matter if it's my actual number or whatever. The process I've been through checks for the watermark/sheen on the passport, but if you can dummy a face then you can dummy some glittery lights fine. My original question stands: do you just need the passport number to prove identity? Because I've never had to provide just that as proof of identity.
      - deadalus 5y ago
        Some crypto websites accept Passport as a means to verify you before you can withdraw funds.
        smorgusofborg 5y ago
        A new passport number comes with each replacement/renewal so I would suspect this is just security theater and you can upload any sample passport with the text changed. If they are insisting on the same exact passport again they could accept a fax of a random artwork and it would be more secure and just as permanent.
        blunte 5y ago
        Which ones? The ones I've used use passport (and often photo holding passport) to enable certain features or raise limits, but they're not used for withdrawl. 2FA and email verification is.
    - weird-eye-issue 5y ago
      No, why would it be? I've provided it to hotel staff, Airbnb hosts, condo security, car rental places, airline staff, and more over the years. They all make copies of it digitally and physically so it's floating around out there in lots of places. Next time I get a passport it will change anyways so I'm not sure I see the big deal even if it was a unique, never changing number.
      - bpoyner 5y ago
        15 years ago a foreigner couldn't even get a hotel room in Thailand without handing over passport information for each guest. I can't imagine it's changed much since then. If the Thai police want to track you down it wouldn't be very hard.
        iso1210 5y ago
        I can't think of a single country (other than my own, and maybe in the rest of the EU) where I've gone to a hotel and not had to give my passport and credit card. Passport is photocopied, credit card is checked. Passport number is like a US social security number, it's public information.
        fy20 5y ago
        I don't think I've ever not been asked for my passport (or some other form of government ID) when staying in hotels in the EU. Two weeks ago I stayed at a large chain and I was asked for passports of my whole family.
        iso1210 5y ago
        Been a while since I stayed in the EU, but I was in Brussels in October 2019 and stayed at an Aloft at the time of an EU summit. I distinctly remember remonstrating with the clerk about the embarrassment of my British passport when I handed it over.
        weird-eye-issue 5y ago
    - blunte 5y ago
      If you travel much, or nowadays if you register on just about any legitimate cryptocurrency exchange, you've already shared this information - and usually with a photo. And with the new COVID stuff/vaccinations, it's being shared more often even if you don't travel.
      - barbazoo 5y ago
        > And with the new COVID stuff/vaccinations, it's being shared more often even if you don't travel. What does that have to do with anything? How is your passport information shared any more than before because of "COVID stuff/vaccinations"?
        blunte 5y ago
        Sorry, sometimes I forget my expat living abroad situation is uncommon. I guess that could be considered “very long term travel”.
  - C19is20 5y ago
    Yet.
- zachberger 5y ago
  Yes, but it's been taken down. I can't query the dataset to see if I, personally, have been exposed.
  - freetanga 5y ago
    Tell me your passport number, names, DOB and I will look it up and let you know… /s

vmception 5y ago

The database included full names, passport numbers, arrival dates, and more.

weird-eye-issue 5y ago
I'm literally in Thailand right now and really can't say this bothers me. None of that info is sensitive
- zachberger 5y ago
  Name -> passport # isn't concerning?
  - cm2187 5y ago
    What can you do with a passport number?
    - vmception 5y ago
      Identity fraud open bank accounts and launder money and lead a mile long paper trail to the wrong person
      - marcus_holmes 5y ago
        Are you sure you just need the number for that and not a copy of the actual document? Like gp says, I've handed my actual passport to every hotel I've stayed at, and they usually make a photocopy. If anyone is assuming that a photocopy of a passport is good evidence that someone is who they say they are, they're wrong. If someone is assuming that just the number proves anything, then they're more wrong. The times I've needed my passport online to prove my identity, it was usually one of those ID processes where I need to be in front of a camera holding my actual passport.
        vmception 5y ago
        Forge the document with the correct number. Click upload. You have way too much respect for the security and redundancies of the system. Only need one account anywhere to be approved. Then you can just do a completely clearnet illicit source transfer to a crypto exchange and disappear the money into tornado.cash or Monero or whatever. The problem stays with the person whose name is on the account. Alternatively, on Dread, people brag about maintaining funded brokerage accounts opened under other people’s names and accessed over compromised windows machines near where the physical person lives. They trading stocks and options with dollars, with the intent to deal with actual laundering later with a larger amount. There are market places for compromised windows machines by postal code and bandwidth.
        ourmandave 5y ago
        In the Ocean's Fourteen script writer's room: "Wait, what?"
        vmception 5y ago
        What you are explaining to me is why you feel comfortable being able to prove your innocence if necessary. To that, good luck and it’s a pleasant way to view the world. That has nothing to do with someone else leveraging gaps in the financial system and acknowledging those gaps exist. To that i would say AML/KYC/OFAC is the joke and should just be dropped since anyone can transfer any amount of value under someone else’s ID on a computer near where the compromised ID owner is expected to live. There are open source tools to wear someone else’s face over webcam while holding up a doctored passport at 240p resolution. Even easier with a still image. And many places do not ask for more than just the ID itself. I don’t really understand who the denial here is helping.
        marcus_holmes 5y ago
        I was thinking about this more... If I say my passport number is 134563543, how does anyone check that? Is there a database of passport numbers and identities that can be checked? I get that the ID process of camera-and-passport can be spoofed, but in the context of this particular data breach, that's irrelevant. If I can dummy up a passport that looks good enough over 240p resolution then it doesn't matter if it's my actual number or whatever. The process I've been through checks for the watermark/sheen on the passport, but if you can dummy a face then you can dummy some glittery lights fine. My original question stands: do you just need the passport number to prove identity? Because I've never had to provide just that as proof of identity.
    - deadalus 5y ago
      Some crypto websites accept Passport as a means to verify you before you can withdraw funds.
      - smorgusofborg 5y ago
        A new passport number comes with each replacement/renewal so I would suspect this is just security theater and you can upload any sample passport with the text changed. If they are insisting on the same exact passport again they could accept a fax of a random artwork and it would be more secure and just as permanent.
      - blunte 5y ago
        Which ones? The ones I've used use passport (and often photo holding passport) to enable certain features or raise limits, but they're not used for withdrawl. 2FA and email verification is.
  - weird-eye-issue 5y ago
    No, why would it be? I've provided it to hotel staff, Airbnb hosts, condo security, car rental places, airline staff, and more over the years. They all make copies of it digitally and physically so it's floating around out there in lots of places. Next time I get a passport it will change anyways so I'm not sure I see the big deal even if it was a unique, never changing number.
    - bpoyner 5y ago
      15 years ago a foreigner couldn't even get a hotel room in Thailand without handing over passport information for each guest. I can't imagine it's changed much since then. If the Thai police want to track you down it wouldn't be very hard.
      - iso1210 5y ago
        I can't think of a single country (other than my own, and maybe in the rest of the EU) where I've gone to a hotel and not had to give my passport and credit card. Passport is photocopied, credit card is checked. Passport number is like a US social security number, it's public information.
        fy20 5y ago
        I don't think I've ever not been asked for my passport (or some other form of government ID) when staying in hotels in the EU. Two weeks ago I stayed at a large chain and I was asked for passports of my whole family.
        iso1210 5y ago
        Been a while since I stayed in the EU, but I was in Brussels in October 2019 and stayed at an Aloft at the time of an EU summit. I distinctly remember remonstrating with the clerk about the embarrassment of my British passport when I handed it over.
      - weird-eye-issue 5y ago
  - blunte 5y ago
    If you travel much, or nowadays if you register on just about any legitimate cryptocurrency exchange, you've already shared this information - and usually with a photo. And with the new COVID stuff/vaccinations, it's being shared more often even if you don't travel.
    - barbazoo 5y ago
      > And with the new COVID stuff/vaccinations, it's being shared more often even if you don't travel. What does that have to do with anything? How is your passport information shared any more than before because of "COVID stuff/vaccinations"?
      - blunte 5y ago
        Sorry, sometimes I forget my expat living abroad situation is uncommon. I guess that could be considered “very long term travel”.
- C19is20 5y ago
  Yet.
zachberger 5y ago
Yes, but it's been taken down. I can't query the dataset to see if I, personally, have been exposed.
- freetanga 5y ago
  Tell me your passport number, names, DOB and I will look it up and let you know… /s