4 ms·

You'd be surprised how many websites (medical, financial etc) are leaking data. e.g. in many all you need is just to replace your profile id with (id+1) and get

You'd be surprised how many websites (medical, financial etc) are leaking data. e.g. in many all you need is just to replace your profile id with (id+1) and get other user's data. Especially if website owner is located in non-EU or western countries there is basically zero responsibility for this, so no one even bothers to hire a dev that understands these basic security things. The cheaper the better. I've seen dozens of examples myself without even trying. Imagine what you can get if you spend more than 20 minutes on this.

jruohonen 3y ago
Sure. Throughout the world, especially hospitals and healthcare seem to be particularly bad at infosec. But regarding this case, I think something like passport data is (or should be) fairly well-protected, which prompts further questions about the hypothetical breaches. Of course, it could as well be an insider case or something similar. Another point is that Telegram was again involved.
- expertentipp 3y ago
  > I think something like passport data is (or should be) fairly well-protected It's sufficient if you're an EU citizen emigrating or traveling to another EU country. They ask you right and left for a passport, passport scan, over email, hard photocopy. You think you're "privacy conscious" and refuse to provide one? Well you're not getting an apartment, thanks bye. Hell, many HOTELS (encountered at least in Spain, Croatia, Malta) make a SCAN OF PASSPORT. Now for leaking hundreds of passport scans all you need is one bored, ill-treated, poorly paid reception worker.
- popcalc 3y ago
  >I think something like passport data is (or should be) fairly well-protected It's astonishing how many times I've had to send scans of my passports to formations agents and banks (non-US) as email attachments in recent years. I always had on my mind how much damage could be done with a simple MX record cache poisoning.

jruohonen 3y ago

Sure. Throughout the world, especially hospitals and healthcare seem to be particularly bad at infosec. But regarding this case, I think something like passport data is (or should be) fairly well-protected, which prompts further questions about the hypothetical breaches. Of course, it could as well be an insider case or something similar. Another point is that Telegram was again involved.

expertentipp 3y ago
> I think something like passport data is (or should be) fairly well-protected It's sufficient if you're an EU citizen emigrating or traveling to another EU country. They ask you right and left for a passport, passport scan, over email, hard photocopy. You think you're "privacy conscious" and refuse to provide one? Well you're not getting an apartment, thanks bye. Hell, many HOTELS (encountered at least in Spain, Croatia, Malta) make a SCAN OF PASSPORT. Now for leaking hundreds of passport scans all you need is one bored, ill-treated, poorly paid reception worker.
popcalc 3y ago
>I think something like passport data is (or should be) fairly well-protected It's astonishing how many times I've had to send scans of my passports to formations agents and banks (non-US) as email attachments in recent years. I always had on my mind how much damage could be done with a simple MX record cache poisoning.