7 ms·
Finding a former Australian prime minister’s passport number on Instagram (2020)
- Bilal_io 1y agoI believe this is the same story covered by Dark Diaries. Very interesting story. https://darknetdiaries.com/episode/84/ https://darknetdiaries.com/episode/84/
- deleted 1y ago[deleted]
- protocolture 1y agoI love this blog post. Its a classic.
- santoshalper 1y agoReally interesting, but the writing was so bad I had to bail out halfway through.
- causal 1y agoI enjoy the meandering style but it did become a little long because of the meandering, glad I skipped ahead instead of just closing tho
- deleted 1y ago[deleted]
- deleted 1y ago[deleted]
- tomhow 1y ago> I had to bail out halfway through Telling us you didn't read the article is exactly the kind of unsubstantive comment we don't want on HN. The comments thread is for people who did read the article and have something to say about the content. This kind of comment breaks the guidelines particularly these ones: Be kind. Don't be snarky. Converse curiously... Don't be curmudgeonly. Thoughtful criticism is fine, but please don't be rigidly or generically negative. Please don't fulminate. Please don't sneer.... Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith. Please don't post shallow dismissals, especially of other people's work. A good critical comment teaches us something. Please don't complain that a submission is inappropriate. If a story is spam or off-topic, flag it. Don't feed egregious comments by replying; flag them instead. If you flag, please don't also comment that you did. Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting. Please take a moment to remind yourself of the guidelines and make an effort to observe them in future. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- CAPSLOCKSSTUCK 1y agoWho asked?
- decimalenough 1y agotomhow is a HN moderator.
- deleted 1y ago[deleted]
- milesrout 1y ago[dead]
- Bjartr 1y agoI think it was all written for the thing it was trying to be. Which is a casual humorous take on the journey this person went through with a little tech education sprinkled in. Any more formal or sophisticated and it would've lost some of the casual humor and been less an interesting journey. But did so in a way much less aggravating than what qualifies for a food recipe these days.
- broodbucket 1y agoThe story is a lot more enjoyable in conference talk form than written form imo https://www.youtube.com/watch?v=lijyQ_HAysA https://www.youtube.com/watch?v=lijyQ_HAysA
- tomhow 1y agoPreviously: Finding a former Australian prime minister’s passport number on Instagram (2020) - https://news.ycombinator.com/item?id=34966909 https://news.ycombinator.com/item?id=34966909 - Feb 2023 (41 comments) When you browse Instagram and find Tony Abbott's passport number - https://news.ycombinator.com/item?id=24488224 https://news.ycombinator.com/item?id=24488224 - Sept 2020 (340 comments)
- coffeecoders 1y agoLove the humor. I am a fan of Alex's writing style!
- LorenDB 1y agoIt's a shame he apparently no longer blogs. His posts are gold.
- ViscountPenguin 1y agoThey/them based on their socials (and iirc, I think that's what they went by at Crikeycon) https://x.com/mangopdf https://x.com/mangopdf
- 4gotunameagain 1y ago[flagged]
- gschizas 1y ago> Born January 1, 1970 Lol. That's _so_ in character
- bawolff 1y agoHow sensitive is a passport number actually? At first glance it seems like it should be, but is it actually? I honestly don't know.
- selcuka 1y agoOnline systems sometimes use it as an indicator to prove your identity. When combined with other sensitive data it can be useful for an identity thief. Edit: The blog post also mentions this: https://mango.pdf.zone/finding-former-australian-prime-minister-tony-abbotts-passport-number-on-instagram/#why-is-it-bad-for-someone-else-to-have-your-passport-number https://mango.pdf.zone/finding-former-australian-prime-minis...
- moralestapia 1y agoCan you provide just one example of said systems?
- selcuka 1y agoSure: - https://www.myid.gov.au/verifying-your-id-in-myid#myid-Australianpassport https://www.myid.gov.au/verifying-your-id-in-myid#myid-Austr... - https://www.afp.gov.au/sites/default/files/PDF/NPC-100PointChecklist-18042019.pdf https://www.afp.gov.au/sites/default/files/PDF/NPC-100PointC... - https://www.equifax.com.au/personal/identity-verification-100-point-check https://www.equifax.com.au/personal/identity-verification-10... The blog post has more use case examples: https://mango.pdf.zone/finding-former-australian-prime-minister-tony-abbotts-passport-number-on-instagram/#why-is-it-bad-for-someone-else-to-have-your-passport-number https://mango.pdf.zone/finding-former-australian-prime-minis...
- throwaway422432 1y agoLook up Australia's 100 point proof of identity which is used by Gov and most corporate entities in Australia. A passport is a primary document (equivalent to a birth certificate) and gives you 60-70 points. It can't be used alone, but in conjunction with another id (forged or stolen) would allow for identify theft.
- ethan_smith 1y agoDespite being from 2020, this vulnerability persists in 2025 with many airlines still exposing sensitive data on boarding passes and luggage tags, making "don't post your boarding pass" still relevant security advice.
- gen6acd60af 1y ago>Despite being from 2020, this vulnerability persists in 2025 with many airlines still exposing What is the "vulnerability" by the "airlines" here?
- petesergeant 1y ago> Based on advice I got from two independent lawyers that was definitely not legal advice: I haven’t done a crime. I will trust his lawyers are right _for Australia only_ (although I have my doubts, and would love to see their reasoning), but in the UK this feels like a clear breach of the Computer Misuse Act[0], and I can't recommend enough that you don't do this. 0: https://www.legislation.gov.uk/ukpga/1990/18/section/1 https://www.legislation.gov.uk/ukpga/1990/18/section/1
- oytis 1y agoSame in Germany. Just accessing data you are not supposed to access is a crime, regardless of whether you used the data in any illegal ways.
- rybosome 1y agoEchoing this advice in the USA. Don’t fuck with this, the language in the laws is loose enough to prosecute almost anything security-related, even well-meaning efforts like this.
- rao-d 1y agoLove it
- moneywaters 1y agoAlso a security tip, mosaic like he used in the picture is not a safe way to hide sensitive data, especially the one that has movement like in the gif where he is scrolling down, the mosaic changes and gives more data to reconstruct original. The safe way is to fully black out, but be wary of not plain color almost opaque marker tools, it could look like black out but playing with contrast will still reveal the data.
- blitzar 1y agoAlso a security tip, don't publicly post inane and pointless things to the internet, no matter how humbly you want to brag about being on an airplane.
- jampa 1y agoReading the "Why is it bad for someone else to have your passport number?" is scary, especially since when traveling to countries like Spain and Italy, every Airbnb / Hotel requires you to send a picture of your passport. Japanese stores take your passport stamp picture for their tax-free, which contains the number on the page. Some embassies even take your passport for a few days before returning it with the visa. Why do we treat passport numbers as passwords instead of a login?
- creakingstairs 1y agoI once checked in at a pretty decent hotel in India and realised that they used re-used customers passport scans and invoices to print wifi coupons! I strongly complained but I don’t really know if they’ve changed.
- raron 1y ago> Why do we treat passport numbers as passwords instead of a login? Because some stupid people thought that photos of passports have any security / validity (including banks, brokerage firms). Interestingly none of them would accept photos of cash as payment though.
- aspenmayer 1y ago> Interestingly none of them would accept photos of cash as payment though. Banks had been hesitant to embrace cryptocurrencies, but they see the value of CBDCs and so are trying to push those. So they will accept something close to that as long as there a large legal market for crypto, which there is from their point of view and role in the market.
- ncruces 1y ago> especially since when traveling to countries like Spain and Italy, every Airbnb / Hotel requires you to send a picture of your passport. They're required to, it's part of the in-person hotel check-in process to require showing photo id, and registering all guests with the local police department. If you're a foreigner, and rather use a service where in-person check-in is impractical, they'll naturally ask for a photo to meet their legal obligations.
- imarkphillips 1y agoWhat a great story teller! Well done Alex.
- zkmon 1y agoEarth revolves around the Sun? Let's see. In a twin-star system which one is going around the other? Let's make one of them have higher mass. Did the heavier one completely stop going around, or does it still wobble a bit? That wobble mean the heavier one is still going around their common center of mass. Also, since there is no static fixed point in the space, the interpretation of movement of Sun and Earth could be very subjective to the reference frame selected. There is nothing wrong if someone wants to consider Earth as that fixed point for some arbitrary local reference frame. Infact, a lot of calculations that matter to human life on Earth require that.
- mmvora 1y agoIts a challenge to make things easy to use - whilst keeping them secure enough. The fact that all I need is a PNR to cancel your flight is insane
- deleted 1y ago[deleted]
- FugeDaws 1y agoThat was one of the funniest/interesting blog posts I've read in a long while