4 ms·

Online systems sometimes use it as an indicator to prove your identity. When combined with other sensitive data it can be useful for an identity thief. Edit: T

Online systems sometimes use it as an indicator to prove your identity. When combined with other sensitive data it can be useful for an identity thief. Edit: The blog post also mentions this: https://mango.pdf.zone/finding-former-australian-prime-minister-tony-abbotts-passport-number-on-instagram/#why-is-it-bad-for-someone-else-to-have-your-passport-number https://mango.pdf.zone/finding-former-australian-prime-minis...

moralestapia 1y ago
Can you provide just one example of said systems?
- selcuka 1y ago
  Sure: - https://www.myid.gov.au/verifying-your-id-in-myid#myid-Australianpassport https://www.myid.gov.au/verifying-your-id-in-myid#myid-Austr... - https://www.afp.gov.au/sites/default/files/PDF/NPC-100PointChecklist-18042019.pdf https://www.afp.gov.au/sites/default/files/PDF/NPC-100PointC... - https://www.equifax.com.au/personal/identity-verification-100-point-check https://www.equifax.com.au/personal/identity-verification-10... The blog post has more use case examples: https://mango.pdf.zone/finding-former-australian-prime-minister-tony-abbotts-passport-number-on-instagram/#why-is-it-bad-for-someone-else-to-have-your-passport-number https://mango.pdf.zone/finding-former-australian-prime-minis...
- throwaway422432 1y ago
  Look up Australia's 100 point proof of identity which is used by Gov and most corporate entities in Australia. A passport is a primary document (equivalent to a birth certificate) and gives you 60-70 points. It can't be used alone, but in conjunction with another id (forged or stolen) would allow for identify theft.
  - kelnos 1y ago
    Presumably you have to present a physical passport, though, for it to count toward those 100 points. The question was what you can do with just the passport number.
    - riatin 1y ago
      You would think so, but no, you don't! Typically it's just the passport number, or if the AML counterparty is feeling really ambitious, the number and the expiry date
- dafelst 1y ago
  There is an example in the article
- phs318u 1y ago
  Understanding that Australia doesn't have a Social Security ID (as the US does), might explain why passports play a similar role with respect to "proof of identity".
  - bigDinosaur 1y ago
    The Australian Tax File Number is presumably more similar to the Social Security ID? Millions of Australians don't have a passport. You don't need one for much - it's perhaps the easiest way of verifying citizenship if you already have one but not the only way.
    - throwaway422432 1y ago
      You would only have a TFN if you are working and potentially paying tax. So generally anyone under 16 would not have one. Closest might be a Medicare Card which gives you access to free/discounted public health that can be used as part of identification. Usually children are on their parents card. Drivers licence is also a primary identifier, and students can use their school student id.
  - iamthemonster 1y ago
    In Australia you start with a birth certificate and photo, and that leads to passport and driving licence. The three of those are the holy trinity of ID (though you'd very rarely be asked for your birth certificate). With passport and driving licence, you can do anything you want, but at least they are photo ID with some anti-forgery features. The time to steal someone's identity is before they get their first driver's licence and passport!
- SchemaLoad 1y ago
  Pretty sure you can use one to sign up for a phone number in Aus
  - soulofmischief 1y ago
    Wait hold on, you have to apply for phone numbers in Australia? You can't just grab a burner from Walmart?
    - SchemaLoad 1y ago
      Yes, every phone number gets linked to an ID. You can grab a sim from the supermarket but when you plug it in you've got to activate it which requires ID.
      - soulofmischief 1y ago
        I'm so sorry. Australia is such a draconian nanny state, hell-bent on surveillance and authoritarian control. It always reminds me a lot of here in the US: Incredible land, a vast ecology, great history and subcultures, and some truly amazing people unfortunately drowned out by a staggeringly large population of loud morons who seem hellbent on voting in the worst possible people to run the whole thing, people who often couldn't care less about the things that make their country truly great, while leaning heavily on populism and deception as a means to retain power. I wouldn't be surprised if the US eventually requires ID for phone numbers, either, the way things have been going.
        josephg 1y ago
        Aussie here. It seems fine though? Like, "buy a burner phone and go offgrid, where nobody knows your name" isn't something I've ever wanted. That's a cowboy dream. Its not really an australian dream. Its certainly not something I've ever wanted. I want to live my life with a competent government and competent police force that - for the most part - I can trust to do the right thing. So long as its not abused, I'm ok with a court order being able to coerce my email provider into giving the police access to my emails. As I understand it, almost all of these requests happen because of crimes. I want the police to solve crimes. Judges here aren't elected. They're mostly retired lawyers trying to do the right thing. I want to trust them. And - I think - for the most part we can. I lived in Melbourne during the pandemic. Our whole state got shut down hard for months. I can't tell you how weird it was seeing news of protests in NY on our behalf. Like, thats so sweet of you. And so stupid. And so unwelcome. Locals overwhelmingly supported what our state premier, Dan Andrews was trying (and failing) to do. In the next state election, most of the other parties barely bothered campaigning because Dan was so popular. I get that lots of americans think of australia sort of like a weird extra state. But we're not. We have our own country, our own values, our own culture and our own, super boring constitution. You can see who we are plain as day in this blog post - where eventually Tony Abbott (think Bill Clinton or Obama) calls up the blog post writer on the phone and asks him for tech advice, and admits he doesn't understand anything about computers. Thats the australian way. Americans having hot opinions about australian politics is like russians having hot opinions about american politics. Even when I agree with you on the details (and I sort of do), its a bit weird and creepy.
- crazylogger 1y ago
  US I-94: https://i94.cbp.dhs.gov/search/history-search https://i94.cbp.dhs.gov/search/history-search Knowing the passport number + name + birthday gives you access to someone's US travel history.
  - bawolff 1y ago
    Well that is terrifying.
    - djtango 1y ago
      This reminds me of some tech journo who lost all his iCloud photos including all his photos and videos of his newborn because some scriptkiddles wanted to pwn him and steal his Twitter handle. They basically used a series of escalation of seemingly innocuous personal data to eventually take over everything. IIRC they somehow got his last 4 credit card details from Amazon then used that to get through the Apple account recovery flow from there they then had his entire key chain. So "what is a passport number really used for" is like that but on steroids. I also recall someone's daily life turned into a nightmare because someone successfully socially engineered their power company and maybe phone company to generally harass them. So while I also have no intuition for why or how a passport number is sensitive I rationally know better and am very careful about even how I discard old boarding passes etc EDIT also worth adding that as a foreigner/non native my passport number is also often used in place for a social security number
      - mgarciaisaia 1y ago
        Posted that story here to discuss (didn't find it in Algolia's HN search): https://news.ycombinator.com/item?id=44430133 https://news.ycombinator.com/item?id=44430133

moralestapia 1y ago

Can you provide just one example of said systems?

selcuka 1y ago
Sure: - https://www.myid.gov.au/verifying-your-id-in-myid#myid-Australianpassport https://www.myid.gov.au/verifying-your-id-in-myid#myid-Austr... - https://www.afp.gov.au/sites/default/files/PDF/NPC-100PointChecklist-18042019.pdf https://www.afp.gov.au/sites/default/files/PDF/NPC-100PointC... - https://www.equifax.com.au/personal/identity-verification-100-point-check https://www.equifax.com.au/personal/identity-verification-10... The blog post has more use case examples: https://mango.pdf.zone/finding-former-australian-prime-minister-tony-abbotts-passport-number-on-instagram/#why-is-it-bad-for-someone-else-to-have-your-passport-number https://mango.pdf.zone/finding-former-australian-prime-minis...
throwaway422432 1y ago
Look up Australia's 100 point proof of identity which is used by Gov and most corporate entities in Australia. A passport is a primary document (equivalent to a birth certificate) and gives you 60-70 points. It can't be used alone, but in conjunction with another id (forged or stolen) would allow for identify theft.
- kelnos 1y ago
  Presumably you have to present a physical passport, though, for it to count toward those 100 points. The question was what you can do with just the passport number.
  - riatin 1y ago
    You would think so, but no, you don't! Typically it's just the passport number, or if the AML counterparty is feeling really ambitious, the number and the expiry date
dafelst 1y ago
There is an example in the article
phs318u 1y ago
Understanding that Australia doesn't have a Social Security ID (as the US does), might explain why passports play a similar role with respect to "proof of identity".
- bigDinosaur 1y ago
  The Australian Tax File Number is presumably more similar to the Social Security ID? Millions of Australians don't have a passport. You don't need one for much - it's perhaps the easiest way of verifying citizenship if you already have one but not the only way.
  - throwaway422432 1y ago
    You would only have a TFN if you are working and potentially paying tax. So generally anyone under 16 would not have one. Closest might be a Medicare Card which gives you access to free/discounted public health that can be used as part of identification. Usually children are on their parents card. Drivers licence is also a primary identifier, and students can use their school student id.
- iamthemonster 1y ago
  In Australia you start with a birth certificate and photo, and that leads to passport and driving licence. The three of those are the holy trinity of ID (though you'd very rarely be asked for your birth certificate). With passport and driving licence, you can do anything you want, but at least they are photo ID with some anti-forgery features. The time to steal someone's identity is before they get their first driver's licence and passport!
SchemaLoad 1y ago
Pretty sure you can use one to sign up for a phone number in Aus
- soulofmischief 1y ago
  Wait hold on, you have to apply for phone numbers in Australia? You can't just grab a burner from Walmart?
  - SchemaLoad 1y ago
    Yes, every phone number gets linked to an ID. You can grab a sim from the supermarket but when you plug it in you've got to activate it which requires ID.
    - soulofmischief 1y ago
      I'm so sorry. Australia is such a draconian nanny state, hell-bent on surveillance and authoritarian control. It always reminds me a lot of here in the US: Incredible land, a vast ecology, great history and subcultures, and some truly amazing people unfortunately drowned out by a staggeringly large population of loud morons who seem hellbent on voting in the worst possible people to run the whole thing, people who often couldn't care less about the things that make their country truly great, while leaning heavily on populism and deception as a means to retain power. I wouldn't be surprised if the US eventually requires ID for phone numbers, either, the way things have been going.
      - josephg 1y ago
        Aussie here. It seems fine though? Like, "buy a burner phone and go offgrid, where nobody knows your name" isn't something I've ever wanted. That's a cowboy dream. Its not really an australian dream. Its certainly not something I've ever wanted. I want to live my life with a competent government and competent police force that - for the most part - I can trust to do the right thing. So long as its not abused, I'm ok with a court order being able to coerce my email provider into giving the police access to my emails. As I understand it, almost all of these requests happen because of crimes. I want the police to solve crimes. Judges here aren't elected. They're mostly retired lawyers trying to do the right thing. I want to trust them. And - I think - for the most part we can. I lived in Melbourne during the pandemic. Our whole state got shut down hard for months. I can't tell you how weird it was seeing news of protests in NY on our behalf. Like, thats so sweet of you. And so stupid. And so unwelcome. Locals overwhelmingly supported what our state premier, Dan Andrews was trying (and failing) to do. In the next state election, most of the other parties barely bothered campaigning because Dan was so popular. I get that lots of americans think of australia sort of like a weird extra state. But we're not. We have our own country, our own values, our own culture and our own, super boring constitution. You can see who we are plain as day in this blog post - where eventually Tony Abbott (think Bill Clinton or Obama) calls up the blog post writer on the phone and asks him for tech advice, and admits he doesn't understand anything about computers. Thats the australian way. Americans having hot opinions about australian politics is like russians having hot opinions about american politics. Even when I agree with you on the details (and I sort of do), its a bit weird and creepy.
crazylogger 1y ago
US I-94: https://i94.cbp.dhs.gov/search/history-search https://i94.cbp.dhs.gov/search/history-search Knowing the passport number + name + birthday gives you access to someone's US travel history.
- bawolff 1y ago
  Well that is terrifying.
  - djtango 1y ago
    This reminds me of some tech journo who lost all his iCloud photos including all his photos and videos of his newborn because some scriptkiddles wanted to pwn him and steal his Twitter handle. They basically used a series of escalation of seemingly innocuous personal data to eventually take over everything. IIRC they somehow got his last 4 credit card details from Amazon then used that to get through the Apple account recovery flow from there they then had his entire key chain. So "what is a passport number really used for" is like that but on steroids. I also recall someone's daily life turned into a nightmare because someone successfully socially engineered their power company and maybe phone company to generally harass them. So while I also have no intuition for why or how a passport number is sensitive I rationally know better and am very careful about even how I discard old boarding passes etc EDIT also worth adding that as a foreigner/non native my passport number is also often used in place for a social security number
    - mgarciaisaia 1y ago
      Posted that story here to discuss (didn't find it in Algolia's HN search): https://news.ycombinator.com/item?id=44430133 https://news.ycombinator.com/item?id=44430133