Never Post A Picture Of Your Boarding Pass On Social Media
Before going on a trip many of us do the mandatory check-in at Facebook, Twitter or Instagram, saying where we going, how many days we will be away for and who we’re travelling with, and post a picture of out boarding-pass to prove it. Its super cool for friends and anyone who follows you online! But sadly are you aware of what an adversary can do with only your airplane boarding pass.
Let's see what someone can do with a photograph of a boarding pass:
Are you wondering if it’s still really cool to post pictures of your boarding pass over social media if these are the consequences? No, no you should not.
But wait, what about the barcode?
People forget to hide the barcode/QR code, not knowing that the barcode will give away all of the information which the person has scribbled over. These barcodes/QR codes can be easily read on barcode scanner apps which will retrieve the data.
Imagine scenarios like this:
(a) You’re traveling from Oslo to Moscow today and post your boarding-pass unedited onto Instagram. Your next flight from Moscow to Tokyo is tomorrow. An adversary can login to your account on the Airlines' website, cancel the ticket to Tokyo and strand you in Moscow airport. Since you are in flight, you will get no notification of flight cancellation until you reach Moscow.
(b) You’re a vegetarian and someone changes your meal preference to meat.
(c) Someone uses your frequent-flyer miles to upgrade their own bookings.
(d) Someone can blackmail the flyer or sell their itinerary to business rivals or close relatives if they suspect that the flyer is travelling with someone important (or maybe cheating).
If you do want to post your boarding card online blur out all your personally identifiable information and flight details and, importantly, your bar code!
- Get your full name
- Get your seat, flight time, destination
- Get your PNR and e-ticket number (starts to get bad from here)
- Login to the Airlines' website via your name and PNR
- See your e-mail address, phone number, home address, other booked flight details (worse coming up)
- Cancel upcoming flights
- Modify your name, phone number, e-mail address
Are you wondering if it’s still really cool to post pictures of your boarding pass over social media if these are the consequences? No, no you should not.
But wait, what about the barcode?
People forget to hide the barcode/QR code, not knowing that the barcode will give away all of the information which the person has scribbled over. These barcodes/QR codes can be easily read on barcode scanner apps which will retrieve the data.
Imagine scenarios like this:
(a) You’re traveling from Oslo to Moscow today and post your boarding-pass unedited onto Instagram. Your next flight from Moscow to Tokyo is tomorrow. An adversary can login to your account on the Airlines' website, cancel the ticket to Tokyo and strand you in Moscow airport. Since you are in flight, you will get no notification of flight cancellation until you reach Moscow.
(b) You’re a vegetarian and someone changes your meal preference to meat.
(c) Someone uses your frequent-flyer miles to upgrade their own bookings.
(d) Someone can blackmail the flyer or sell their itinerary to business rivals or close relatives if they suspect that the flyer is travelling with someone important (or maybe cheating).
If you do want to post your boarding card online blur out all your personally identifiable information and flight details and, importantly, your bar code!
Comments
Post a Comment