Boarding passes generally meet one of two rather disparate fates: They’re either discarded and forgotten by the frequent fliers tired of touting around yet another piece of paper, or they’re photographed and immortalized by the vacationer eager to share his or her worldly travels with a waiting social circle. But regardless of whether your boarding pass habits align more closely with situation A or situation B, you may want to be a bit more careful — as it turns out, it contains a pretty alarming amount of information that you may not want floating about in the universe.
As per a new blog post authored by the well-reputed security expert Brian Krebs of Krebs on Security, the barcodes on your boarding passes contain a wealth of information, and more alarmingly still, clues as to your current and future travel plans and habits. According to Krebs, a devoted reader named Cory found a photo of a friend’s boarding pass on Facebook and proceeded to run it through one of many free online barcode readers. Suddenly, he was accosted by his friend’s personal details.
“Besides his name, frequent flyer number and other (personally identifiable information), I was able to get his record locator (aka ‘record key’) for the Lufthansa flight he was taking day,” Cory told Krebs. “I then proceeded to Lufthansa’s website and using his last name (which was encoded in the barcode) and the record locator was able to get access to his entire account. Not only could I see this one flight, but I could see any future flights that were booked to his frequent flyer number from the Star Alliance.” Also included as part of this digital treasure chest of data was Cory’s friend’s contact information.
The dangers of having this sort of sensitive data out in the open abound, and Krebs points out that a hacker or any ill-wisher could easily change your travel plans by canceling a flight or booking a different one altogether, resetting your frequent flier information, or even use this information to segue into other personal accounts that may be connected. And of course, with access to your contact information, potential criminals could discover where you live and how best to find you.
Needless to say, posting a photo of your boarding pass on the Internet isn’t a good idea, but to avoid having your boarding pass slip accidentally into problematic fingers, Krebs and other experts have suggested using mobile boarding passes that only you can access. After all, in this digital age, you could stand to save the trees and protect your privacy at the same time.
