Skip to main content

Why posting photos of your boarding pass is a terrible idea

Ah, travel. Remember travel?

Travel was when we used to go “other places,” in a time when the U.S. wasn’t literally banned from the rest of the world. And often, when preparing to travel, we used to post pictures to social media of our boarding pass to show off to our friends and — more importantly — anonymous internet strangers.

Turns out this is and has always been a terrible idea because the internet is dark and full of hackers. Or in this case, a person in Australia who knows how to access the “inspect element” option on a website’s drop-down menu and used it to hack personal details from the country’s former Prime Minister.

"So you know when you’re flopping about at home, minding your own business, drinking from your water bottle in a way that does not possess any intent to subvert the Commonwealth of Australia?"

— “Alex” (@mangopdf) September 16, 2020

As chronicled in an extremely hilarious blog post, complete with YMCA background music, Alex Hope, a hacker and blogger based in Australia, detailed his odyssey of kind-of-accidentally-on-purpose discovering the passport and phone numbers of former Australian Prime Minister Tony Abbott.

It all started when Abbott posted a picture on Instagram of his boarding pass in March, in which the booking reference number is clearly visible (the photo has since been removed, because duh).

Turns out, as Hope discovered, you can easily log in to certain airline websites using just this information: A last name and a booking reference. And voilà, Hope got his hands on the rather sensitive information of the major Australian diplomat, including what the airline was saying about Abbott, his phone number, and his diplomatic passport number.

This sent Hope down a wormhole of government email addresses and telephone numbers, trying to inform the powers-that-be that he had rather easily snagged this information and that it was a problem. In the end, Hope said officials corrected the issue.

When reached for comment, Hope confirmed to Digital Trends that he wasn’t a professional white-hat hacker, and the blog was basically just a fun side project, but that he does work in computer security professionally.

“I didn’t have to use any like, actual computer knowledge for this,” he told Digital Trends over Twitter. “But doing this kind of thing for work did get me in the useful habit of recording my screen whenever I’m about to do a crime.”

Making yourself an easy target

While Hope’s story is the latest (and currently, funniest) documentation of how this kind of identity theft works, it’s been a known problem for a while.

Hope’s hack was fairly low-tech (a simple right-click will do it), but there are websites out that that can also fully scan a boarding pass bar code simply through the picture, according to Reader’s Digest.

In 2017 and 2018, both Forbes and the tech blog Null-Byte pointed out that while some bad actors will go so far as to “socially engineer” (aka phish) information out of people, a simple search of #boardingpass on Instagram will yield thousands of potential targets. Even if a bar code or a booking reference aren’t forthcoming, just a frequent flyer number will work. Even Google Images indexes boarding pass pictures.

It doesn’t take much to get people’s personal information and screw up their lives via identity theft. So don’t let vanity — or a compulsive desire for social media validation — will be your downfall. Stop posting pictures of your boarding passes. Or at least obscure the important information if you must show off to your pals.

Maya Shwayder
I'm a multimedia journalist currently based in New England. I previously worked for DW News/Deutsche Welle as an anchor and…
AMD may be doing something unprecedented with Ryzen 9000
A render of a Ryzen 9000 CPU.

AMD's Ryzen 9000 processors are right around the corner, set to launch this month -- and we just got our first hint about how much they might cost. An early preorder from a Slovenian retailer revealed the pricing for all four Zen 5 desktop chips. On the whole, it's good news. AMD appears to be doing something that hardly ever happens by keeping the prices lower than they were at the launch of Zen 4. However, that doesn't mean that buying the new processors will save you money.

The preorders at Funtech, a Slovenian retailer, are now open, and this just might be the first place that's already selling Zen 5. The flagship Ryzen 9 9950X was listed at 660 euros ($708 at current exchange rates), followed by the Ryzen 9 9900X at 500 euros ($536), the Ryzen 7 9700X at 400 euros ($429), and lastly, the Ryzen 5 9600X, priced at 310 euros ($332).

Read more
Why Nvidia is about to get a huge edge over AMD
The Nvidia RTX 4080 Super on a pink background.

Micron has shared some performance figures for its next-gen graphics memory, and if these numbers turn out to be true, it could mean great things for upcoming graphics cards.

The company claims that its GDDR7 VRAM will offer up to 30% performance improvement in gaming scenarios, and this reportedly applies both to games that rely heavily on ray tracing and on pure rasterization. Will Nvidia's RTX 50-series, which is said to be using GDDR7 memory, turn out to be a bigger upgrade than expected?

Read more