Identity Theft From Tossed Airline Boarding Pass?

crush writes "The Guardian newspaper has a great story about how the gathering of information for 'anti-terrorist' passenger screening databases allowed a reporter and security guru Adam Laurie to lay the groundwork for stealing the identity of a business traveller by using his discarded boarding-pass stub." From the article: "We logged on to the BA website, bought a ticket in Broer's name and then, using the frequent flyer number on his boarding pass stub, without typing in a password, were given full access to all his personal details - including his passport number, the date it expired, his nationality (he is Dutch, living in the UK) and his date of birth. The system even allowed us to change the information."

Comments

Re:I call bullshit

[ISoldMyLowIdOnEbay]

From TFA

"BA has now closed its security loophole after being contacted by the Guardian in March"

So I wouldn't expect it to work now...

Re:I call bullshit

[rfunches]

Okay, I'll bite.

From TFA, the guy is a business traveller. Now look what happens if you "need help" logging in to BA's website:

As a member of the British Airways Executive Club, On Business or as a registered customer with britishairways.com, you can now log in to manage your account and access our exclusive online services. You log in by entering your details in the boxes at the top right hand corner of the screen.

Login ID Your login ID is either your: > Executive Club membership number or > On Business membership number or > Username

PIN/Password When logging in with the following: > Executive Club membership number, use your 4-digit PIN or > On Business use your login id and password or > username, use your password

Executive Club members If you need a PIN or have forgotten your PIN, then please click here to apply for one >>

On Business members If you have forgotten your password or login id click here for more information >>

Forgotten your password? Enter your username in both the Login ID and the PIN/Password boxes to receive your password prompt.

From what I can tell, if the reporter is in fact not lying, if the "victim" was an Executive Club member, you need the following if you need a PIN, or have forgotten your PIN:

• Membership number
• First name
• Family/Last name

Hmm. This is printed on the boarding pass already. Oh, and if he's an On Business member, you only need the username to retrieve the password, and the website tells you that it's "2 characters 6 digits"; what's the chance of that being the membership number printed on the boarding pass?

I wouldn't call this complete and utter bullshit yet. There are reasonable explanations for how this was accomplished.

Re:That story scares me.

[innot]

No, an airport is national territory. And by convention an airplane becomes part of the national territory the moments the doors open (with doors closed different regulations apply (Warsaw Convention, Montreal Convention))

Most International Airports have designated transit area for passengers transiting a country to save them from the hassle of immigration and emigration - Except for the US, where most international airports do not have real transit areas, thus requiring all transiting passengers to enter the US and leave it a few minutes later (wasting 2-3 hours for the whole process, no to mention the humiliating finger-printing and picture taking)

It seems to me, that the US officals think that everyone setting foot on US soil only wants to enter the country (as a potential terrorist).

I work at an airline and we used to have flights to the US with continuing services to other destinations in middle america and the caribbean.
We had to stop this because of the enourmous hassles our transit passengers had to endure on transit (including sometimes refusal of transit). We now go via Havanna, which has its own problems, but at least the passengers have no problems on the transit.