安全与隐私mango.pdf.zone
当我在 Instagram 上发现托尼·阿博特的护照号码
When you browse Instagram and find Tony Abbott's passport number
2020 — 2025，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
一位安全研究者在 Instagram 上翻到澳大利亚前总理 Tony Abbott 发布的照片，从中读到他的护照号与航班订座编号，进而发现航空公司订座系统只需姓名加订座编号就能调出旅客记录。文章以幽默自嘲的笔调讲述他如何一步步验证这个漏洞、并向航空公司与相关部门披露。
为什么经久不衰：它把一次偶然的社交媒体泄密讲成既好笑又实用的安全课：照片里的小细节足以撬开一整套系统，而这类问题多年后依然普遍存在。
HN 评论精选
高斯模糊可被反卷积还原，涂黑并转成图片才安全。
说得好。我也有个类似经历，顺便提醒：有时候打码（模糊）是不够的。一位朋友曾在 Instagram 发美国签证照片宣布赴美行程，还特意把护照号等敏感信息做了高斯模糊。但高斯模糊很容易还原，我用 Mathematica 自带的 ImageDeconvolve、猜了个高斯核参数就成功还原了，然后告诉了她。我建议直接用黑矩形涂黑，如果是 PDF，处理后再转成图片，因为太多 PDF 编辑器只是叠加新对象，底下的内容并没有被改动。
kccqzy查看英文原文
Nice. Here's a similar personal story with a PSA that sometimes blurring is NOT sufficient. A friend of mine posted on Instagram a picture of a U.S. visa (or something similar; it was probably five years ago) to announce her trip to the U.S., and she took care to blur out sensitive information such as her passport number. But a Gaussian blur is easy to reverse and I successfully unblurred it and told her my discovery. I didn't use any specialized software; it was just Mathematica with its built-in ImageDeconvolve function with guessed parameters for the Gaussian kernel. I personally recommend blacking out (add a black rectangle) instead of blurring, and if it is a PDF, convert to an image afterwards because too many PDF editors use non-destructive operations to add a new object instead of changing what's underneath.
内容与文笔俱佳，可读性极强。
除了内容本身非常有意思，这篇也写得极好，信息和趣味的分寸拿捏得恰到好处，我很喜欢这种写作风格。
POiNTx查看英文原文
Apart from the really interesting content, this is an extremely good read, strikes me as the right kind of balance of information and keeping you entertained. I really enjoyed this writing style!
文章充满自嘲式幽默，尤其是拿澳洲换总理和 Harold Holt 失踪开玩笑。
里面有几处一流的毒舌金句：「此人是 Tony Abbott，澳大利亚众多前总理之一。」「出于安全考虑，我们尽量每六个月换一次总理，并且绝不在多个网站上重复使用同一位总理。」「Harold Holt 也是另一位前总理，我们……把他弄丢了？他某天早上去游泳时消失了。这不是玩笑。我们把 Harold Holt 纪念游泳中心以他命名。我再说一遍，这不是玩笑。」
sorum查看英文原文
Some Grade A zingers in there: > The man in question is Tony Abbott, one of Australia’s many former Prime Ministers. > For security reasons, we try to change our Prime Minister every six months, and to never use the same Prime Minister on multiple websites. > Harold Holt was another former Prime Minster and we… lost him? He disappeared while going for a swim one morning. This is not a joke. We named Harold Holt Memorial Swim Centre after him. I repeat, this is not a joke.
漏洞在 Amadeus 这类共用订座平台上，影响约 200 家航司，且早被报道过。
我觉得这篇严重埋没了重点：Qantas 的系统由 Amadeus 运营，而 Amadeus 还为另外约 200 家航空公司提供订座系统。既然能在 Qantas 上做到这一步、拿到那些备注，很可能对任何其他航空公司也能做到。这已经够糟了，而且这个问题（或非常类似的问题）早在 2019 年初就被广泛报道过。所以要么 Amadeus 直到这次披露才修（非常非常糟），要么 Qantas 没给订座系统打安全补丁（同样很糟）。
fphhotchips查看英文原文
I feel like this buries the lede massively: Qantas' system was run by Amadeus, who also run the booking system for some 200 other airlines [0]. If you could do this with Qantas and get all those notes, you could probably do it to any other airline and get them too. That would be bad enough, but it also appears that this issue (or one very much like it) has been reported widely at least back in early 2019. So, either Amadeus didn't fix the issue until it was disclosed here (very very bad) or Qantas didn't update their booking system for a security patch (also very bad). [0] https://techcrunch.com/2019/01/15/amadeus-airline-booking-vulnerability-passenger-records/
历次讨论
同类还值得读
非法素数
Illegal prime
维基百科条目，介绍“非法素数”：某些素数之所以被称为“非法”，是因为它们经特定编码后，恰好对应一段被法律禁止传播的数据——最著名的是 DVD 解密程序 DeCSS 的代码，有人把…
安全与隐私上首页 5 次 · 2010–2021en.wikipedia.org编辑精选关于 /dev/urandom 的常见误区
Myths about /dev/urandom
（Thomas Hühn 撰写，2014 年首发并持续更新）逐条反驳关于 /dev/urandom 的常见误解：它与 /dev/random 使用的是同一个 CSPRNG，一旦完…
安全与隐私上首页 5 次 · 2014–20202uo.de编辑精选AES 高级加密标准火柴人图解
A Stick Figure Guide to the Advanced Encryption Standard (AES)
一篇用火柴人漫画形式讲解 AES（高级加密标准）算法的经典科普文章。
安全与隐私上首页 5 次 · 2009–2022moserware.com编辑精选指纹是用户名，不是密码
Fingerprints are Usernames, not Passwords
作者（eCryptfs 维护者、Ubuntu 安全工程师）认为指纹等生物特征是公开、不可更改的标识，应视作用户名而非密码，不能当作秘密凭据用于认证。
安全与隐私上首页 4 次 · 2013–2017blog.dustinkirkland.comHTTPS 连接的最初几毫秒（2009）
The First Few Milliseconds of an HTTPS Connection (2009)
逐毫秒拆解一次 HTTPS 连接建立时发生了什么，重点讲 TLS 握手、证书验证、RSA 签名与密钥协商等机制，面向不熟悉该领域的读者。
安全与隐私上首页 4 次 · 2009–2020moserware.com编辑精选