WHAT do you do with your boarding pass after your flight lands? Do you:
a) Leave it in the seatback pocket?
b) Throw it away?
c) Have no idea where it ended up, but feel grateful that it’s your boarding pass and not your smartphone that you misplaced?
d) Take it home with you and feed it through a paper shredder?
Gulliver knows better than to assume knowledge of the habits of all his readers, but he’s going to posit that not very many of you answered d). A boarding pass for a flight that you have already boarded is about as valuable as a ticket to a concert that already happened. Unless it’s one that you want to remember for the rest of your life, you won’t be holding on to any keepsakes.
But if you answered a), b), or c), you could be opening yourself up to “hackers, identity thieves or even stalkers”. That’s according to CBS News, which published one of a flurry of recent reports on the sensitive information contained in a boarding pass. It all began with a post by Brian Krebs, a former Washington Post reporter who writes the influential Krebs on Security blog. Mr Krebs was moved to action when a reader saw a picture of a Lufthansa boarding pass that a friend had posted to Facebook. The reader, Cory, was able to scan the pass’s barcode and uncover a trove of personal information. It revealed not only the friend’s name and frequent flyer number, but also his flight record locator, which could be used on the Lufthansa website to view future bookings from the Star Alliance. Cory could now change his friend’s seats and even cancel flights.
The ensuing hysteria was as predictable as it was widespread. Slate summed it up best with a story headlined: “Why You Should Eat Your Airplane Boarding Pass Once You Take Your Seat.” Mr Krebs recommended disposing of your boarding pass via a shredder.
But does a boarding pass barcode really hold the key to such sensitive secrets? At Fusion, Kashmir Hill argues that it doesn’t. “Yes, it’s true there’s a lot of information there,” she writes, “but it’s not much more than what someone sees by simply looking at your boarding pass, sans barcode scanner.” Ms Hill scanned boarding passes from more than five airlines and found that in all cases, the only information contained in the barcode that wasn’t printed on the pass itself was the frequent flyer number.
Well, you may counter, what that really means is that the entire paper boarding pass should be protected vigilantly from falling into the wrong hands. It is true that information on a boarding pass gets strangers one step closer to your airline account. But these accounts, Ms Hill writes, require a PIN or password. And while a frequent flyer number can let people reset your PIN or password, they still have to answer a security question to complete the process.
That’s not necessarily a tall order, though. Cory’s friend’s security question was the most common one around: What is your mother’s maiden name? As Mr Krebs writes, that information can often be found easily on a person’s Facebook page, particularly if the mother’s relatives have her maiden name as their last name.
All of this goes to show that yes, airlines should probably not make data available through a barcode scanner that they don’t want to make available on a printed boarding pass. And yes, you are probably better off using an electronic boarding pass on your phone, inconvenient though it may sometimes be. But the biggest takeaway is simply that your personal data are a lot easier to hack than you probably think. A wide range of seemingly harmless slips of paper, containing your name and an identifying detail or two, can open you up to a hacker’s attack. So the next time you check for your personal belongings as you exit a plane, you might want to make sure your boarding pass is among them.
