Better Than Nothing Security on the example of Russian Railways
I think many used the system of buying tickets for trains over the Internet. And I used it more than once. There were different oddities of course ... but overall the system is cool. Many people probably noticed that electronic terminals for ticketing appeared at the stations in Moscow time. The use case is this: I buy a ticket via the Internet site , print a form with a barcode, go to the station, bring this form to the iron brain, enter my passport information and get a ticket.
There is one thing that always confuses me in this scheme. Cryptographic strength of my passport data. But still, I calmed myself down - well, they would find my form on the street, well, they would see my name there, where could they get my passport number!
Having issued a ticket on the site, this beautiful site offers me to print it immediately. Commendable zeal! But there is one thing - FF does not print documents on my printer, because they quarrel with the printer driver because of the paper format. It happens, well ... I copy the form in OpenOffice and type. I think I’m not the only one doing this - many people can copy it into the office bag and print from there.
And here begins the most interesting! Printing out the form in this way, I found on it ... my passport number! That is, the one who holds this form in his hands, he goes to receive it. Seeing this on a form, I thought at first something bad about RZD, and then I looked at their website and saw the following in the code:
')
There are just two blocks, depending on the mode, either a block with passport data is selected, or from an asterisk (the position of the asterisks is also cool, taking into account the number of the structure, yeah)! In the end, what we see is the use of CSS as a means of hiding data that is actually used as a password!
Lord, maybe I do not understand something?
There is one thing that always confuses me in this scheme. Cryptographic strength of my passport data. But still, I calmed myself down - well, they would find my form on the street, well, they would see my name there, where could they get my passport number!
Having issued a ticket on the site, this beautiful site offers me to print it immediately. Commendable zeal! But there is one thing - FF does not print documents on my printer, because they quarrel with the printer driver because of the paper format. It happens, well ... I copy the form in OpenOffice and type. I think I’m not the only one doing this - many people can copy it into the office bag and print from there.
And here begins the most interesting! Printing out the form in this way, I found on it ... my passport number! That is, the one who holds this form in his hands, he goes to receive it. Seeing this on a form, I thought at first something bad about RZD, and then I looked at their website and saw the following in the code:
< td >
< span class = screen> PN1234567890 < / span >
< span class = print> Mon ***** 7890 < / span >
< / td >
')
There are just two blocks, depending on the mode, either a block with passport data is selected, or from an asterisk (the position of the asterisks is also cool, taking into account the number of the structure, yeah)! In the end, what we see is the use of CSS as a means of hiding data that is actually used as a password!
Lord, maybe I do not understand something?
Source: https://habr.com/ru/post/63660/
All Articles