Who doesn’t love Instagramming their vacation? Beautiful vistas, pretty yoga photos, and more can all be collected in a string of online snapshots that let you track your entire trip! Even your boarding pass! After all, what could go wrong with publicly revealing a six-digit number anybody can punch into an airline’s website to learn personal details about you?
In case you hadn’t guessed, Instagramming your boarding pass is a terrible, terrible idea. In the video below, you’ll watch security researcher Karsten Nohl go onto Instagram, use the hashtag #boardingpass to find a Lufthansa ticket, and then punch it into the company’s website. With just that, a troll could access your personal details and frequent flyer number, not to mention monkey with your flights. In theory, if the hacker could breach the agent systems, they could also find your credit card number and other personal information no one but the airline should have ever had. And the danger doesn’t go away when the flight touches down, as the numbers and bar codes tend to stay active for a set period of time afterward.