60

In one of the questions on this site, it was suggested the use of Dropbox to save a backup copy of your passport, in case you need to proof who you are if your original document is lost.

I like the idea, but what if someone gets access to your Dropbox folders and is able to acquire the copy of your passport. The same goes for when you leave a copy of your passport at a hotel receptions desk. Once someone has the info printed on that copy, would that make it easier to steal your identity?

  • Mostly identity theft, but not too major these days in the age of social media. – nolim1t Nov 28 '13 at 5:12
  • This question is answered more comprehensively on security.SE. – Dan Dascalescu Mar 17 at 2:45
45

Yes - it does increase the risk of identity theft, however for most successful identity thefts, the attacker would need various other bits of information as well.

The best way to think of it is that every piece of information about you an attacker has, the less effort he has to expend to impersonate you.

Once an attacker can impersonate you they could steal your money (this happens a lot with online banking), your house, your credit rating, your reputation, and generally cause you major problems.

General recommendation is to not place anything in Dropbox unencrypted, if it is at all sensitive.

We have a range of questions on this topic over on Security SE and more than happy to discuss in the DMZ - the Sec.SE chat room.

23

A passport copy can often contain sensitive information such as date of birth which can be used to access other sensitive information such as bank accounts. However, most transactions where you need to get in touch with customer care to get access will also require additional details such as secret passphrases, PINs, address information, or account numbers - none of which are available on your passport, hence the passport alone will usually not help anyone steal your identity. Additionally, if trying to steal your identity in person as opposed to online or the phone, they'd need to look similar to you and/or back it up with some form of secondary ID such as a national ID or a driver's license, and obtaining BOTH your passport copy and your secondary ID can be hard for a casual counterfeiter.

Dropbox isn't the only way to store copies of your passport; some people do this by saving a scanned copy in their email account. Whatever way you choose, if you are concerned protecting data then you should look into enabling two-factor authentication on such accounts where in addition to your password you also need to enter a one-time password generated either by an app or sent to you by text message to access the account. Since receiving text messages is free in most countries even when roaming (or is reasonably cheap), this can be a good way of boosting security on your account while travelling.

  • 2
    Needed to say, with Dropbox, i.e. collaborative file-sharing system, having an SMS double-check is a bit of a non-sense :-/ However I agree, Dropbox is not the best place in the world to store sensitive data. – yo' Jan 29 '14 at 10:50
  • 1
    I'd be suspicious of emailing sensitive things to your email too, especially gmail, I don't think it's beyond Google tech to scan binary image formats for ad purposes – blackbird Jan 30 '14 at 16:30
  • @blackbird57 You don't necessarily need to send the email, you can attach a file and save it as a draft. – kiradotee Apr 27 '16 at 22:54
  • This answer was written in 2013. Nowadays, using 2FA with SMS is a very bad idea. Using an app like Google Authenticator is recommended instead. – Dan Dascalescu Mar 12 at 9:26
8

Another thing an attacker can do is to take over your social network account (Facebook, for example) or Gmail, by calling the support, pretending to be you who "lost a phone" and "got locked out of email", and sending them the scan of your passport to "prove" he is you. This has happened in past (see for example "Aaron Thompson lost control of his Facebook account after an attacker used social engineering and a fake passport").

  • 1
    In an ideal world, this would not succeed. But we don't live in an ideal world. I have seen many cashiers flip over my credit card, glance at the clearly printed "PHOTO ID REQUIRED" instead of a signature, and continue on saying nothing. I purchased groceries for my blind friend with her card and her not present and the cashier thought nothing of a male using a card labeled "Elizabeth." – WGroleau Feb 17 '18 at 1:35
  • @WGroleau: my ex (female) has routinely bought things with my credit card without problem. This happened as recently as 2018, and in Silicon Valley, where you'd think awareness of security practices would be a little higher than elsewhere. – Dan Dascalescu Mar 12 at 9:28
5

There is an app that integrates with Dropbox that encrypts your data, so that you get the convenience of having it everywhere but much more difficult to steal. It's called BoxCryptor, check it out. I have my passport and some insurance stuff on there as a backup.

  • 4
    Except you don't get it everywhere. You need a copy of this software installed to access it, which isn't going to work well when you're being held by immigration due to having lost your passport... – Doc Jan 28 '14 at 22:54
  • 3
    Yeah you can have it on your phone, with Dropbox you can set favourites so they're available to view offline on your phone. Worst case, if they ask to see something, you can request some 3G/wifi to download before unlocking the encrypted docs – blackbird Jan 30 '14 at 16:28
  • I've used Boxcryptor and it's a solid choice if you only have one computer and one mobile device; beyond that you need to pay for it (or deal with their local-only install). Another similar option would be to use VeraCrypt (formerly TrueCrypt) to create a container on your computer, put the scans there, and then use Disk Decipher on your phone to access the archive. Yet another option is to use some tool other than Dropbox that has zero-knowledge encryption, e.g., Sync.com, TresorIt, SpiderOak, pCloud, or iDrive. – corvec Mar 19 '18 at 16:01