How does one see what redirects you are being sent through?
Can someone explain how I'd see all those issues that he mentioned? Just through Inspector in Firefox, or other tools?
How Airlines don’t care about privacy: Case Study Emirates.com
21–30 of 177 posts
Re: How Airlines don’t care about privacy: Case Study Emirates.com
#22I mean - after Equifax got away with leaking SSNs, Names, Addresses with DoBs of all 142M Americans - this is seriously nothing. At this point, I have become apathetic on these privacy related issues as nothing will be done.
Re: How Airlines don’t care about privacy: Case Study Emirates.com
#23How do Expedia, Travelocity, etc. compare with airline booking sites?
Re: How Airlines don’t care about privacy: Case Study Emirates.com
#24> This issue is not only limited to Emirates, a lot of airlines like Lufthansa, KLM (last checked on October 2017) suffer from the same issues. Still, god bless Emirates. Hands down, best airline.
One story of my life:
I was scheduled for a flight Singapore -> Frankfurt and wanted to avoid sitting next to a colleague. Asked at check-in the lady who was sitting next to me and got the names without hesitation. On the flight back from Frankfurt, I could not confirm the names due to privacy laws. I suppose it is a question of awareness and local practices.
Re: How Airlines don’t care about privacy: Case Study Emirates.com
#25Has anyone heard of an exploit that sets people's flights to use the attackers frequent flyer number, thus collecting their miles?
This[1] talk linked in the article mentions that it is happening, and that the name check is mostly useless because you can often just change the name attached to the frequent flyer number. Of course, things may have changed, but they probably haven't.
[1]: https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carme...
Re: How Airlines don’t care about privacy: Case Study Emirates.com
#26How does one see what redirects you are being sent through? Can someone explain how I'd see all those issues that he mentioned? Just through Inspector in Firefox, or other tools?
Inspect element is a good place to start. I would suggest the following approach:
1. Open a new tab. 2. Right click inspect element and check the option to preserve logs. 3. Copy and paste the link which you want to check, 4. Preserve log will keep all the re-directions.
and you can then inspect what the website is upto.
There are more tools, which help you debug traffic outside browser like https://mitmproxy.org, Wireshark etc, but I think Inspect Element should be enough to help you reproduce the scenarios mentioned in the article.
Re: How Airlines don’t care about privacy: Case Study Emirates.com
#27Nothing will happen until a malicious party ends up cancelling an entire flight’s worth of passengers and it starts costing them serious money and reputation. It’s a sad state of affairs when there is no ethical way to correct certain grossly unethical business practices.
Absolutely agree, data security is a not a priority for almost all organizations in Service Industry. Hopefully GDPR and E-Privacy will be the beginning of an era when organizations are forced to think about protecting user information.
The website sounds like a blatant GDPR violation, and GDPR has teeth.
Re: How Airlines don’t care about privacy: Case Study Emirates.com
#28Its funny to be reading this just a week after noticing this. Every airline uses some sort of a contractor or a shared piece of software for online checkins. You can tell by the formed URI fragments and the JSON being sent back and forth. Its all trash. I wanted to work on a business that unified all check-ins under single company. I do not think however, it is reasonable given that all of these airlines have the pro…
> shared piece of software for online checkins
You are probably refering to GDS - that’s been up since 1960’s: https://en.m.wikipedia.org/wiki/Computer_reservation_system#...
Re: How Airlines don’t care about privacy: Case Study Emirates.com
#29i wonder how GDPR will affect this sort of issue.
Re: How Airlines don’t care about privacy: Case Study Emirates.com
#30In line with the age-old advice on how sausages are made, here's my advice: don't ever inspect the data leaving a mobile device.
– Just as I was about to add this comment, I remembered how it's not limited to mobile devices anymore.
(Thankfully with certificate pinning and integrity checking you may be spared of the risk of ever finding out what your apps actually do. Remember: only weirdos and terrorists tinker.)