31–40 of 177 posts
How do Expedia, Travelocity, etc. compare with airline booking sites?
I mean - after Equifax got away with leaking SSNs, Names, Addresses with DoBs of all 142M Americans - this is seriously nothing. At this point, I have become apathetic on these privacy related issues as nothing will be done.
i wonder how GDPR will affect this sort of issue.
EDIT: (Addendum) - The user would also have the right to ask the first party (airline) to "require" third parties it has shared personal data with, to delete them. Enforcing this however, will be hard.
I mean - after Equifax got away with leaking SSNs, Names, Addresses with DoBs of all 142M Americans - this is seriously nothing. At this point, I have become apathetic on these privacy related issues as nothing will be done.
All 142m Americans?
The fact that your mail client / embedded browser takes you happily to sites with broken certs, giving them a tracking token (and in this case, total access to your booking) is also quite a problem.
In line with the age-old advice on how sausages are made, here's my advice: don't ever inspect the data leaving a mobile device. – Just as I was about to add this comment, I remembered how it's not limited to mobile devices anymore. (Thankfully with certificate pinning and integrity checking you may be spared of the risk of ever finding out what your apps actually do. Remember: only weirdos and terrorists tinker.)
I think we can be confident that sites that don't even use CSP won't be implementing Expect-CT any time.
In line with the age-old advice on how sausages are made, here's my advice: don't ever inspect the data leaving a mobile device. – Just as I was about to add this comment, I remembered how it's not limited to mobile devices anymore. (Thankfully with certificate pinning and integrity checking you may be spared of the risk of ever finding out what your apps actually do. Remember: only weirdos and terrorists tinker.)
Certificate pinning is going away: http://www.zdnet.com/article/google-chrome-is-backing-away-f... I think we can be confident that sites that don't even use CSP won't be implementing Expect-CT any time.
In line with the age-old advice on how sausages are made, here's my advice: don't ever inspect the data leaving a mobile device. – Just as I was about to add this comment, I remembered how it's not limited to mobile devices anymore. (Thankfully with certificate pinning and integrity checking you may be spared of the risk of ever finding out what your apps actually do. Remember: only weirdos and terrorists tinker.)
Certificate pinning is going away: http://www.zdnet.com/article/google-chrome-is-backing-away-f... I think we can be confident that sites that don't even use CSP won't be implementing Expect-CT any time.
However, profiling the public key of the site a mobile app connects to and erroring out if it is compromised to prevent MitM attacks is called 'certificate pinning' for mobile apps but is not related to the HPKP pinning of browsers. A reference for certificate pinning: https://blog.netspi.com/certificate-pinning-in-a-mobile-appl...
https://en.wikipedia.org/wiki/Passenger_name_record
the entire airline industry runs on software that is about 25-30 years behind the state of the art.