Live data from Hacker News

How Airlines don’t care about privacy: Case Study Emirates.com

medium.com

111–120 of 177 posts

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#111
post #105

Earlier quoted context omitted.

Well, the General Data Protection Regulation (GDPR) will become enforceable in May (for all people in the EU). As far as I understand, Emirates is risking big fines if they they don't fix this by May 25.

Even though they are not based out of EU and only operate in EU?

If they sell to EU customers, then yes, they have to abide by the EU privacy regulations. Alternatively, they can set up a website just for EU customers or stop serving them altogether.

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#112
post #105

Earlier quoted context omitted.

Well, the General Data Protection Regulation (GDPR) will become enforceable in May (for all people in the EU). As far as I understand, Emirates is risking big fines if they they don't fix this by May 25.

Even though they are not based out of EU and only operate in EU?

Where they are based doesn't matter. If they are collecting revenues (taking payments) from EU clients, it applies. That includes generating ad revenues from EU based eyeballs. When it comes to on-ad-generating, free websites, it remains to be seen how bold EU regulators get. It'll be hard to penalize or prosecute such websites, and there are enough violations in the fat cats anyway, so I'm guessing those free websites will get a free pass for now (pun intended).

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#113
post #13

I oftentimes reach for my 'call the regulator' button when I read these articles. Whats odd is how many people say "god no..." as if there was some consequential downside to using the very government entity we created (in law) to make corporate entities "do the right thing" when they don't appear to want to do it voluntarily. So.. here we go. Explain to me, why we don't want to enact law to require (through regulatio…

I oftentimes reach for my 'call the regulator' button when I read these articles. And what regulator is that? Does Dubai even have a "regulator" overseeing stuff like this? Emirates is wholly owned by the government of Dubai. So basically you would be complaining about one Dubai government agency to another Dubai government agency. Perhaps you could complain about this to some US or EU regulator? Would they care enou…

Emirates gets a big chunk of their revenues from EU customers. They definitely don't want to piss of EU regulators. As for US regulators, they've been at odds with them for some time, so Emirates will probably try to fight them before giving in. But this particular privacy hole is the size of a crater - it will be hard to fight the regulators. In fact, as a software architect, I feel that the solution is far cheaper than fighting regulators.

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#114
post #47

These magic URLs that can log you in automatically, generally ought to necessitate a very high degree of paranoia from whoever is implementing them. In this case the single point of failure seems like the leaky referrer, which ought to have been noticed as part of the aforementioned paranoia. I guess the problem here is that from an overall experience POV you want users to be able to get to their booking from their e…

Installing uBlock Origin on mobile Firefox is trivial.

You will still hit the same problems they described for some sites. Because some JS has been blocked by your blocker, certain websites will have buttons that just don't work. This is frustrating when those buttons are key things like 'buy' or 'confirm'.

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#115

Earlier quoted context omitted.

Sounds like KLM: https://www.klm.com/travel/us_en/prepare_for_travel/on_board... This is on a strictly opt-in basis. I guess it's an interesting alternative to Tinder if you're going to be stuck on a plane. (Disclaimer: I've never tried it myself)

Apparently on Virgin Airlines there are chat rooms on the planes. Those have only two practical use cases: dating, and trolling: https://twitter.com/KrangTNelson/status/959907806622121984

I used the chat on a KLM flight to Canada recently, it was neat. You could also chat with a specified seat number, and they would get a popup on their screen that you want to initiate chat - it was very useful as there was a large group of us travelling together and I could just chat with someone without walking to their seat on the other end of the plane.

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#116
post #105

Earlier quoted context omitted.

Well, the General Data Protection Regulation (GDPR) will become enforceable in May (for all people in the EU). As far as I understand, Emirates is risking big fines if they they don't fix this by May 25.

Even though they are not based out of EU and only operate in EU?

They're taking money from EU customers, so yes the EU will enforce.

They have assets (and even more, they want to land in EU airports) in the EU so yes the EU can force them to comply even if they don't want to.

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#117

From my experience the travel industry are the worst offenders of data security. I remember making booking on booking.com and not having to pay for my booking, and I wondered how hotels can confirm bookings, when I went to check in at the hotel I asked this question to the front desk staff, and they simply told me “oh we get a fax or email from the OTA of your credit card information”. You can imagine the look on my…

I use agoda.com over booking.com for this very reason: it lets me pay with paypal. If you care about that sort of things, I suggest you do too.

Of course, you then have to provide your credit card or another mean of payment to the hotel on arrival for insurance.

PS: and this is pretty much the why of how something as reviled by merchants as paypal is thriving, as a customer I love it.

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#118

Earlier quoted context omitted.

The quote is not wrong. If you aren't paying for something, then 100% of the time you are the product. If you are paying for something, then <100% of the time you are also the product.

I don't pay for wikipedia (actually I do via donations and edits but that's not the point) but I don't see anything bad about their BM.

But Wikipedia is run by a non-profit organization...

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#119

Nothing will happen until a malicious party ends up cancelling an entire flight’s worth of passengers and it starts costing them serious money and reputation. It’s a sad state of affairs when there is no ethical way to correct certain grossly unethical business practices.

> malicious party Which one? Google, Twitter, Facebook, Microsoft, Yahoo, Crazy Egg, Criteo or NSA listening on the wire? My apologies if you disagree, but I feel that the article is borderline alarmist and I believe is written in the worst possible tone to communicate the problem. Yup, there is a shitton of analytics products. Yes, PII is leaked and this needs to be fixed. But, no, it's not like listed parties (BTW,…

>Which one? Google, Twitter, Facebook, Microsoft, Yahoo, Crazy Egg, Criteo or NSA listening on the wire?

Or anyone exploiting either of those parties' bad security. That's an enormous attack surface. Also add the passenger's email provider to that list.

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#120
post #84

That's pretty bad, but frankly he could have communicated better to Emirates. If I was working as first line support and received that message with "omg do you know you are sharing fields a, b and c to partners. And maybe you are sharing with x, y and z also?" , without any technical details at all, I would also give a canned response, tag it as tinfoil hat and throw it into the junk.

Exactly. Twitter isn't the medium to report this sort of problem. Ask for an email address for security vulnerabilities, and send it there.

That was the first question I asked on Twitter support, to which they replied, I can report the issues here. https://cdn-images-1.medium.com/max/1600/1*VvnWUPs8xnWRtH92M...

Again, I am more than happy to report it proper channels. I understand the reasons of ethically reporting such issues.

I would really appreciate it, can you help me find correct channel even now for Emirates, Lufthansa, KLM, Air-France ?

Post reply on HN