Earlier quoted context omitted.
Use "password" - eight letters and it's English and so should be safe on a Spanish site.
You missed that we're only allowed to use digits/numbers. No letters!
72779673
EasyJet admits a cyber-attack has affected approximately nine million customers
111–120 of 164 posts
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#112Earlier quoted context omitted.
Partner had trouble doing an online check-in with EasyJet. Some kind of error. Arrived at the airport to be told that even though she has the ticket, she does not have a place. There were ~5 people with her in the same situation. 4 other people did not show up for the flight, so some of them got a seat after all. My partner did not, spent the night in the airport. Took about a year and loads of calling to get a compe…
Overbooking is actually incredibly common. Every flight has some number of passengers not show up. Airlines prefer to compensate one or two people for the fact that they didn't get a seat, instead of leaving some number of seats empty. Getting compensated should be practically instant though, and definitely not take a year, so something went terribly wrong there.
Another anecdote. I had a EU Lufthansa flight that was cancelled a few hours before departure. That's 600 euros compensation no questions asked, in theory. When transfering the compensation, there was some kind of hiccup with the banks and it didn't arrive. It took me more than 6 months and more than 30 emails with customer service to get the compensation resent. 90% of the replies were "accounting says funds were sent; not our problem". Ended up using EU's out-of-court customer resolution system (recommended): I think that's what caused them to finally react.
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#113Earlier quoted context omitted.
good luck buying a plane ticket from easyjet without giving them your CC info
Some banks can generate a virtual CC ad-hoc, so you could have different CC details per each transaction. It's rare, I wish my bank did it, but it exists.
> I wish my bank did it
You can just use something like Privacy.com to accomplish the same thing.
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#114Earlier quoted context omitted.
Unless you are being sued by the bank as the one who stole the money and this happens in another country and the time to claim your innocence is out. Then it’s you who suffers the fraud, not the bank :/ (talking from personal experience of a close friend)
Yes, I had something similar happening. Did your friend get anything paid out? It's still hurting me while it happened many years ago.
Unfortunately, my friend is not able to enter the said country where he once was a resident anymore. Without spending tens of thousands dollars without clear promise of success it seems impossible to resolve this. Perhaps after some long time the debt to bank is cleared. In reality, it is actually the bank that should be sued for all this – they haven’t checked identity properly before giving out loans worth of tens of thousands $. It is not impossible that the bank employee is part of this. I am talking about the state of Israel, btw.
The summary is: fraudster with fake ID featuring real data of my friend but fake photo managed to get loans and credit cards from several banks/companies. Since my friend lef the country, he was not getting any of the post. After years these orgs opened collection cases against my friend. Since he was not in the country, the courts have judged him as debt-evader and allowed collection agency to act against him.
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#115Is it the case for anyone else that your login data is not invalidated? You’d think someone in their org would realize at least to invalidate the auth data?
I managed to sign in without a problem :/
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#116I just logged in to change my easyJet password: > Your password must be a single word between 6 and 20 characters in length and must not include the special characters # & + or space. Come on! This is ridiculous. If you're going to get hacked at least have a sane password policy.
Doesn't a max length suggest that they are storing passwords rather than hashes?
Sure could be, but to play devils advocate maybe not, some hashing libraries have limits (silent truncation or otherwise) and/or it could be reasonable not to allow users to make the backend hash strings of unbounded length.
These specific limitations indicate that it's more likely to be something bad however, it's funny because I remember adding EasyJet to https://github.com/dumb-password-rules/dumb-password-rules/p... last year.
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#117it still baffles me everytime why they wait for so long to admit it, and why there's no accountability for such incompetence.
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#118Any customer data, and especially PII, needs to be toxic. The toxicity needs to increase super-linearly with the total amount of data, because the value of leak does, too, while the difficulty of the breach probably does not. It needs to be so expensive to store extensive data of millions of people that companies (or for that matter, the government) cannot wait to get rid of it. Currently, most online shops nudge me…
This is how I’m building my startup[1]. All data stays with the customer and we actively don’t want it, because that’s how I wish all my products worked. I suspect you will see more startups who treat data more respectfully in the future, as the next wave of founders have experienced the consequences of unrestricted data collection.
Having said that, I also think a large part of the problem is that treating data like toxic waste is hard. There are more established patterns for data collection than data destruction. How do you know when it’s safe to delete some piece of data? What if the user comes back and complains about a transaction after you’ve deleted the associated data?
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#119> EasyJet said it first became aware of the attack in January. vs > The GDPR introduces a duty on all organisations to report certain types of personal data breach to the relevant supervisory authority. You must do this within 72 hours of becoming aware of the breach, where feasible. So either EasyJet was delayed in their reporting of the breach, or the ICO didn't feel it was urgent to notify 9 million people that th…
Their official statement says > we took immediate steps to respond to and manage the incident and engaged leading forensic experts to investigate the issue. We also notified the National Cyber Security Centre and the ICO. We have closed off this unauthorised access. Maybe the relevant supervising authority didn't find it important to notify those 9 million customers.
> Maybe the relevant supervising authority didn't find it important to notify those 9 million customers.
Which is a problem right? Now it emerges what has been breached. Including credit card data. Surely the prudent thing would have been to warn all their customers immediately to allow them to be on the lookout for malicious use of their data (phishing, etc.) and not wait until they have concluded their investigation.
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#120Earlier quoted context omitted.
Is there a technical reason to use a GET for authentication? I've always seen it as a POST. If you use GET, won't your parameters be plainly visible in well, everything, unless they put them in the body and that's a whole nother can of worms.
No, https encrypts the URL as well (although the domain itself can be leaked via DNS). But in most respects query params are no different to the body security wise. The main difference is that if you bookmark it, you may end up storing your sensitive data in your bookmarks.
Query params often end in stuff like web server (WAF, load-balancer, reverse proxy, ...) access logs and they might get accidentally exposed.
They shouldn't get exposed of course, but they do. [EDIT: redacted an example of some random dude's access log]
If you search for "password" in there you will likely see a new Mirai bot variant [1] bouncing credentials off the server looking for weblogin.cgi on vulnerable Zyxel devices.
I imagine PA highlit this detail in their post ("weblogin.cgi accepts both HTTP GET and POST") exactly to ensure sure defenders don't restrict themselves to blocking or investigating only the more normal POST mechanism.
[1] https://unit42.paloaltonetworks.com/new-mirai-variant-mukash...