Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Airlines don’t care about privacy: Case Study Emirates.com

medium.com

Post reply on HN
Print view View original

121–130 of 177 posts

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#121

Post by palmodi »

Too wrote: post #84

That's pretty bad, but frankly he could have communicated better to Emirates. If I was working as first line support and received that message with "omg do you know you are sharing fields a, b and c to partners. And maybe you are sharing with x, y and z also?" , without any technical details at all, I would also give a canned response, tag it as tinfoil hat and throw it into the junk.

I guess you missed out on this part -

"In the wake of responsible behaviour, on discovering these serious security flaws that violate user-data privacy, I decided to flag them to Emirates through Twitter DM in October 2017. Please note that I could not find a dedicated channel for reporting security bugs on Emirates website.

I also wrote an email to the Product Manager highlighting the security flaws. I was met with a deafening silence."

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#122

Post by palmodi »

crowbahr wrote: post #89
Too wrote: post #84

That's pretty bad, but frankly he could have communicated better to Emirates. If I was working as first line support and received that message with "omg do you know you are sharing fields a, b and c to partners. And maybe you are sharing with x, y and z also?" , without any technical details at all, I would also give a canned response, tag it as tinfoil hat and throw it into the junk.

He does address that though: >Please note that I could not find a dedicated channel for reporting security bugs on Emirates website I agree that he should've found an email channel but Twitter is their official customer support interaction.

He also says that he wrote an email to the Product Manager -

"I also wrote an email to the Product Manager highlighting the security flaws. I was met with a deafening silence.

So, Social media team gives a canned response and the Product Manager doesn't bother to even respond to an email just goes on to show that Data security is not their priority.

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#123

Post by palmodi »

Matheus28 wrote: post #85
Too wrote: post #84

That's pretty bad, but frankly he could have communicated better to Emirates. If I was working as first line support and received that message with "omg do you know you are sharing fields a, b and c to partners. And maybe you are sharing with x, y and z also?" , without any technical details at all, I would also give a canned response, tag it as tinfoil hat and throw it into the junk.

Exactly. Twitter isn't the medium to report this sort of problem. Ask for an email address for security vulnerabilities, and send it there.

I guess you completely missed the paragraph titled "Reporting it to Emirates:"

I will write it here for you - "In the wake of responsible behaviour, on discovering these serious security flaws that violate user-data privacy, I decided to flag them to Emirates through Twitter DM in October 2017. Please note that I could not find a dedicated channel for reporting security bugs on Emirates website.

The Social Media Team immediately responded to my Twitter DM with a canned response but I was not ready to give up hope. I also wrote an email to the Product Manager highlighting the security flaws. I was met with a deafening silence."

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#124

Post by guitarbill »

sseveran wrote: post #82
monksy wrote: post #79

This should not be a surpise. Most business types don't give a shit about anything but money. Community, social, environment, or any other negative externaliaities. They just don't care. They're after and bound to "feduciary" responsiblity. (Short term reward and ignoring long term consequences) I realize that was a moral high horse: I'm curious about how you can reward people for positive long term growth.

It turns out that people in general buy airline tickets based almost exclusively on price. Airlines are actually showing very long term thinking given that they have very high capital costs and need to make those investments pay off in the very long run. People are rewarded in the long term with profit because they have built a business that their customers want to patronize. Even as a very technically savvy person I…

> It turns out that people in general buy airline tickets based almost exclusively on price

> They are a trusted counterparty

This is interesting, and I agree. But while I'm a big fan of quality and think there's many cases where not buying the cheapest is a good more in general, I find it hard to justify with airlines.

The quality varies wildly now, and reward programs are getting more and more meaningless - often they're even pointless because you simply can't fly to that airport with a carrier in your airline alliance, or they offer a way more inconvenient flight.

Sometimes, business class is only marginally better than economy (same seats, more legroom), but you couldn't tell from the cost. There are only very few airlines where business class is consistent. Why do I need to know what type of plane it is to know what business class seating is going to look like? The difference between business and first class is similarly vague. Sometimes it's worlds apart, others it's a slightly larger screen.

So why take the chance for airlines that aren't Singapore/Thai/ANA (to name my favourites)? Just buy the cheapest flight, brave it, and take some unpaid vacation and maybe a massage with the money you saved to make up for the horrible experience.

The only constant is flying sucks, and will suck a lot more if you can't avoid the USA. (Although the major US airports are such a shitshow that paying more to arrive/depart at a smaller airport could be worth it time-wise.)

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#125

Post by jaclaz »

sokoloff wrote: post #61
toomanybeersies wrote: post #52

Earlier quoted context omitted.

Airlines aren't responsible for security. The rules are specified by the IATA and national agencies and security is either handled by a government department (e.g. TSA) or by the airport itself. Also, switching off electronic devices has nothing to do with security. The apparent reason is that it can cause issues with navigation, as was theorised after a plane crash in the 90's. Most flights these days don't even req…

It's not just that. It's the airlines' means for complying with a specific federal law as well. https://www.law.cornell.edu/cfr/text/14/91.21 The reason that different airlines have different rules, is that their OpSpecs have different (and sometimes evolving) treatment on portable electronic devices, which is their way, as operators, of complying with § 91.21 (shared because I suspect some will find it interesting i…

Yes, and I would add some (hopefully) "common sense" consideration.

IF you were a captain, responsible for a several millions dollar aircraft and for hundreds of lives, AND IF there was a teeny-tiny, extremely low probability that using a phone (or computer or other electronic device) could cause a disaster, including the possibility of a suicide act of sabotage, how would you implement in practice the Federal Rule you cited?

1) Kindly ask the passengers to have the devices switched off.

2) Seize each and every such device before boarding, and X-ray/scan each and every passengers to be 100% sure that they don't carry with them one (hidden).

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#126

Post by princekolt »

Although I completely agree with the article, I think it's putting the bar a bit too low to expect individual privacy from a UAE based company, when they have little regard for even the basics of Human Rights[1].

[1]: https://en.wikipedia.org/wiki/Human_rights_in_the_United_Ara...

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#127

Post by scrollaway »

princekolt wrote: post #126

Although I completely agree with the article, I think it's putting the bar a bit too low to expect individual privacy from a UAE based company, when they have little regard for even the basics of Human Rights[1]. [1]: https://en.wikipedia.org/wiki/Human_rights_in_the_United_Ara...

Ok, how about Paypal?

https://twitter.com/Adys/status/943346017608585216

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#128

Post by paulie_a »

scrollaway wrote: post #127
princekolt wrote: post #126

Although I completely agree with the article, I think it's putting the bar a bit too low to expect individual privacy from a UAE based company, when they have little regard for even the basics of Human Rights[1]. [1]: https://en.wikipedia.org/wiki/Human_rights_in_the_United_Ara...

Ok, how about Paypal? https://twitter.com/Adys/status/943346017608585216

PayPal is an awful company. If they went out of business tomorrow the world would be a better place.

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#129

Post by paulie_a »

joosters wrote: post #114
sorokod wrote: post #106

Earlier quoted context omitted.

Installing uBlock Origin on mobile Firefox is trivial.

You will still hit the same problems they described for some sites. Because some JS has been blocked by your blocker, certain websites will have buttons that just don't work. This is frustrating when those buttons are key things like 'buy' or 'confirm'.

Then those sites do not deserve your business

Re: How Airlines don’t care about privacy: Case Study Emirates.com

#130

Post by amelius »

paulie_a wrote: post #128
scrollaway wrote: post #127

Earlier quoted context omitted.

Ok, how about Paypal? https://twitter.com/Adys/status/943346017608585216

PayPal is an awful company. If they went out of business tomorrow the world would be a better place.

https://news.ycombinator.com/item?id=16279017
Post reply on HN