Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

United Airlines’ so-called online security (2016)

techcrunch.com

Post reply on HN
Print view View original

21–30 of 41 posts

Re: United Airlines’ so-called online security (2016)

#21

Post by mgkimsal »

eitland wrote: post #9
walrus01 wrote: post #5

You think that's bad, there's major Canadian banks where the password for your online banking account can't be longer than 8 characters or numbers, can't contain punctuation marks, and is stored in plaintext on their backend. Edit: oh yeah, I forgot, it also doesn't recognize case sensitivity. A = a I'm assuming they're storing them in all caps, 8 character length database fields on a monstrous ancient mainframe soft…

Not quite as bad but I got a letter recently from something bank-ish (huge, international, traditional) that contained some serious admonitions including one about never using password managers or writing down the password in any way, concealed or not didn't matter. I have problems taking any security advice seriously from such companies after that but since I fully expect them to use ut against me if I ever have to…

seems to be continuing the pattern of shifting responsibility. 20 years ago, we had 'bank fraud', but now much of that same activity is 'identity theft'. This shifts the burden from 'their' problem to 'my' problem.

Re: United Airlines’ so-called online security (2016)

#22

Post by Gasparila »

I had one experience reporting a security vulnerability to United's bug bounty program and never want to do it again. I reported an issue to that I could reset anybody's MileagePlus number by only guessing a multiple choice security question ("what is your favorite sport", etc), bypassing any email confirmation or anything like that. After 3 months of back and forth with their security team, they released an Android update that patched the issue. I was then told "It turns out this fix was pushed by the QA team and was actually unrelated to your Bug Bounty submission" and that my submission was ineligible. At least they have a program I guess?

Re: United Airlines’ so-called online security (2016)

#23

Post by jrootabega »

Gasparila wrote: post #22

I had one experience reporting a security vulnerability to United's bug bounty program and never want to do it again. I reported an issue to that I could reset anybody's MileagePlus number by only guessing a multiple choice security question ("what is your favorite sport", etc), bypassing any email confirmation or anything like that. After 3 months of back and forth with their security team, they released an Android…

Thanks for sharing your experience. No one wants innocent peoples' data to be compromised, but maybe your story will do something to discourage others from participating, and United will feel the consequences as a result. Having a bug bounty program is one thing; standing behind it is another. Is there a ranking of bug bounty programs in terms of ease of use, good faith, etc?

Re: United Airlines’ so-called online security (2016)

#24

Post by solatic »

jjeaff wrote: post #12
solatic wrote: post #10

Earlier quoted context omitted.

For what it's worth, such password schemes usually include lockouts after small-N tries to prevent the passwords from being brute-forced from the outside, and an attacker with database-level access is probably going to use it not to compromise passwords but to directly change balances. Not to excuse such password schemes - they're horrible, and banks need to get with the times - but if they were really so ineffective…

Full write access to a database is a totally different thing than reading out the plaintext passwords or getting a leaked dump of the data. Perhaps a mishandled backup.

Which is one of the reasons why these schemes are horrible. But the point remains that banks are afraid of database leaks for other reasons.

Maybe think of it like this: imagine that you have an airgapped system where all the endpoints are running Windows XP (reasoning being something like hardware drivers that were written by defunct companies and can't / won't be upgraded). Is it horrible that such machines are running unsupported, EOL versions of Windows? No question. But if there are other controls in place (like airgapping, like 24/7 physical access control to the endpoints), it might still be possible to provide de-facto effective security.

Re: United Airlines’ so-called online security (2016)

#25

Post by taejo »

StreamBright wrote: post #18
moreira wrote: post #8

I've often read discussion about how you can't regulate this sort of thing because the industry moves so fast that what's a best practice today can be tomorrow's horrible security (then enforced by law). But, isn't it possible to legislate this on a blacklist basis? "Fine of up to $X if you're storing passwords in plaintext. Fine of up to $X if you're limiting the length of passwords to Outlawing a small set of easil…

You can regulate by having legislation that has 2 components. One is the law that such companies have to follow best practices. Second, best practices are created and published by a set of companies who have the best record of implementing security correctly, or even having security professionals (and there are many well respected security experts who can do this since they talk about it on their blogs all the time).

You can also regulate by having fines or substantial civil damages for breaches, requiring insurance to cover the liability, and letting the insurers figure out what practices are needed to get cheap rates.

Re: United Airlines’ so-called online security (2016)

#26

Post by koolba »

piquadrat wrote: post #13

> Two-factor authorization has a specific meaning: ... Well that was the worst place the author could have mixed up authorization and authentication... In fact, he seems to use authorization and authentication pretty much interchangeably, which kind of undermines his rant a bit...

Ha! Two-factor authorization sounds like it’d be some kind of multi-sig protocol. The digital equivalent of “Turn both keys simultaneously”.

Re: United Airlines’ so-called online security (2016)

#27

Post by kevincox »

omeid2 wrote: post #11
moreira wrote: post #8

I've often read discussion about how you can't regulate this sort of thing because the industry moves so fast that what's a best practice today can be tomorrow's horrible security (then enforced by law). But, isn't it possible to legislate this on a blacklist basis? "Fine of up to $X if you're storing passwords in plaintext. Fine of up to $X if you're limiting the length of passwords to Outlawing a small set of easil…

This kind of law would be very ineffective as they need to grand-father previously built applications and so enforcement becomes very complicated and only practical in data-breach scenarios, so might as well make laws that fines for data breach in relations to non-zero day and neglect of security by industry standards (I know it when I see it, expert opinion, et al). That is, don't legislate implementation but conseq…

Why would you need to grandfather previously built applications? It seems to be that these would be the best things to target with the law. When you pass the law include a date at which enforcement starts. Now you need to fix any in use applications.

Re: United Airlines’ so-called online security (2016)

#28

Post by dismalpedigree »

Funny enough, they did burn the building down back in the mid 90s. There was so much copper wiring that melted together that they just left the blob between the floors because it would be too hard to remove. I’m sure it has been dealt with since then with the whole wifi and cell phone issues that it would cause though. I worked there as an IT intern in the early 2000s. I vowed to never work in IT. Yet here I am. I guess the siren song was too much.

Re: United Airlines’ so-called online security (2016)

#29

Post by tapland »

jrootabega wrote: post #23
Gasparila wrote: post #22

I had one experience reporting a security vulnerability to United's bug bounty program and never want to do it again. I reported an issue to that I could reset anybody's MileagePlus number by only guessing a multiple choice security question ("what is your favorite sport", etc), bypassing any email confirmation or anything like that. After 3 months of back and forth with their security team, they released an Android…

Thanks for sharing your experience. No one wants innocent peoples' data to be compromised, but maybe your story will do something to discourage others from participating, and United will feel the consequences as a result. Having a bug bounty program is one thing; standing behind it is another. Is there a ranking of bug bounty programs in terms of ease of use, good faith, etc?

It's never good to have bugs in the wild that could risk customer information. I want to see United shape up, but I don't want regular guys to suffer for it.
Post reply on HN