The OP can report the security problem by going to https://www.alaskaair.com/content/about-us/site-info/report-... . I think this is probably the best way to get Alaska Airlines to fix the problem.
Tell HN: Alaska Airlines website exposes passenger data
31–40 of 47 posts
Re: Tell HN: Alaska Airlines website exposes passenger data
#32Earlier quoted context omitted.
I'm going to go with caching issues + interactions with Sabre backend. Also, did you know that your confirmation code, aka record locator is not globally unique? They are 6-character sequences like KZVGX5, so as you might imagine with the number for passengers flying, it doesn't take long to exhaust the namespace.
Alaska uses 6 letters. 26^6 is a bit over 300 million codes. Each year there are about 5 billion air passenger boardings, so while the whole of aviation runs through that space every 3 weeks, any individual airline takes much longer.
The letter/digit-space is per GDS, not per-airline/industry, however different airlines can have particular additional restrictions on codes. Some airlines don't allow 0 and O (i.e. Qantas), others don't allow I and 1, and others always/usually have the same ending letter (unless code-sharing).
Another thing to note is (unless something's changed in the 15 years since I left the airline industry) that non-trivial booking changes (i.e. not just passenger information changes) generally result in a new PNR being generated to replace the old one, effectively using up the old code.
Re: Tell HN: Alaska Airlines website exposes passenger data
#33Earlier quoted context omitted.
I disagree. Even support staff should be able to say "oh wow, this is really bad, let me get my supervisor", who would then recursively escalate until they get to someone who can open the correct ticket.
“Should” is doing a lot of work there. For that to actually happen support staff has to be empowered to think for themselves and also be compensated enough to care.
Agreed. Every customer support rep should be making at least $200k a year. Then they'll care about their career and quality will improve with their morale.
Re: Tell HN: Alaska Airlines website exposes passenger data
#34You need to be very, very careful about posting this, depending on your jurisdiction - in most western countries this disclosure is illegal, and you can be criminally prosecuted for providing information about accessing personal information, and you are also admitting that you knowingly accessed the personal information of other customers - in fact, airline passengers, who there are additional privacy laws for. What…
I am not a lawyer but this line of thinking does not make sense to me. First, poster did not post any personal information. Second, the poster responsibly disclosed the bug to Alaska Airlines but Alaska did not fix it. The poster is now publicly disclosing that the bug exists. Note that the poster did not include repo steps for the bug. The bottom line is we need a mechanism to ensure security bugs are fixed. Publicl…
Yeah, that’s all nice and all but it’s irrelevant in the eyes of the law.
Not posting personal information is irrelevant - that he has accessed it and admits doing so, is.
Prior disclosure is irrelevant. There’s case law that makes this clear.
Not including repro steps is irrelevant as merely disclosing the presence of a vulnerability is enough to fall foul of the CFAA, as the reasonableness test is whether a competent person could with the knowledge given reproduce the vulnerability, to which the answer is almost always yes. They also admit using the vulnerability, which is definitely a violation of the CFAA.
I agree wholeheartedly with your sentiment that this is nuts, but this is the way the law has been written and applied, and he is taking a serious risk with this disclosure.
Re: Tell HN: Alaska Airlines website exposes passenger data
#35I have connections with people at Alaska. I will send this their way and hopefully someone will reach out. Make sure there is contact info in your bio
Are you trying to get OP sent to prison?
Re: Tell HN: Alaska Airlines website exposes passenger data
#36I have connections with people at Alaska. I will send this their way and hopefully someone will reach out. Make sure there is contact info in your bio
Are you trying to get OP sent to prison?
Stop being dramatic. Most companies appreciate white hats. OP didn't divulge the exploit and is being responsible.
Re: Tell HN: Alaska Airlines website exposes passenger data
#37Re: Tell HN: Alaska Airlines website exposes passenger data
#38The OP can report the security problem by going to https://www.alaskaair.com/content/about-us/site-info/report-... . I think this is probably the best way to get Alaska Airlines to fix the problem.
You did not read before commenting. OP had already done this: https://news.ycombinator.com/item?id=42347618
Not blaming you, we all do this. Just stating a fact.
Re: Tell HN: Alaska Airlines website exposes passenger data
#39Earlier quoted context omitted.
“Should” is doing a lot of work there. For that to actually happen support staff has to be empowered to think for themselves and also be compensated enough to care.
Agreed. Every customer support rep should be making at least $200k a year. Then they'll care about their career and quality will improve with their morale.
Seems like people down-voted you for this "outrageous" opinion, but I agree. The people that do all the important work in our society (nurses, garbage collectors, cleaners, customer support, etc.) should get the highest income.
Re: Tell HN: Alaska Airlines website exposes passenger data
#40Earlier quoted context omitted.
Agreed. Every customer support rep should be making at least $200k a year. Then they'll care about their career and quality will improve with their morale.
Seems like people down-voted you for this "outrageous" opinion, but I agree. The people that do all the important work in our society (nurses, garbage collectors, cleaners, customer support, etc.) should get the highest income.
Teachers should be paid like 10x more than they do now