41–47 of 47 posts
Earlier quoted context omitted.
“Should” is doing a lot of work there. For that to actually happen support staff has to be empowered to think for themselves and also be compensated enough to care.
Agreed. Every customer support rep should be making at least $200k a year. Then they'll care about their career and quality will improve with their morale.
You need to be very, very careful about posting this, depending on your jurisdiction - in most western countries this disclosure is illegal, and you can be criminally prosecuted for providing information about accessing personal information, and you are also admitting that you knowingly accessed the personal information of other customers - in fact, airline passengers, who there are additional privacy laws for. What…
Earlier quoted context omitted.
I am not a lawyer but this line of thinking does not make sense to me. First, poster did not post any personal information. Second, the poster responsibly disclosed the bug to Alaska Airlines but Alaska did not fix it. The poster is now publicly disclosing that the bug exists. Note that the poster did not include repo steps for the bug. The bottom line is we need a mechanism to ensure security bugs are fixed. Publicl…
Yeah, that’s all nice and all but it’s irrelevant in the eyes of the law. Not posting personal information is irrelevant - that he has accessed it and admits doing so, is. Prior disclosure is irrelevant. There’s case law that makes this clear. Not including repro steps is irrelevant as merely disclosing the presence of a vulnerability is enough to fall foul of the CFAA, as the reasonableness test is whether a compete…
I have connections with people at Alaska. I will send this their way and hopefully someone will reach out. Make sure there is contact info in your bio
Are you trying to get OP sent to prison?
Earlier quoted context omitted.
I don't think it's realistic to expect airline support staff to know how to properly classify and route web vulnerabilities. Giving someone points is just a way to get them to go away so the ticket can be closed.
I disagree. Even support staff should be able to say "oh wow, this is really bad, let me get my supervisor", who would then recursively escalate until they get to someone who can open the correct ticket.
Most companies don't give them the training, autonomy, problem solving tools, or even buy-in to deal with something like this.
When I call in I expect them to be able to change my reservation and handle seat changes and such. I don't expect them to be able to triage a tech support call and tell the difference in severity between, say, a shared computer with somebody else's login, a browser caching issue, a database hack, a proxy or CDN issue, etc.
Earlier quoted context omitted.
Originally the PNR when the reservation systems where built in the 1960’s and 70’s the six / seven / eight digit reference was the hash of the physical location in memory of the booking. It would take very few cpu cycles to recall the booking. Nowadays of course the booking reference is virtual.
Should I read this as a reversible hash? I can't imagine it works this way, have you got any pointers to learn more about early sabre ?