Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking the largest airline and hotel rewards platform (2023)

samcurry.net

Post reply on HN
Print view View original

71–80 of 122 posts

Re: Hacking the largest airline and hotel rewards platform (2023)

#71

Post by spi »

matteason wrote: post #41

This is only tangentially related but it always blows my mind how insecure airline booking portals are. For many (most?) airlines all you need is the booking reference (PNR number) and surname to log in and see flight itinerary, contact details and, in some cases, change or cancel the booking. No password or MFA needed. The kicker is that your PNR number and surname are encoded in the barcode on your boarding pass, e…

I know this is HN and here it's not a popular opinion, but maximum security is _not_ always a good idea. Even setting aside the problem of many different actors having to access these details mentioned below, there's value in a simple login process. Specifically for airplane tickets, the most common ones I had to struggle with multiple times are retrieving reservations bought from a different computer, or by a travel agency. In all these situations, it was exactly the simple approach that saved me. If 2FA was mandatory, the best case scenario was that the travel agency would have to send you a separate e-mail with details about how to access their portal where this 2FA would somehow work. The number of systems multiplies, the number of credentials to remember does, as well. If you are not from your usual workplace (and chances are, if you are travelling, you are not) or from a shaky connection (same), you are in a real problem. In a time-critical scenario, which makes it really worse.

Implementing a "secure" connection here would be a sure road for pain ahead, at least it would need the airplane company to increase customer support a lot, and likely a lot of bad publicity every time something fails. Delays cost money, especially in this industry. And what would you get for that? The safety that, if you publish a picture of your reservation / boarding pass online, nobody can log in with your credentials and cancel your flight? That's a rather niche and very targeted risk, which is better handled by a single customer support agent who, simply, issues you a new ticket.

(by the way, by the time you have checked in and your boarding pass has been issued, a lot of companies just don't allow you to cancel anymore, so it's really a non-issue?)

Re: Hacking the largest airline and hotel rewards platform (2023)

#72

Post by lowercased »

matteason wrote: post #41

This is only tangentially related but it always blows my mind how insecure airline booking portals are. For many (most?) airlines all you need is the booking reference (PNR number) and surname to log in and see flight itinerary, contact details and, in some cases, change or cancel the booking. No password or MFA needed. The kicker is that your PNR number and surname are encoded in the barcode on your boarding pass, e…

It's worse with some. A recent trip had me create an account with an airline - I can log in and see my trips, points, name, etc... but to see the itinerary, I have to have the PNR number, which isn't anywhere in the authenticated portal area. It's only delivered by email, once AFIACT. I thought I'd lost it at first - couldn't find it for a while (went to spam apparently).

But... if I'm logged in via user/pass... why would this notion of 'view your itinerary' NOT be available? What security benefit is there? None as far as I could see.

Re: Hacking the largest airline and hotel rewards platform (2023)

#73

Post by interludead »

matteason wrote: post #41

This is only tangentially related but it always blows my mind how insecure airline booking portals are. For many (most?) airlines all you need is the booking reference (PNR number) and surname to log in and see flight itinerary, contact details and, in some cases, change or cancel the booking. No password or MFA needed. The kicker is that your PNR number and surname are encoded in the barcode on your boarding pass, e…

It's overlooked security issue in the airline industry. Yet I still haven't encountered such data theft stories (I mean personally)

Re: Hacking the largest airline and hotel rewards platform (2023)

#74

Post by [deleted] »

matteason wrote: post #41

This is only tangentially related but it always blows my mind how insecure airline booking portals are. For many (most?) airlines all you need is the booking reference (PNR number) and surname to log in and see flight itinerary, contact details and, in some cases, change or cancel the booking. No password or MFA needed. The kicker is that your PNR number and surname are encoded in the barcode on your boarding pass, e…

[deleted]

Re: Hacking the largest airline and hotel rewards platform (2023)

#75

Post by samsonradu »

ddorian43 wrote: post #54
shakna wrote: post #51

Earlier quoted context omitted.

That's precisely why the cookie should just be an identifier, that you look up group info from the database. Because you can guarantee the cookie contents will be modified by someone at some point. Make it useful to you, useless to them.

By default flask doesnt have a db. There is flask-sessions extensiom that does this for you.

Can't session data be stored on disk? that's the default PHP behavior.

Re: Hacking the largest airline and hotel rewards platform (2023)

#76

Post by ddorian43 »

samsonradu wrote: post #75
ddorian43 wrote: post #54

Earlier quoted context omitted.

By default flask doesnt have a db. There is flask-sessions extensiom that does this for you.

Can't session data be stored on disk? that's the default PHP behavior.

Because you might have multiple webservers.

Re: Hacking the largest airline and hotel rewards platform (2023)

#77

Post by remus »

toyg wrote: post #46
remus wrote: post #38

Earlier quoted context omitted.

It's a strange disconnect between the quality of the incident response and the extremely basic nature of many of the bugs reported. I mean SECRET_KEY='secret'?! Seriously straightforward stuff.

Why? One depends on development practices, the other on security-team practices. You can have a team of donkeys building a product and the sharpest hackers guarding it. Ideally best practices would trickle down, but that's not a given.

> You can have a team of donkeys building a product and the sharpest hackers guarding it.

You could do but it's a pretty risky way to run a business. Obviously the real world often gets in the way, but a competent manager would look at that org structure and say "shouldn't we move some of those smart ppl on to the build team to catch issues before they're in prod? Seems awfully risky waiting until it's live to catch these bugs which could cause us massive financial harm"

Re: Hacking the largest airline and hotel rewards platform (2023)

#78

Post by IggleSniggle »

fer wrote: post #53
matteason wrote: post #41

This is only tangentially related but it always blows my mind how insecure airline booking portals are. For many (most?) airlines all you need is the booking reference (PNR number) and surname to log in and see flight itinerary, contact details and, in some cases, change or cancel the booking. No password or MFA needed. The kicker is that your PNR number and surname are encoded in the barcode on your boarding pass, e…

The issue here is interoperability. PNR identifier and last name is the only reasonable key to use when a single PNR is meant to be shared among the GDS, the IT provider, the traveler and companions, hotels, car rentals companies, travel agencies and countless other players in the market (sometimes several of each at the same time). But it's also true it relies on the traveler keeping the PNR reference secret. Adding…

You can only imagine the pain of having a "-" in your last name, when some documents accept spaces but not hyphens, and some accept hyphens but not spaces, and some accept neither, and some require other identifying documents to match each other...

I imagine this is the sort of thing that makes these stay so open. If my flight is cancelled and rebooked with a partner, but my id says "Last-Name" and my boarding pass says "LastName" and for some reason I'm in the system as just "Name," then it's really nice the I can still make it on my next flight departing in 10 minutes.

Re: Hacking the largest airline and hotel rewards platform (2023)

#79

Post by fer »

IggleSniggle wrote: post #78
fer wrote: post #53

Earlier quoted context omitted.

The issue here is interoperability. PNR identifier and last name is the only reasonable key to use when a single PNR is meant to be shared among the GDS, the IT provider, the traveler and companions, hotels, car rentals companies, travel agencies and countless other players in the market (sometimes several of each at the same time). But it's also true it relies on the traveler keeping the PNR reference secret. Adding…

You can only imagine the pain of having a "-" in your last name, when some documents accept spaces but not hyphens, and some accept hyphens but not spaces, and some accept neither, and some require other identifying documents to match each other... I imagine this is the sort of thing that makes these stay so open. If my flight is cancelled and rebooked with a partner, but my id says "Last-Name" and my boarding pass s…

My name almost always gets trimmed. Here you can see a bit of the interoperational hell: https://xx1.pass-consulting.com/documentation/xx1-travel-sdk...

The tech in the travel industry is cursed, and the pay is bad. Do not recommend.

Re: Hacking the largest airline and hotel rewards platform (2023)

#80

Post by samsonradu »

ddorian43 wrote: post #76
samsonradu wrote: post #75

Earlier quoted context omitted.

Can't session data be stored on disk? that's the default PHP behavior.

Because you might have multiple webservers.

There are solutions for that: Shared NAS, sticky sessions etc.
Post reply on HN