7 ms·
It's worth noting that everything mentioned in the article except the full frequent flyer number is also printed in ASCII on the boarding pass.
by pcl 11y ago
It's worth noting that everything mentioned in the article except the full frequent flyer number is also printed in ASCII on the boarding pass.
- carterehsmith 11y agoSure, but the frequent flyer number is apparently not well protected: "Not only could I see this one flight, but I could see ANY future flights that were booked to his frequent flyer number from the Star Alliance.”"
- monochromatic 11y agoThe frequent flyer number seems to be the piece that gives away the keys to the kingdom.
- ajdlinux 11y agoEven if the FF number were not printed on the boarding pass, the booking reference/PNR and surname are generally enough to log in and retrieve the FF number from the booking.
- ubernostrum 11y agoDepends on the airline. US-based airlines tend to require an actual password to access the account and see future flights, spend miles on redemptions, and so on (I have accounts, currently, with four different US-based carriers, and all of them require a password for account access). The confirmation code and passenger name are enough to make changes to that reservation, though; if you know someone's code + name you can cancel the return segment of their journey, for example. I'm wondering if the person being quoted was confused by seeing the return segments of a multi-segment trip (which are part of a single reservation, and would come up with just the information on the boarding pass), and thought it was actually full account access.
- CaptainZapp 11y agoI'm wondering if the person being quoted was confused by seeing the return segments of a multi-segment trip I wondered that too. I'm a Miles & More member via Swiss (which is part of the Lufthansa group) and you definitely need a password / pin to access your FF account. Accessing a specific booking via booking code / surname is a whole different issue.
- ajdlinux 11y agoMy regular airline is Qantas, which prints the full frequent flyer number on the boarding pass, but not the PNR/booking reference.
- hugh4 11y agoQantas assigns FF numbers sequentially -- mine was in the first million so it's six digits. So any number is associated with someone's account. Other schemes seem to assign only a tiny fraction of possible codes, which is why my Starwood number is twelve digits long. I don't see any reason why they should do that.
- ajdlinux 11y agoThey've changed - new QFF accounts are something like 10 or 12 digits long. (I'm 7 digits myself.)
- nnd 11y agoWhich is not usually the case. At least for Start Alliance members I see my FFN printed on tickets.
- cnvogel 11y agoBut from a social/human perspective: some semi-data-conscious people have been known to upload pictures with only the human readable print redacted, but with the barcode left intact. Also oome people might tear the boarding pass into many pieces so that name, flight,... can't be associated. But the barcode is relatively small. It might still be readable in one piece.
- mabcat 11y agoVirgin Australia prints the PNR and frequent flyer number in plaintext. I scanned a recent VA boarding pass with a PDF417 scanner, and amongst all the other stuff is 16 characters without an obvious meaning. The boarding pass in the article had a similar region, and another longer one. It would have been interesting for the article to have pulled those apart.
- SmellyGeekBoy 11y agoVirgin's security is a joke. Their Flying Club (frequent flyer points) website stores passwords in plaintext! Not to mention the ridiculous restrictions they put on the username / password fields in the first place.