5 ms·

Seemed like a bit of an odd talk for a crowd that largely flies to cons. This is mostly stuff your average FTer already knows. And for gods sake don't try addi

by ryanlol 10y ago

Seemed like a bit of an odd talk for a crowd that largely flies to cons. This is mostly stuff your average FTer already knows. And for gods sake don't try adding your frequent flier # on other peoples tickets. The airline will catch you, and unless the tickets have your name on them you aren't gonna get any miles anyway.

premium-concern 10y ago
I recommend watching the talk.
- ryanlol 10y ago
  I recommend not making comments like this on HN. I watched the entire talk days ago as it was happening and didn't see anything new or interesting in it. Record locators are short and you can scan bar codes on boarding passes was basically all of it. They also made some pretty ridiculous suggestions that simply wont work, like the proposed scheme with adding your FF# to other peoples tickets. The name on the ticket has to match yours for you to get the miles, this is the worst imaginable way of stealing them. The talk isn't terrible, it's entertaining and relatively well presented, but it certainly only provides a very basic look at these systems through the eyes of someone who clearly isn't all that familiar with them yet. It's good for a beginner but seems like it might be a bit out of place in an international conference where you'll have lots of frequent fliers who already know all of these things.
  - atomwaffel 10y ago
    > They also made some pretty ridiculous suggestions that simply wont work, like the proposed scheme with adding your FF# to other peoples tickets. The name on the ticket has to match yours for you to get the miles, this is the worst imaginable way of stealing them. You must have missed the bit in the Q&A session when they addressed this very issue. They suggested creating a new frequent flyer account in the name of the person travelling and transferring the stolen miles to your own account – or simply changing the name attached to your own account if the system permits. They also claimed to know of people who were doing this as they spoke, and their talk gives little reason to doubt them. > I watched the entire talk days ago as it was happening and didn't see anything new or interesting in it. Record locators are short and you can scan bar codes on boarding passes was basically all of it. I disagree. The (in)security of travel agency systems was something I suspected but had no evidence of, and they presented some novel, fairly clever and disturbingly feasible ways of exploiting the bruteforceability of sequential PNRs, like sending highly targetted credit card phishing emails to people with recent bookings.
    - ryanlol 10y ago
      >You must have missed the bit in the Q&A session when they addressed this very issue. >They suggested creating a new frequent flyer account in the name of the person travelling So then they end up with an account with 1 trips worth of miles on it, that'll rarely be worth anything at all. >transferring the stolen miles to your own account – Seriously? Do you have any idea how many miles you'd have to steal for that to be worthwhile. You have to pay $ to transfer miles. >or simply changing the name attached to your own account if the system permits. I can't think of anyone who permits this without a painful process, can you? >They also claimed to know of people who were doing this as they spoke, and their talk gives little reason to doubt them. Yeah, people also collect empty bottles off the streets. If you want easy cheap miles this isn't the way to do it. How about you go try it, just to be sure :)
      - thesumofall 10y ago
        >So then they end up with an account with 1 trips worth of miles on it, that'll rarely be worth anything at all. Well, a return flight FRA-SIN in First is worth 40,000 miles which is about 100 USD on most partner shops
        ryanlol 10y ago
        That's basically the functional equivalent of tying a string around a bottle and then returning it to the machine multiple times. Sure, you can successfully commit fraud and earn a few $, is it worth your time? nah.
        Nexxxeh 10y ago
        With a system you can automate? Where you could likely use a single account for everyone who shares a name? (How many John Smiths, how many Mike Davies, how many Ahmed Muhammads?) Something that could likely be coded in an afternoon and left to run on some Amazon instances that never actually get the bill paid on? I think you may be overestimating the setup cost and vastly underestimating the potential haul.

by ryanlol 10y ago

premium-concern 10y ago

I recommend watching the talk.

ryanlol 10y ago
I recommend not making comments like this on HN. I watched the entire talk days ago as it was happening and didn't see anything new or interesting in it. Record locators are short and you can scan bar codes on boarding passes was basically all of it. They also made some pretty ridiculous suggestions that simply wont work, like the proposed scheme with adding your FF# to other peoples tickets. The name on the ticket has to match yours for you to get the miles, this is the worst imaginable way of stealing them. The talk isn't terrible, it's entertaining and relatively well presented, but it certainly only provides a very basic look at these systems through the eyes of someone who clearly isn't all that familiar with them yet. It's good for a beginner but seems like it might be a bit out of place in an international conference where you'll have lots of frequent fliers who already know all of these things.
- atomwaffel 10y ago
  > They also made some pretty ridiculous suggestions that simply wont work, like the proposed scheme with adding your FF# to other peoples tickets. The name on the ticket has to match yours for you to get the miles, this is the worst imaginable way of stealing them. You must have missed the bit in the Q&A session when they addressed this very issue. They suggested creating a new frequent flyer account in the name of the person travelling and transferring the stolen miles to your own account – or simply changing the name attached to your own account if the system permits. They also claimed to know of people who were doing this as they spoke, and their talk gives little reason to doubt them. > I watched the entire talk days ago as it was happening and didn't see anything new or interesting in it. Record locators are short and you can scan bar codes on boarding passes was basically all of it. I disagree. The (in)security of travel agency systems was something I suspected but had no evidence of, and they presented some novel, fairly clever and disturbingly feasible ways of exploiting the bruteforceability of sequential PNRs, like sending highly targetted credit card phishing emails to people with recent bookings.
  - ryanlol 10y ago
    >You must have missed the bit in the Q&A session when they addressed this very issue. >They suggested creating a new frequent flyer account in the name of the person travelling So then they end up with an account with 1 trips worth of miles on it, that'll rarely be worth anything at all. >transferring the stolen miles to your own account – Seriously? Do you have any idea how many miles you'd have to steal for that to be worthwhile. You have to pay $ to transfer miles. >or simply changing the name attached to your own account if the system permits. I can't think of anyone who permits this without a painful process, can you? >They also claimed to know of people who were doing this as they spoke, and their talk gives little reason to doubt them. Yeah, people also collect empty bottles off the streets. If you want easy cheap miles this isn't the way to do it. How about you go try it, just to be sure :)
    - thesumofall 10y ago
      >So then they end up with an account with 1 trips worth of miles on it, that'll rarely be worth anything at all. Well, a return flight FRA-SIN in First is worth 40,000 miles which is about 100 USD on most partner shops
      - ryanlol 10y ago
        That's basically the functional equivalent of tying a string around a bottle and then returning it to the machine multiple times. Sure, you can successfully commit fraud and earn a few $, is it worth your time? nah.
        Nexxxeh 10y ago
        With a system you can automate? Where you could likely use a single account for everyone who shares a name? (How many John Smiths, how many Mike Davies, how many Ahmed Muhammads?) Something that could likely be coded in an afternoon and left to run on some Amazon instances that never actually get the bill paid on? I think you may be overestimating the setup cost and vastly underestimating the potential haul.