4 ms·

> They also made some pretty ridiculous suggestions that simply wont work, like the proposed scheme with adding your FF# to other peoples tickets. The name on

> They also made some pretty ridiculous suggestions that simply wont work, like the proposed scheme with adding your FF# to other peoples tickets. The name on the ticket has to match yours for you to get the miles, this is the worst imaginable way of stealing them. You must have missed the bit in the Q&A session when they addressed this very issue. They suggested creating a new frequent flyer account in the name of the person travelling and transferring the stolen miles to your own account – or simply changing the name attached to your own account if the system permits. They also claimed to know of people who were doing this as they spoke, and their talk gives little reason to doubt them. > I watched the entire talk days ago as it was happening and didn't see anything new or interesting in it. Record locators are short and you can scan bar codes on boarding passes was basically all of it. I disagree. The (in)security of travel agency systems was something I suspected but had no evidence of, and they presented some novel, fairly clever and disturbingly feasible ways of exploiting the bruteforceability of sequential PNRs, like sending highly targetted credit card phishing emails to people with recent bookings.

ryanlol 10y ago
>You must have missed the bit in the Q&A session when they addressed this very issue. >They suggested creating a new frequent flyer account in the name of the person travelling So then they end up with an account with 1 trips worth of miles on it, that'll rarely be worth anything at all. >transferring the stolen miles to your own account – Seriously? Do you have any idea how many miles you'd have to steal for that to be worthwhile. You have to pay $ to transfer miles. >or simply changing the name attached to your own account if the system permits. I can't think of anyone who permits this without a painful process, can you? >They also claimed to know of people who were doing this as they spoke, and their talk gives little reason to doubt them. Yeah, people also collect empty bottles off the streets. If you want easy cheap miles this isn't the way to do it. How about you go try it, just to be sure :)
- thesumofall 10y ago
  >So then they end up with an account with 1 trips worth of miles on it, that'll rarely be worth anything at all. Well, a return flight FRA-SIN in First is worth 40,000 miles which is about 100 USD on most partner shops
  - ryanlol 10y ago
    That's basically the functional equivalent of tying a string around a bottle and then returning it to the machine multiple times. Sure, you can successfully commit fraud and earn a few $, is it worth your time? nah.
    - Nexxxeh 10y ago
      With a system you can automate? Where you could likely use a single account for everyone who shares a name? (How many John Smiths, how many Mike Davies, how many Ahmed Muhammads?) Something that could likely be coded in an afternoon and left to run on some Amazon instances that never actually get the bill paid on? I think you may be overestimating the setup cost and vastly underestimating the potential haul.

ryanlol 10y ago

>You must have missed the bit in the Q&A session when they addressed this very issue. >They suggested creating a new frequent flyer account in the name of the person travelling So then they end up with an account with 1 trips worth of miles on it, that'll rarely be worth anything at all. >transferring the stolen miles to your own account – Seriously? Do you have any idea how many miles you'd have to steal for that to be worthwhile. You have to pay $ to transfer miles. >or simply changing the name attached to your own account if the system permits. I can't think of anyone who permits this without a painful process, can you? >They also claimed to know of people who were doing this as they spoke, and their talk gives little reason to doubt them. Yeah, people also collect empty bottles off the streets. If you want easy cheap miles this isn't the way to do it. How about you go try it, just to be sure :)

thesumofall 10y ago
>So then they end up with an account with 1 trips worth of miles on it, that'll rarely be worth anything at all. Well, a return flight FRA-SIN in First is worth 40,000 miles which is about 100 USD on most partner shops
- ryanlol 10y ago
  That's basically the functional equivalent of tying a string around a bottle and then returning it to the machine multiple times. Sure, you can successfully commit fraud and earn a few $, is it worth your time? nah.
  - Nexxxeh 10y ago
    With a system you can automate? Where you could likely use a single account for everyone who shares a name? (How many John Smiths, how many Mike Davies, how many Ahmed Muhammads?) Something that could likely be coded in an afternoon and left to run on some Amazon instances that never actually get the bill paid on? I think you may be overestimating the setup cost and vastly underestimating the potential haul.