14 ms·

How Airlines don’t care about privacy: Case Study Emirates.com

• kkm 9y ago
  Updates: - March 6th, 2018: Emirates responded with a standard statement. Excerpt: “The depiction in Mr Modi’s article as to what data is being shared, or customer choice in ‘opting out’ is inaccurate.” Here is my response: https://news.ycombinator.com/item?id=16532591 https://news.ycombinator.com/item?id=16532591
• crb 9y ago
  Has anyone heard of an exploit that sets people's flights to use the attackers frequent flyer number, thus collecting their miles?
  • kkm 9y ago
    Interesting thought, would be really curious to see the outcome for that. AFAIK, the link that Emirates is sharing allowed me to add my own miles number. What I am not sure is, if there is a check at the backend (Emirates side) which compares the miles number with ticket holder email ID.
  • vwcx 9y ago
    No, because in most cases the program requires the passenger's name to match the FF account name.
    • TheSpiceIsLife 9y ago
      > the program requires Except in the event of exploit of vulnerability...
    • sksksk 9y ago
      a lot of FF programmes allow transferring of miles
  • jorams 9y ago
    This[1] talk linked in the article mentions that it is happening, and that the name check is mostly useless because you can often just change the name attached to the frequent flyer number. Of course, things may have changed, but they probably haven't. [1]: https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carmen_sandiego https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carme...
• chii 9y ago
  i wonder how GDPR will affect this sort of issue.
  • __ka 9y ago
    In this case, the airline would have to get explicit consent for sharing the user's personal data with third parties. So at the very least, it will increase transparency. Post-GDPR, in the event of negligence, organizations like https://noyb.eu/ https://noyb.eu/ will become more relevant as mediums for collective action in the form of class action suits. EDIT: (Addendum) - The user would also have the right to ask the first party (airline) to "require" third parties it has shared personal data with, to delete them. Enforcing this however, will be hard.
• Arbalest 9y ago
  Yet another reason blocking ads is a must. But not just blocking ads, trackers as well. I use uMatrix and uBlock origin. Unfortunately this does nothing to deal with the aforementioned redirect chain. I suppose maybe this means it is time to go back to the telephone and flight agencies.
  • kkm 9y ago
    Some of the tracking protection tools might help, but not all for exactly the reasons you mentioned. However, you can enforce some settings in Firefox and Firefox based browsers to control referrer leakage in control. But it does break few websites. I can recommend taking a look at : https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer and see what suits your need.
    • Arbalest 9y ago
      I wonder if enabling referrer trimming by default on common browsers would force people willing to use tracking to reconsider their practices. Like everything (it seems) it is always a game of cat and mouse, and the best way to make it harder for trackers is to make sure the targets keep moving.
  • nukeop 9y ago
    There is really no way out of the redirect chain here, but if you want to avoid malicious redirects on many other websites you can use the Neat URL extension.
  • bpicolo 9y ago
    Hard to block all analytics because you can also shuffle them through as first party traffic too.
  • alok-g 9y ago
    >> I suppose maybe this means it is time to go back to the telephone and flight agencies. You would just end up paying more (directly or indirectly) while still having the representatives using the same problematic system, now from their end.
• ziikutv 9y ago
  Its funny to be reading this just a week after noticing this. Every airline uses some sort of a contractor or a shared piece of software for online checkins. You can tell by the formed URI fragments and the JSON being sent back and forth. Its all trash. I wanted to work on a business that unified all check-ins under single company. I do not think however, it is reasonable given that all of these airlines have the process, as shit as it is, for a reason.
  • dzhiurgis 9y ago
    > shared piece of software for online checkins You are probably refering to GDS - that’s been up since 1960’s: https://en.m.wikipedia.org/wiki/Computer_reservation_system#Major_systems https://en.m.wikipedia.org/wiki/Computer_reservation_system#...
  • kkm 9y ago
    I hear you, the problem is deeply rooted, in the implementation design. Even reporting these problems is such a tedious task, that you kind of feel like giving up after a certain point. Unfortunately, not just Emirates, but a huge number of e-commerce companies across industries like travel, shopping, healthcare are subjected to similar leaks.
  • tyingq 9y ago
    That's not quite right. They all (mostly) do checkin with some combinination of PNR identifier, and last/first name. There's no actual collusion though. Just coincidental settling on the same minimum need. They isn't much in common across airlines as far as the actual code goes, though. Beyond that they all use some limited set of CRS providers, like Galileo, Sabre, Amadeus, etc. That is to say, there's some common code, but it's pretty far down the stack, and only common across a few carriers. One example: https://www.nytimes.com/2017/09/28/business/airport-check-in-computer.html https://www.nytimes.com/2017/09/28/business/airport-check-in... Hit several carriers, but not all by a long stretch.
• M_Bakhtiari 9y ago
  Nothing will happen until a malicious party ends up cancelling an entire flight’s worth of passengers and it starts costing them serious money and reputation. It’s a sad state of affairs when there is no ethical way to correct certain grossly unethical business practices.
  • palmodi 9y ago
    Absolutely agree, data security is a not a priority for almost all organizations in Service Industry. Hopefully GDPR and E-Privacy will be the beginning of an era when organizations are forced to think about protecting user information.
    • amluto 9y ago
      The website sounds like a blatant GDPR violation, and GDPR has teeth.
      • yawaramin 9y ago
        I'm wondering how sharp those teeth are. What are they going to do, revoke Emirates operational licenses throughout Europe? That would not go over well with flyers...
        • PickledJesus 9y ago
          A fine of up to €20 million or up to 4% of the annual worldwide turnover, whichever is greater. Yeah there's a reason everyone's panicking about GDPR, it can seriously wreck your business.
  • drdaeman 9y ago
    > malicious party Which one? Google, Twitter, Facebook, Microsoft, Yahoo, Crazy Egg, Criteo or NSA listening on the wire? My apologies if you disagree, but I feel that the article is borderline alarmist and I believe is written in the worst possible tone to communicate the problem. Yup, there is a shitton of analytics products. Yes, PII is leaked and this needs to be fixed. But, no, it's not like listed parties (BTW, of which ek.aero is Emirates' own domain) are immediate threats. However, yes, this is quite severe as there are many scenarios when the data would eventually land in the wrong hands. E.g. if it would not considered sensitive PII anymore but treated as "just some analytics/statistics". Basically, he should have patiently communicated that despite the trust in big analytic companies, private personal information still gets sent to them (mostly indirectly - in form of session links), and this may lead to accidental security leaks. Like, for example, some subcontractor having access to "only" analytics would technically have access to much more data than they are expected to have. The article fails to do this and instead screams what's essentially boils down to "Google Analytics sees a link to the page with my passport details!". Color me surprised the support reply was not helpful at all.
• nukeop 9y ago
  Airlines don't care about privacy, security, user experience, prices... There are many things you don't have to care about when competition is low and barriers to entry are incredibly high. As an aside, turns out 9/10 decoy bombs and bladed weapons are smuggled onboard with no problems in tests. All the security theatre and voodoo rituals requiring passengers to switch off all electronic devices for no actual reasons and it's still trivial to hijack a plane.
  • toomanybeersies 9y ago
    Airlines aren't responsible for security. The rules are specified by the IATA and national agencies and security is either handled by a government department (e.g. TSA) or by the airport itself. Also, switching off electronic devices has nothing to do with security. The apparent reason is that it can cause issues with navigation, as was theorised after a plane crash in the 90's. Most flights these days don't even require you to turn your electronics off, or even put it in airplane mode. I'm fairly sure the reason that they made you turn your electronics off wasn't even for the plane, but rather to ensure that you pay attention to the safety briefing.
    • sokoloff 9y ago
      It's not just that. It's the airlines' means for complying with a specific federal law as well. https://www.law.cornell.edu/cfr/text/14/91.21 https://www.law.cornell.edu/cfr/text/14/91.21 The reason that different airlines have different rules, is that their OpSpecs have different (and sometimes evolving) treatment on portable electronic devices, which is their way, as operators, of complying with § 91.21 (shared because I suspect some will find it interesting in a random-trivia sort of way, not because I'm arguing against your post)
      • jaclaz 9y ago
        Yes, and I would add some (hopefully) "common sense" consideration. IF you were a captain, responsible for a several millions dollar aircraft and for hundreds of lives, AND IF there was a teeny-tiny, extremely low probability that using a phone (or computer or other electronic device) could cause a disaster, including the possibility of a suicide act of sabotage, how would you implement in practice the Federal Rule you cited? 1) Kindly ask the passengers to have the devices switched off. 2) Seize each and every such device before boarding, and X-ray/scan each and every passengers to be 100% sure that they don't carry with them one (hidden).
• etaioinshrdlu 9y ago
  It's technical incompetence. Emirates is a fantastic airline that treats people very well. Of course this doesn't have anything to with well engineered IT systems.
  • kkm 9y ago
    Failure to accept and acknowledge these issues needs to be sorted out.Unless these issues are treated as a technical priority, organisations will have a huge impact on service delivery issues sooner or later.
• ggm 9y ago
  I oftentimes reach for my 'call the regulator' button when I read these articles. Whats odd is how many people say "god no..." as if there was some consequential downside to using the very government entity we created (in law) to make corporate entities "do the right thing" when they don't appear to want to do it voluntarily. So.. here we go. Explain to me, why we don't want to enact law to require (through regulation) this practice to cease.
  • hermitdev 9y ago
    I'm waiting for someone to state "when you're not paying for something, you are the product", except in this case, you are paying for something, yet you're still the product. This is just...disgusting.
    • kkm 9y ago
      This comment is spot on. Do you mind if I use it as a caption on the artice aswell(with due credits)
      • propogandist 9y ago
        not at all; I don't mind
      • ggm 9y ago
        If you don't pay for it, you are the product. If you pay for it, you may still be productized. Odd that an EULA actually binds both parties, but somehow unequally? I don't think so!
    • on_and_off 9y ago
      This is why we should stop quoting that all the time. Just because you are paying for a product does not prevent your data from being sold or used in unethical ways.
      • hyperdimension 9y ago
        As much as I agree with you that we seriously have got to stop trotting out that quote all the time, the quote doesn't necessarily preclude what you point out. According to the quote, if you don't pay for it, you're definitely the product, but clearly, as you mention, just because you pay for it doesn't mean you're still not the product. Unfortunately.
• Aspos 9y ago
  > This issue is not only limited to Emirates, a lot of airlines like Lufthansa, KLM (last checked on October 2017) suffer from the same issues. Still, god bless Emirates. Hands down, best airline.
  • jsemrau 9y ago
    One story of my life: I was scheduled for a flight Singapore -> Frankfurt and wanted to avoid sitting next to a colleague. Asked at check-in the lady who was sitting next to me and got the names without hesitation. On the flight back from Frankfurt, I could not confirm the names due to privacy laws. I suppose it is a question of awareness and local practices.
• Hop_Gracer 9y ago
  What "value" are they trying to add with all these partnerships? Security issues aside, is it as simple as these companies are paying them and they don't ask questions?
• brokenmachine 9y ago
  How does one see what redirects you are being sent through? Can someone explain how I'd see all those issues that he mentioned? Just through Inspector in Firefox, or other tools?
  • kkm 9y ago
    Inspect element is a good place to start. I would suggest the following approach: 1. Open a new tab. 2. Right click inspect element and check the option to preserve logs. 3. Copy and paste the link which you want to check, 4. Preserve log will keep all the re-directions. and you can then inspect what the website is upto. There are more tools, which help you debug traffic outside browser like https://mitmproxy.org https://mitmproxy.org, Wireshark etc, but I think Inspect Element should be enough to help you reproduce the scenarios mentioned in the article.
• product50 9y ago
  I mean - after Equifax got away with leaking SSNs, Names, Addresses with DoBs of all 142M Americans - this is seriously nothing. At this point, I have become apathetic on these privacy related issues as nothing will be done.
  • 0xffff2 9y ago
    All 142m Americans?
    • lancepioch 9y ago
      Adults that have credit history, I believe.
    • sincerely 9y ago
      Yes: https://www.reuters.com/article/us-equifax-breach/equifax-failed-to-patch-security-vulnerability-in-march-former-ceo-idUSKCN1C71VY https://www.reuters.com/article/us-equifax-breach/equifax-fa...
      • 0xffff2 9y ago
        "Yes" isn't a valid answer to the question. There are a lot more than 142 million US citizens.
  • walrus01 9y ago
    https://medium.com/message/everything-is-broken-81e5f33a24e1 https://medium.com/message/everything-is-broken-81e5f33a24e1
  • rdtsc 9y ago
    Yap and their stock pretty much recovered. Worse, as you said, everyone learned: "it's actually quite alright to leak all this stuff, no need to revamp anything or worry about security, privacy and spending extra on that, you'll be just fine".
• walterbell 9y ago
  How do Expedia, Travelocity, etc. compare with airline booking sites?
  • kkm 9y ago
    Lot of the e-commerce sites are bound to similar leaks. I remember reporting similar issues to MakeMytrip.com, Expedia last year, MakeMyTrip.com was prompt enough to fix these issues. Sadly, never go any response from Expedia so not sure if they fixed the issues or not.
• dictum 9y ago
  In line with the age-old advice on how sausages are made, here's my advice: don't ever inspect the data leaving a mobile device. – Just as I was about to add this comment, I remembered how it's not limited to mobile devices anymore. (Thankfully with certificate pinning and integrity checking you may be spared of the risk of ever finding out what your apps actually do. Remember: only weirdos and terrorists tinker.)
  • asterius 9y ago
    Certificate pinning is going away: http://www.zdnet.com/article/google-chrome-is-backing-away-from-public-key-pinning-and-heres-why/ http://www.zdnet.com/article/google-chrome-is-backing-away-f... I think we can be confident that sites that don't even use CSP won't be implementing Expect-CT any time.
    • djrogers 9y ago
      Presumably GP was talking about in-app certificate pinning, not Google’s opinion of the day...
    • seanmcelroy 9y ago
      HPKP is what the article you posted to is referring to, and probably will go away completely. However, profiling the public key of the site a mobile app connects to and erroring out if it is compromised to prevent MitM attacks is called 'certificate pinning' for mobile apps but is not related to the HPKP pinning of browsers. A reference for certificate pinning: https://blog.netspi.com/certificate-pinning-in-a-mobile-application/ https://blog.netspi.com/certificate-pinning-in-a-mobile-appl...
      • asterius 9y ago
        It seems grandiose to call that 'certificate pinning' when it is just hard coding, e.g. a self-signed CA cert or (worse) a particular server cert. Makes me suspect that a lot of client side validation is happening with mobile apps.
  • 9y ago
• asterius 9y ago
  If you look at https://track.emirates.email https://track.emirates.email you will see that it isn't emirates either, but a service provided by Mandrill, an add-on for MailChimp, and the cert is valid for https://mandrillapp.com https://mandrillapp.com. Surely they could have figured out how to use SNI. The fact that your mail client / embedded browser takes you happily to sites with broken certs, giving them a tracking token (and in this case, total access to your booking) is also quite a problem.
  • kkm 9y ago
    Exactly, the fact that the url does not have any expiry (apart from the end of booking), the email providers in this case Mailchimp would also have access to the same. For the case why browser did not redirect the broken cert, that is because the link sent in the email was over http.
    • asterius 9y ago
      I tested going to a https link via gmail. On desktop chrome, it immediately opens the link (and hence passes the link parameters). On mobile it pops up a privacy error, "Attackers might be trying to steal your information" (NET::ERR_CERT_COMMON_NAME_INVALID), which is certainly the right thing to do. Still have to try it on Office365 and Outlook.
      • kkm 9y ago
        Strange, I always encounter `NET::ERR_CERT_COMMON_NAME_INVALID` even on Gmail with Chrome. What's your test setup?
        • asterius 9y ago
          Doh, you're right. I looked at the site earlier and forgot to click on the red triangle and click "re-enable warnings". Mea culpa. I checked firefox and it works correctly too.
• ksk 9y ago
  What is the definition of privacy?
• walrus01 9y ago
  airlines regularly transmit PNR info to third parties with no crypto at all, sadly, it is their default industry standard. https://en.wikipedia.org/wiki/Passenger_name_record https://en.wikipedia.org/wiki/Passenger_name_record the entire airline industry runs on software that is about 25-30 years behind the state of the art.
• AdmiralAsshat 9y ago
  I had a coworker who was flying to Morocco (I forget what airline). He called me over to his desk at some point to show me the screen as he was picking out his seat. By each occupied seat was a headshot of the passenger, pulled from what I assume was their Facebook profile. It was amazingly creepy.
  • United857 9y ago
    Sounds like KLM: https://www.klm.com/travel/us_en/prepare_for_travel/on_board/your_seat_on_board/meet_and_seat.htm https://www.klm.com/travel/us_en/prepare_for_travel/on_board... This is on a strictly opt-in basis. I guess it's an interesting alternative to Tinder if you're going to be stuck on a plane. (Disclaimer: I've never tried it myself)
    • duxup 9y ago
      Wouldn't there be an incentive to make yourself ... less pleasant looking in the hopes nobody sits next to you?
      • gesman 9y ago
        No! you'll just invite to spend 10hrs flight with a creep next to you :)
    • minimaxir 9y ago
      Apparently on Virgin Airlines there are chat rooms on the planes. Those have only two practical use cases: dating, and trolling: https://twitter.com/KrangTNelson/status/959907806622121984 https://twitter.com/KrangTNelson/status/959907806622121984
      • amorphid 9y ago
        I suspect the primary use case is talking to fellow passengers with whom you already have a relationship. But maybe not. I've never used it.
      • 9y ago
• fareesh 9y ago
  These magic URLs that can log you in automatically, generally ought to necessitate a very high degree of paranoia from whoever is implementing them. In this case the single point of failure seems like the leaky referrer, which ought to have been noticed as part of the aforementioned paranoia. I guess the problem here is that from an overall experience POV you want users to be able to get to their booking from their email without having to go back and forth to figure out their booking reference number and type it in. Even as an advanced user sometimes there is very little you can do to protect against this. In a lot of cases, blocking trackers is also a flaky solution because sometimes custom event tracking takes place as part of a JS event, and the event fails horribly due to the library not being loaded thanks to your blocker, and as a result the event doesn't do what it's supposed to, and you can't use the interface. For mobile users, blockers are either not easy to install, or exist on some fringe browser that is untested, and breaks the UI. I wonder if it is possible to measure or guess how many humans have access to your booking in such cases. Some part of the sysadmin team at each of those tracking companies, maybe product leads, customer support?
  • kkm 9y ago
    For measuring presence of trackers on popular websites, I recommend: https://whotracks.me/ https://whotracks.me/ Disclaimer: This is a project from the company I work for. (Cliqz)
  • solnyshok 9y ago
    ublock is fully functional in firefox mobile on android. I use it since v57, do not know how it was before that.
  • sorokod 9y ago
    Installing uBlock Origin on mobile Firefox is trivial.
    • joosters 9y ago
      You will still hit the same problems they described for some sites. Because some JS has been blocked by your blocker, certain websites will have buttons that just don't work. This is frustrating when those buttons are key things like 'buy' or 'confirm'.
• granshaw 9y ago
  I can easily see how this happened - Product deems that requiring a login for that page is too high a barrier and bad for business. Engineering thinks that “it ain’t so bad” since said links have a difficult to guess uuid; but of course forgot about or didn’t consider all the trackers that Marketing setup.
• netsharc 9y ago
  Hmm, no mention of luggage tags or boarding passes? Your luggage tag usually has your last name and your booking code. Those 2 bits of information are enough to login to your flight details, including your passport information. They are also on your boarding pass, also coded on the barcode, which people sometimes post online, it can also be photographed from a distance with a good enough camera.
  • arnarbi 9y ago
    FTA: Every single passenger's info is readable by a list of 20+ domains that are not Emirates. That's quite different from having to put physical eyeballs on a luggage tag.
  • kkm 9y ago
    I think you are referring to an attack similar to this: https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carmen_sandiego https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carme..., I just linked this video in the article and not the complete attack vector.
• artellectual 9y ago
  From my experience the travel industry are the worst offenders of data security. I remember making booking on booking.com and not having to pay for my booking, and I wondered how hotels can confirm bookings, when I went to check in at the hotel I asked this question to the front desk staff, and they simply told me “oh we get a fax or email from the OTA of your credit card information”. You can imagine the look on my face when that happened. Here I am building my online business using tokens with pci dss compliant payment gateway and all these businesses out there don’t even care. My lesson learned then was these industries will do anything to make it more convenient for the travelers to book, even compromise on security.
  • aj7 9y ago
    Why isn’t it the same when you hand them your credit card?
    • csours 9y ago
      Your credit card number should not persist in their system when you hand it to them, and it definitely should not be printed on hard copy. https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Sec...
  • Spooky23 9y ago
    They have to support the lowest common denominator. I worked for a company that did camping reservations. Our system for remote sites involved a ranger getting up at 4am, starting a generator and powering up a fax machine. That was seen as an improvement over travelling 40 miles to get a weekly, guaranteed useless list or the honor system and cash payments. It's like anything else, companies don't lift a finger unless it costs them money or runs them afoul of regulators.
  • John_KZ 9y ago
    I wish I had the level of audacity or ignorance these people have and send plaintext user data over http, write half-assed webapps that just look pretty but offer no security etc etc. I would be in a much better place right now from a professional point of view. But I just can't do it.
• monksy 9y ago
  This should not be a surpise. Most business types don't give a shit about anything but money. Community, social, environment, or any other negative externaliaities. They just don't care. They're after and bound to "feduciary" responsiblity. (Short term reward and ignoring long term consequences) I realize that was a moral high horse: I'm curious about how you can reward people for positive long term growth.
  • sseveran 9y ago
    It turns out that people in general buy airline tickets based almost exclusively on price. Airlines are actually showing very long term thinking given that they have very high capital costs and need to make those investments pay off in the very long run. People are rewarded in the long term with profit because they have built a business that their customers want to patronize. Even as a very technically savvy person I am not sure I would stop flying an airline because of this. While I agree these are awful practices would I be willing to do an extra hop with an airline that had better security? Nope. So while I sympathize with the article if Emirates was my main airline I would probably still fly them. It turns out many companies suck at securing their customers data. If that is important to their customers they will be reward/punished accordingly. Ironically this is one of the reasons I prefer to buy things online through Amazon and why I think they have 50% market share. They are a trusted counterparty to my transactions and I would rather buy something through them than a small companies website.
    • guitarbill 9y ago
      > It turns out that people in general buy airline tickets based almost exclusively on price > They are a trusted counterparty This is interesting, and I agree. But while I'm a big fan of quality and think there's many cases where not buying the cheapest is a good more in general, I find it hard to justify with airlines. The quality varies wildly now, and reward programs are getting more and more meaningless - often they're even pointless because you simply can't fly to that airport with a carrier in your airline alliance, or they offer a way more inconvenient flight. Sometimes, business class is only marginally better than economy (same seats, more legroom), but you couldn't tell from the cost. There are only very few airlines where business class is consistent. Why do I need to know what type of plane it is to know what business class seating is going to look like? The difference between business and first class is similarly vague. Sometimes it's worlds apart, others it's a slightly larger screen. So why take the chance for airlines that aren't Singapore/Thai/ANA (to name my favourites)? Just buy the cheapest flight, brave it, and take some unpaid vacation and maybe a massage with the money you saved to make up for the horrible experience. The only constant is flying sucks, and will suck a lot more if you can't avoid the USA. (Although the major US airports are such a shitshow that paying more to arrive/depart at a smaller airport could be worth it time-wise.)
• Too 9y ago
  That's pretty bad, but frankly he could have communicated better to Emirates. If I was working as first line support and received that message with "omg do you know you are sharing fields a, b and c to partners. And maybe you are sharing with x, y and z also?", without any technical details at all, I would also give a canned response, tag it as tinfoil hat and throw it into the junk.
  • Matheus28 9y ago
    Exactly. Twitter isn't the medium to report this sort of problem. Ask for an email address for security vulnerabilities, and send it there.
    • chmars 9y ago
      Well: «Please note that I could not find a dedicated channel for reporting security bugs on Emirates website.»
    • kkm 9y ago
      That was the first question I asked on Twitter support, to which they replied, I can report the issues here. https://cdn-images-1.medium.com/max/1600/1*VvnWUPs8xnWRtH92MJ5MWA.png https://cdn-images-1.medium.com/max/1600/1*VvnWUPs8xnWRtH92M... Again, I am more than happy to report it proper channels. I understand the reasons of ethically reporting such issues. I would really appreciate it, can you help me find correct channel even now for Emirates, Lufthansa, KLM, Air-France ?
    • palmodi 9y ago
      I guess you completely missed the paragraph titled "Reporting it to Emirates:" I will write it here for you - "In the wake of responsible behaviour, on discovering these serious security flaws that violate user-data privacy, I decided to flag them to Emirates through Twitter DM in October 2017. Please note that I could not find a dedicated channel for reporting security bugs on Emirates website. The Social Media Team immediately responded to my Twitter DM with a canned response but I was not ready to give up hope. I also wrote an email to the Product Manager highlighting the security flaws. I was met with a deafening silence."
• DyslexicAtheist 9y ago
  it raises a larger question in the industry such as what kind of internal protection do companies such as "Amadeus IT Group" have in place to prevent employees from sifting through passengers etix[¹] booking data? I had the opportunity to witness a data-scientist being able to tap into life itinerary data-stream, set up listeners and filter out anything they liked. ¹ https://en.wikipedia.org/wiki/Etix https://en.wikipedia.org/wiki/Etix
  • palmodi 9y ago
    Having worked with Amadeus IT products for airlines, I can tell you this - they are the most regressive "IT" products available in the world.
• ycombinete 9y ago
  To what degree can products like Privacy Badger, and uBlock, help with this sort of invasion?
• princekolt 9y ago
  Although I completely agree with the article, I think it's putting the bar a bit too low to expect individual privacy from a UAE based company, when they have little regard for even the basics of Human Rights[1]. [1]: https://en.wikipedia.org/wiki/Human_rights_in_the_United_Arab_Emirates https://en.wikipedia.org/wiki/Human_rights_in_the_United_Ara...
  • scrollaway 9y ago
    Ok, how about Paypal? https://twitter.com/Adys/status/943346017608585216 https://twitter.com/Adys/status/943346017608585216
    • paulie_a 9y ago
      PayPal is an awful company. If they went out of business tomorrow the world would be a better place.
      • amelius 9y ago
        https://news.ycombinator.com/item?id=16279017 https://news.ycombinator.com/item?id=16279017
• davewasthere 9y ago
  Emirates.com has changed a lot in the 18 years since I last worked on it. But I can see how this might have come about. Each 3rd party add-on is probably required by marketing in one form or another (analytics, social sharing, partner data, advertising, ). And possibly development has been done just thinking about how to do something, rather than if they should be doing something. We don't know what the gatekeepers have managed to prevent getting deployed... Part of how I see my role is to always to have a product-owner sanity-check hat on. But at the end of the day, it's the people with the wallets who decide what gets included in their outcome, even if it's against the recommendations of experts. Commercial reality sometimes trumps common sense.
  • palmodi 9y ago
    Absolutely agree with you, having been a digital marketer and later Product Manager for an Airline, I realized the ill-effects of mindlessly using tools to "crack" the secret sauce of heightened UX and hence increased revenue stream. Would I do it today? No. Would a CMO push for third party trackers? Hell, Yes. The onus lies on CTO to evaluate products, third party tools against a checklist that also covers User-Data protection as one of the bullet points.
• leroy_masochist 9y ago
  One funny thing is that Emirates makes it look like they do care about security by implementing a surprisingly onerous Captcha requirement before Skywards login. I usually get it wrong a couple of times before I can get to my account -- lots of 6s that might be Gs, partially obfuscated 8s that might be 3s, etc.
• Sir_Cmpwn 9y ago
  Browsers need to take a hardline stance on external content and stop allowing pages to load anything whatsoever from external domains. But they won't, becuase one of them is Google.
  • beart 9y ago
    Wouldn't this just lead to these websites putting everything behind a reverse proxy? That would make it harder to detect and block third party scripts.
  • pc86 9y ago
    So in addition to explaining to your parents what an SSL cert is you want to explain to them which domains should be whitelisted and which shouldn't?
    • Sir_Cmpwn 9y ago
      What does this have to do with my comment?
  • deadmetheny 9y ago
    Yeah that's exactly what we need, browsers arbitrarily deciding what content is allowed to be loaded.
    • Sir_Cmpwn 9y ago
      It would not be arbitrary, it would be well defined.
  • jstarfish 9y ago
    I agree with your sentiment but this would break every website that uses a CDN for static assets.
    • Sir_Cmpwn 9y ago
      It would, that's the point. You'd give them time to fix it, like you give notice before visually indicating HTTP is insecure or deprecating SHA-1 certificates.