3 ms·

Nothing will happen until a malicious party ends up cancelling an entire flight’s worth of passengers and it starts costing them serious money and reputation.

Nothing will happen until a malicious party ends up cancelling an entire flight’s worth of passengers and it starts costing them serious money and reputation. It’s a sad state of affairs when there is no ethical way to correct certain grossly unethical business practices.

palmodi 9y ago
Absolutely agree, data security is a not a priority for almost all organizations in Service Industry. Hopefully GDPR and E-Privacy will be the beginning of an era when organizations are forced to think about protecting user information.
- amluto 9y ago
  The website sounds like a blatant GDPR violation, and GDPR has teeth.
  - yawaramin 9y ago
    I'm wondering how sharp those teeth are. What are they going to do, revoke Emirates operational licenses throughout Europe? That would not go over well with flyers...
    - PickledJesus 9y ago
      A fine of up to €20 million or up to 4% of the annual worldwide turnover, whichever is greater. Yeah there's a reason everyone's panicking about GDPR, it can seriously wreck your business.
drdaeman 9y ago
> malicious party Which one? Google, Twitter, Facebook, Microsoft, Yahoo, Crazy Egg, Criteo or NSA listening on the wire? My apologies if you disagree, but I feel that the article is borderline alarmist and I believe is written in the worst possible tone to communicate the problem. Yup, there is a shitton of analytics products. Yes, PII is leaked and this needs to be fixed. But, no, it's not like listed parties (BTW, of which ek.aero is Emirates' own domain) are immediate threats. However, yes, this is quite severe as there are many scenarios when the data would eventually land in the wrong hands. E.g. if it would not considered sensitive PII anymore but treated as "just some analytics/statistics". Basically, he should have patiently communicated that despite the trust in big analytic companies, private personal information still gets sent to them (mostly indirectly - in form of session links), and this may lead to accidental security leaks. Like, for example, some subcontractor having access to "only" analytics would technically have access to much more data than they are expected to have. The article fails to do this and instead screams what's essentially boils down to "Google Analytics sees a link to the page with my passport details!". Color me surprised the support reply was not helpful at all.
- M_Bakhtiari 9y ago
  >Which one? Google, Twitter, Facebook, Microsoft, Yahoo, Crazy Egg, Criteo or NSA listening on the wire? Or anyone exploiting either of those parties' bad security. That's an enormous attack surface. Also add the passenger's email provider to that list.
- hooeezit 9y ago
  You missed the part where it's unencrypted HTTP traffic. So, any 'malicious party' sitting at a café with free wifi.
  - drdaeman 9y ago
    So did the message to the support, screenshotted in the article. And it's not just "any party sitting at a cafe". It specifically requires that this malicious party is sitting in the same cafe, present (physically or remotely) at the moment the site is accessed. So it's more likely to be an airport's WiFi network - which is much more probably place where an unsuspecting traveler may access such page. Hunting for a cafe with someone buying tickets from a specific airline is probably too complicated to pay off, unless the attack is personal. Anyway, I don't argue this is all very bad. It is. What I want to say is that the problem was communicated in a very poor way. And even this follow-up blog article is so light on details, a person without some security knowledge would quite likely shrug it off with an impression it's some tinfoil-hatter screaming at analytics trackers.

palmodi 9y ago

Absolutely agree, data security is a not a priority for almost all organizations in Service Industry. Hopefully GDPR and E-Privacy will be the beginning of an era when organizations are forced to think about protecting user information.

amluto 9y ago
The website sounds like a blatant GDPR violation, and GDPR has teeth.
- yawaramin 9y ago
  I'm wondering how sharp those teeth are. What are they going to do, revoke Emirates operational licenses throughout Europe? That would not go over well with flyers...
  - PickledJesus 9y ago
    A fine of up to €20 million or up to 4% of the annual worldwide turnover, whichever is greater. Yeah there's a reason everyone's panicking about GDPR, it can seriously wreck your business.

drdaeman 9y ago

> malicious party Which one? Google, Twitter, Facebook, Microsoft, Yahoo, Crazy Egg, Criteo or NSA listening on the wire? My apologies if you disagree, but I feel that the article is borderline alarmist and I believe is written in the worst possible tone to communicate the problem. Yup, there is a shitton of analytics products. Yes, PII is leaked and this needs to be fixed. But, no, it's not like listed parties (BTW, of which ek.aero is Emirates' own domain) are immediate threats. However, yes, this is quite severe as there are many scenarios when the data would eventually land in the wrong hands. E.g. if it would not considered sensitive PII anymore but treated as "just some analytics/statistics". Basically, he should have patiently communicated that despite the trust in big analytic companies, private personal information still gets sent to them (mostly indirectly - in form of session links), and this may lead to accidental security leaks. Like, for example, some subcontractor having access to "only" analytics would technically have access to much more data than they are expected to have. The article fails to do this and instead screams what's essentially boils down to "Google Analytics sees a link to the page with my passport details!". Color me surprised the support reply was not helpful at all.

M_Bakhtiari 9y ago
>Which one? Google, Twitter, Facebook, Microsoft, Yahoo, Crazy Egg, Criteo or NSA listening on the wire? Or anyone exploiting either of those parties' bad security. That's an enormous attack surface. Also add the passenger's email provider to that list.
hooeezit 9y ago
You missed the part where it's unencrypted HTTP traffic. So, any 'malicious party' sitting at a café with free wifi.
- drdaeman 9y ago
  So did the message to the support, screenshotted in the article. And it's not just "any party sitting at a cafe". It specifically requires that this malicious party is sitting in the same cafe, present (physically or remotely) at the moment the site is accessed. So it's more likely to be an airport's WiFi network - which is much more probably place where an unsuspecting traveler may access such page. Hunting for a cafe with someone buying tickets from a specific airline is probably too complicated to pay off, unless the attack is personal. Anyway, I don't argue this is all very bad. It is. What I want to say is that the problem was communicated in a very poor way. And even this follow-up blog article is so light on details, a person without some security knowledge would quite likely shrug it off with an impression it's some tinfoil-hatter screaming at analytics trackers.