5 ms·
That's pretty bad, but frankly he could have communicated better to Emirates. If I was working as first line support and received that message with "omg do you
by Too 9y ago
That's pretty bad, but frankly he could have communicated better to Emirates. If I was working as first line support and received that message with "omg do you know you are sharing fields a, b and c to partners. And maybe you are sharing with x, y and z also?", without any technical details at all, I would also give a canned response, tag it as tinfoil hat and throw it into the junk.
- Matheus28 9y agoExactly. Twitter isn't the medium to report this sort of problem. Ask for an email address for security vulnerabilities, and send it there.
- chmars 9y agoWell: «Please note that I could not find a dedicated channel for reporting security bugs on Emirates website.»
- kkm 9y agoThat was the first question I asked on Twitter support, to which they replied, I can report the issues here. https://cdn-images-1.medium.com/max/1600/1*VvnWUPs8xnWRtH92MJ5MWA.png https://cdn-images-1.medium.com/max/1600/1*VvnWUPs8xnWRtH92M... Again, I am more than happy to report it proper channels. I understand the reasons of ethically reporting such issues. I would really appreciate it, can you help me find correct channel even now for Emirates, Lufthansa, KLM, Air-France ?
- palmodi 9y agoI guess you completely missed the paragraph titled "Reporting it to Emirates:" I will write it here for you - "In the wake of responsible behaviour, on discovering these serious security flaws that violate user-data privacy, I decided to flag them to Emirates through Twitter DM in October 2017. Please note that I could not find a dedicated channel for reporting security bugs on Emirates website. The Social Media Team immediately responded to my Twitter DM with a canned response but I was not ready to give up hope. I also wrote an email to the Product Manager highlighting the security flaws. I was met with a deafening silence."
- crowbahr 9y agoHe does address that though: >Please note that I could not find a dedicated channel for reporting security bugs on Emirates website I agree that he should've found an email channel but Twitter is their official customer support interaction.
- palmodi 9y agoHe also says that he wrote an email to the Product Manager - "I also wrote an email to the Product Manager highlighting the security flaws. I was met with a deafening silence. So, Social media team gives a canned response and the Product Manager doesn't bother to even respond to an email just goes on to show that Data security is not their priority.
- SSLy 9y agoProper first-line support setup makes the staff send any queries they don't understand to higher levels, not throw away.
- taurath 9y agoThe new thing now even with big travel booking companies is to have one tier of phone support that can literally only provide canned answers, and a very difficult to get to escalation to an email team that will give you a canned answer.
- palmodi 9y agoI guess you missed out on this part - "In the wake of responsible behaviour, on discovering these serious security flaws that violate user-data privacy, I decided to flag them to Emirates through Twitter DM in October 2017. Please note that I could not find a dedicated channel for reporting security bugs on Emirates website. I also wrote an email to the Product Manager highlighting the security flaws. I was met with a deafening silence."