4 ms·
Airline websites don’t care about privacy follow-up: Emirates in full-on denial
- palmodi 9y agoThis is absolute abomination! They really need to get their act together.
- kkm 9y agoHopefully, they do. It's pretty weird how they themselves advice not to share the booking reference with other people and are leaking the same to the third-parties.
- palmodi 9y agoThat was indeed quite ironic. I bet the PR person did not read their own privacy policy before pointing you towards it. Pretty sure they weren't expecting you to read volumes of vague jargon and pick their follies. Well done.
- walrus01 9y agoIf you think this is bad you should see the network-engineering security practices of some gulf-state (Qatar, Kuwait, UAE, etc) telecoms and ISPs. You will cringe.
- mabbo 9y agoHere's a completely plausible and terrible idea someone nefarious could do given this vulnerability: Setup a laptop or some other small device that is listening to data being sent over Wifi at an airport. If you're feeling really brave, hide the device inside the airport, plugged in. Every time it picks up anything being sent over http to one of these insecure third parties, look for booking reference numbers and names, then automatically cancel the ticket using those two pieces of data. If you did that at a major Emirates hub, you could probably cancel a significant number of tickets, impacting the company enough to get them to actually get their act together.
- kkm 9y agoI wish the Emirates tech team understands the gravity of this problem. None of the services they are using to optimize the websites, needs this sensitive information. It's a side-effect of their implementation. But just a small correction, the third-parties are not on HTTP, it's the email link that it HTTP.
- nunez 9y agoOr you could get sued and put in jail...that's cheaper :(
- vikramadhiman 9y agowow this is shocking. i am going to watch out in future.
- kkm 9y agoAs long as you don't look at the network, it is not at all scary.
- grzm 9y agoDiscussion on initial report from 2 days ago, over 170 comments): https://news.ycombinator.com/item?id=16516687 https://news.ycombinator.com/item?id=16516687 Edited for clarification: thanks, 'kkm!
- kkm 9y agoThanks, Yes, That's the first post highlighting the issues. This follow-up post is after Emirates responded via theregister.co.uk. There were so many inaccurate things in their comment that I decided to do a complete post.
- rammy1234 9y agoNow that this is in open , is emirates site safe to use ?