3 ms·

Additionally, the MIQ system enables an unlimited number of bookings to be made with a SINGLE email address. There are multiple issues with the booking system

Additionally, the MIQ system enables an unlimited number of bookings to be made with a SINGLE email address. There are multiple issues with the booking system which enable this. I’ve notified them of these issues multiple times, they did nothing. It then became news, and was reported publicly multiple times, and still there were no changes. Before this vulnerability was widely known making a booking was not all that difficult. After it became widely known there was not a single booking available in the system. Go figure.

yardstick 6y ago
Have you tried making multiple bookings in the same account or multiple emails since Feb? They seem to have a job that checks for duplicate bookings (based on email and/or names/passports) and emails you to warn you if you don’t remove the excess bookings they will cancel all of them. Don’t actually know if they follow through with it... Yeah the system is broken. Lots of people were running tools to automate bookings in order to find and secure a date, given how quickly they get snapped up. It’s marginally harder now they are using a captcha.
- RileyJames 6y ago
  Interesting. I didn't attempt holding actual booking for longer than an hour, because I didn't want to take spots away from people. But while they stated they would cancel duplicate bookings at the time, that's only regarding confirmed bookings. A user can still hold a booking for 48 hours while "booking flights", and with a 48 hour window its easy enough to time the release of said booking at the lowest volume booking period and attempt to snap it back up within few seconds with a second account. Additionally, there is no validation beyond the email address. Name & passport are simple string fields, and you can have many different names / passports under a single account. That's all before you go all out and make 100's - 1000's of accounts. I'm being a bit harsh, I was generally impressed with the quality of the booking system and how quickly they got it up. But once it's been out for a few months, and the cracks are starting to appear AND those crack become public it's just not good enough. It becomes another class based system where: Priority 1) those with contacts within the department / ministry or some other method of getting special treatment Priority 2) those who can bot / exploit the system to get what they need Priority 3) those willing to pay to access priority 1 or 2. Priority 4) everyone else, ie: the public. And this isn't getting tickets to a sporting event. This is "I want to go home to NZ because I've lost my job in Australia and I can't afford to pay rent" or "my mother is sick and I'd like to see her and spend a few moments before she passes". If priorities are to be made, they shouldn't be on class & connections.

yardstick 6y ago

Have you tried making multiple bookings in the same account or multiple emails since Feb? They seem to have a job that checks for duplicate bookings (based on email and/or names/passports) and emails you to warn you if you don’t remove the excess bookings they will cancel all of them. Don’t actually know if they follow through with it... Yeah the system is broken. Lots of people were running tools to automate bookings in order to find and secure a date, given how quickly they get snapped up. It’s marginally harder now they are using a captcha.

RileyJames 6y ago
Interesting. I didn't attempt holding actual booking for longer than an hour, because I didn't want to take spots away from people. But while they stated they would cancel duplicate bookings at the time, that's only regarding confirmed bookings. A user can still hold a booking for 48 hours while "booking flights", and with a 48 hour window its easy enough to time the release of said booking at the lowest volume booking period and attempt to snap it back up within few seconds with a second account. Additionally, there is no validation beyond the email address. Name & passport are simple string fields, and you can have many different names / passports under a single account. That's all before you go all out and make 100's - 1000's of accounts. I'm being a bit harsh, I was generally impressed with the quality of the booking system and how quickly they got it up. But once it's been out for a few months, and the cracks are starting to appear AND those crack become public it's just not good enough. It becomes another class based system where: Priority 1) those with contacts within the department / ministry or some other method of getting special treatment Priority 2) those who can bot / exploit the system to get what they need Priority 3) those willing to pay to access priority 1 or 2. Priority 4) everyone else, ie: the public. And this isn't getting tickets to a sporting event. This is "I want to go home to NZ because I've lost my job in Australia and I can't afford to pay rent" or "my mother is sick and I'd like to see her and spend a few moments before she passes". If priorities are to be made, they shouldn't be on class & connections.