4 ms·

What seems unsaid in the article but seems to be the case, is that the app is logging in to American Airlines systems using the flight attendant credentials and

What seems unsaid in the article but seems to be the case, is that the app is logging in to American Airlines systems using the flight attendant credentials and then scraping. If this is the case, I think American Airlines is justified in trying to block them. An app storing/using credentials for a different service is a data breach waiting to happen.

nnm 4y ago
It is commonsense to use the hardware/software authorized by your employer to do the work.
- TobyTheDog123 4y ago
  This is nonsense. This would be like claiming you have to use a company-sponsored to-do list app, or a company-sponsored git client, or a company-sponsored text editor, or a company-sponsored FTP client. I'd hate to be at any job that enforces any single one of those. There are many arguments against this app, but this is not one of them.
  - alar44 4y ago
    Really? Maintaining consistency across users is a huge part of IT. I can't imagine working somewhere where everyone just uses whatever software they want. Support would be a nightmare.
  - a4isms 4y ago
    I'm not entirely sure that is a nonsensical argument. I am permitted to use any client I like to perform SQL queries of our customer data, but if the client were to happen to route the data through a third party, I would be in employment-jeopardy breach of our security policies. Similar rules goes for hardware: I can bring my own device for reading and locally storing our email and chats, but customer data is not to be accessed on any hardware not authorized by the company. Roster data is not customer data, and there are reasonable arguments to be made that this is not an exact parallel. But in principle, I can understand a company wanting to have control over certain types of data and how it might be exfiltrated from the company, even if it is intended for employees to use to do their jobs.
    - krferriter 4y ago
      But in this case, isn't the "third party" just a piece of client-side software that performs a bunch of http requests to systems the client user is allowed to access, on a device the user is allowed to use, in order to aggregate the results and show them all in one spot? It's not being sent to third party systems off the user's phone. Banning it would be like restricting certain sql clients, like allowing the CLI clients, but banning pgAdmin or MYSQL Workbench.
      - a4isms 4y ago
        I agree with you! I also don’t really agree with the ban, and seriously doubt that they have any reason other than, “We dunno what this is, and are too lazy^H^H^H^H busy to think it through, give a decision, and deal this the precedent of allowing screen scraping and/or third-party clients.” All I was trying to say is that while I may disagree with their call, I wouldn’t go so far as to say it’s “nonsense.” Just wrong :-)
SoftTalker 4y ago
Any evidence that the app is storing/using credentials, or if it is, storing them insecurely? How about AA's own apps? Do they store credentials or do you have to log in every time?
- acedTrex 4y ago
  None of this information is public, its spread across internal websites that integrate with AAs SSO
hedora 4y ago
This argument could be made about literally any software or hardware used to access any service. It is like argung they should make everyone wear mittens 24/7 so they can't write their passwords down.
- eddieroger 4y ago
  Capturing a user's credentials and logging in to a system they don't manage is nowhere near your analogy. Unless AA is operating a public API, this is an unauthorized use of their service, which they absolutely have the right to shut down and protect themselves against. If someone takes the key to my house and goes inside without my permission, it's still breaking and entering.

nnm 4y ago

It is commonsense to use the hardware/software authorized by your employer to do the work.

TobyTheDog123 4y ago
This is nonsense. This would be like claiming you have to use a company-sponsored to-do list app, or a company-sponsored git client, or a company-sponsored text editor, or a company-sponsored FTP client. I'd hate to be at any job that enforces any single one of those. There are many arguments against this app, but this is not one of them.
- alar44 4y ago
  Really? Maintaining consistency across users is a huge part of IT. I can't imagine working somewhere where everyone just uses whatever software they want. Support would be a nightmare.
- a4isms 4y ago
  I'm not entirely sure that is a nonsensical argument. I am permitted to use any client I like to perform SQL queries of our customer data, but if the client were to happen to route the data through a third party, I would be in employment-jeopardy breach of our security policies. Similar rules goes for hardware: I can bring my own device for reading and locally storing our email and chats, but customer data is not to be accessed on any hardware not authorized by the company. Roster data is not customer data, and there are reasonable arguments to be made that this is not an exact parallel. But in principle, I can understand a company wanting to have control over certain types of data and how it might be exfiltrated from the company, even if it is intended for employees to use to do their jobs.
  - krferriter 4y ago
    But in this case, isn't the "third party" just a piece of client-side software that performs a bunch of http requests to systems the client user is allowed to access, on a device the user is allowed to use, in order to aggregate the results and show them all in one spot? It's not being sent to third party systems off the user's phone. Banning it would be like restricting certain sql clients, like allowing the CLI clients, but banning pgAdmin or MYSQL Workbench.
    - a4isms 4y ago
      I agree with you! I also don’t really agree with the ban, and seriously doubt that they have any reason other than, “We dunno what this is, and are too lazy^H^H^H^H busy to think it through, give a decision, and deal this the precedent of allowing screen scraping and/or third-party clients.” All I was trying to say is that while I may disagree with their call, I wouldn’t go so far as to say it’s “nonsense.” Just wrong :-)

SoftTalker 4y ago

Any evidence that the app is storing/using credentials, or if it is, storing them insecurely? How about AA's own apps? Do they store credentials or do you have to log in every time?

acedTrex 4y ago
None of this information is public, its spread across internal websites that integrate with AAs SSO

hedora 4y ago

This argument could be made about literally any software or hardware used to access any service. It is like argung they should make everyone wear mittens 24/7 so they can't write their passwords down.

eddieroger 4y ago
Capturing a user's credentials and logging in to a system they don't manage is nowhere near your analogy. Unless AA is operating a public API, this is an unauthorized use of their service, which they absolutely have the right to shut down and protect themselves against. If someone takes the key to my house and goes inside without my permission, it's still breaking and entering.