6 ms·

This is one of those terrifying security and operational scenarios. Sure the TSA can say nothing on our end was compromised but if the data is readily accessibl

This is one of those terrifying security and operational scenarios. Sure the TSA can say nothing on our end was compromised but if the data is readily accessible to download and accessed by every mom and pop carrier with a 3 person IT staff that can barely keep the lights on is anything actually secure?

mrguyorama 4y ago
It's a weird concept that doesn't make sense: "Nobody can see it but every single company that interfaces with airline booking NEEDS to see it". The only way around this would be for DHS to host a web endpoint that took a name and answered whether they were on the list. This still has some problems like being able to enumerate over time.
- thewebcount 4y ago
  I mean, it's even more absurd than that. The data itself is rife with errors. Senator Ted Kennedy had to have himself removed from the list several times[0]. [0]https://www.cnn.com/2015/12/07/politics/no-fly-mistakes-cat-stevens-ted-kennedy-john-lewis/index.html https://www.cnn.com/2015/12/07/politics/no-fly-mistakes-cat-...
- eddsh1994 4y ago
  You could detect that enumeration and would require a list of everyones name - maybe add a DOB and a price per API call and it'd go down.
  - orev 4y ago
    Enumeration doesn’t have to mean using a brute force search. One could simply make the api call and then update a local database with the result. That local database would then become the potentially exposed data.
- htag 4y ago
  > This still has some problems like being able to enumerate over time. 1. There are eight billion people. Even if you had everyone's first name, last name and DOB you couldn't ask for more names (or more foreign names) then the size and location of your airline would allow without raising red flags with the wrong type of people. You would never get the complete list this way. 2. If you ask a DHS server if someone is allowed on an airplane, and they say no, there's a good chance that eventually someone at DHS will start to investigate. It's going to look a little bad if you don't have a reason for looking up the name. It's going to look very bad if this happens many times. 3. I wonder if an end user of an airline webportal could try to purchase tickets in someone else's and then see if it's denied to check if someone is on the no fly list.
  - maxerickson 4y ago
    Why would it be suspicious for an airline to use a system designed to check the flight status of an individual? Sure, it could be suspicious for an airline to make requests that didn't line up with likely prospective passengers, but that isn't at all how you phrased your second point.
    - htag 4y ago
      On the second point it's not the airline that it suspicious but the individual on the list. Their actions might be under investigation, and that might include attempting to buy an airplane ticket. What happens if they never actually tried to buy the ticket, but someone was trying to recreate the list? Wouldn't this type of event occur many many times, and the airline might begin to standout.
- ar_lan 4y ago
  This is basically how public housing records work, right? You basically cannot buy a house and keep your address private unless you route it through a trust or LLC. Even though the county won't up and tell you "Oh, Mr. ar_lan lives at 1234 Hacker Way", you can certainly just scrape all the data you want and construct a DB that then becomes searchable by name. Seriously - unless the government steps in and has some sort of tunnel just between the user buying the ticket, and preventing them, without an airline employee somewhere in-between, this will just basically never be secure. I guess there could be some super severe auditing on the employeees w/ access - but that means these employees are now the ticketing agents, as well.
- Scoundreller 4y ago
  The US already has that for non-citizens and non-Canadians: ESTA and visas. I guess lack of those doesn’t stop them from flying out. Maybe codeshares are supposed to enforce the US no-fly list even if you’re not flying to/from US. Dunno.

mrguyorama 4y ago

It's a weird concept that doesn't make sense: "Nobody can see it but every single company that interfaces with airline booking NEEDS to see it". The only way around this would be for DHS to host a web endpoint that took a name and answered whether they were on the list. This still has some problems like being able to enumerate over time.

thewebcount 4y ago
I mean, it's even more absurd than that. The data itself is rife with errors. Senator Ted Kennedy had to have himself removed from the list several times[0]. [0]https://www.cnn.com/2015/12/07/politics/no-fly-mistakes-cat-stevens-ted-kennedy-john-lewis/index.html https://www.cnn.com/2015/12/07/politics/no-fly-mistakes-cat-...
eddsh1994 4y ago
You could detect that enumeration and would require a list of everyones name - maybe add a DOB and a price per API call and it'd go down.
- orev 4y ago
  Enumeration doesn’t have to mean using a brute force search. One could simply make the api call and then update a local database with the result. That local database would then become the potentially exposed data.
htag 4y ago
> This still has some problems like being able to enumerate over time. 1. There are eight billion people. Even if you had everyone's first name, last name and DOB you couldn't ask for more names (or more foreign names) then the size and location of your airline would allow without raising red flags with the wrong type of people. You would never get the complete list this way. 2. If you ask a DHS server if someone is allowed on an airplane, and they say no, there's a good chance that eventually someone at DHS will start to investigate. It's going to look a little bad if you don't have a reason for looking up the name. It's going to look very bad if this happens many times. 3. I wonder if an end user of an airline webportal could try to purchase tickets in someone else's and then see if it's denied to check if someone is on the no fly list.
- maxerickson 4y ago
  Why would it be suspicious for an airline to use a system designed to check the flight status of an individual? Sure, it could be suspicious for an airline to make requests that didn't line up with likely prospective passengers, but that isn't at all how you phrased your second point.
  - htag 4y ago
    On the second point it's not the airline that it suspicious but the individual on the list. Their actions might be under investigation, and that might include attempting to buy an airplane ticket. What happens if they never actually tried to buy the ticket, but someone was trying to recreate the list? Wouldn't this type of event occur many many times, and the airline might begin to standout.
ar_lan 4y ago
This is basically how public housing records work, right? You basically cannot buy a house and keep your address private unless you route it through a trust or LLC. Even though the county won't up and tell you "Oh, Mr. ar_lan lives at 1234 Hacker Way", you can certainly just scrape all the data you want and construct a DB that then becomes searchable by name. Seriously - unless the government steps in and has some sort of tunnel just between the user buying the ticket, and preventing them, without an airline employee somewhere in-between, this will just basically never be secure. I guess there could be some super severe auditing on the employeees w/ access - but that means these employees are now the ticketing agents, as well.
Scoundreller 4y ago
The US already has that for non-citizens and non-Canadians: ESTA and visas. I guess lack of those doesn’t stop them from flying out. Maybe codeshares are supposed to enforce the US no-fly list even if you’re not flying to/from US. Dunno.