4 ms·

At least (?) that's in an app. But it's worse. A hotel told me it's sometimes plaintext over email. https://arstechnica.com/information-technology/2023/02/myst

At least (?) that's in an app. But it's worse. A hotel told me it's sometimes plaintext over email. https://arstechnica.com/information-technology/2023/02/mysterious-leak-of-booking-com-reservation-data-is-being-used-to-scam-customers/?comments=1&post=41615090 https://arstechnica.com/information-technology/2023/02/myste...

user3939382 3y ago
That has to be a PCI violation. Maybe it doesn’t have any teeth. The CC networks seem lax with their rules.
Scoundreller 3y ago
I wonder if the hotel uses an incoming-fax-to-email system.
- smueller1234 3y ago
  Nice catch! That was indeed something we found about a decade ago when I worked there. I don't recall what the security folks tried to do about it. Generally, though, more and more hotels shifted from faxes to API integrations via channel managers. But that's a whole extra step in sophistication.
  - juliogreff 3y ago
    I worked on some of these systems as well. Credit card details haven't been sent by emails for many many years, and I believe the last fax Booking ever sent was somewhere in 2018 or 2019, the whole fax system was decommissioned. By the time I left I believe they were still showing CC details to hotels via the extranet or an app though. A virtual CC thingy exists, but like someone said upthread, hotels are very set in their ways and often behind the times.
    - smueller1234 3y ago
      Oh hilarious! The business logic for getting optimal routing for faxes was... quirky. Picking the right source country/line/carrier to get the best quality line while getting the lowest cost and balancing capacity. In the old days all held in a complex queue in a MySQL db (sigh). I recall getting paged out of bed a number of times as an escalation to get it all working again after we hit yet another lock contention issue in MySQL. Good times!

4 ms·

At least (?) that's in an app. But it's worse. A hotel told me it's sometimes plaintext over email. https://arstechnica.com/information-technology/2023/02/myst

by vintagedave 3y ago

user3939382 3y ago
That has to be a PCI violation. Maybe it doesn’t have any teeth. The CC networks seem lax with their rules.
Scoundreller 3y ago
I wonder if the hotel uses an incoming-fax-to-email system.
- smueller1234 3y ago
  Nice catch! That was indeed something we found about a decade ago when I worked there. I don't recall what the security folks tried to do about it. Generally, though, more and more hotels shifted from faxes to API integrations via channel managers. But that's a whole extra step in sophistication.
  - juliogreff 3y ago
    I worked on some of these systems as well. Credit card details haven't been sent by emails for many many years, and I believe the last fax Booking ever sent was somewhere in 2018 or 2019, the whole fax system was decommissioned. By the time I left I believe they were still showing CC details to hotels via the extranet or an app though. A virtual CC thingy exists, but like someone said upthread, hotels are very set in their ways and often behind the times.
    - smueller1234 3y ago
      Oh hilarious! The business logic for getting optimal routing for faxes was... quirky. Picking the right source country/line/carrier to get the best quality line while getting the lowest cost and balancing capacity. In the old days all held in a complex queue in a MySQL db (sigh). I recall getting paged out of bed a number of times as an escalation to get it all working again after we hit yet another lock contention issue in MySQL. Good times!