3 ms·

Also, when you factor in the human tendency to pick very easily guessed PIN codes, it's laughably easy. [1] 11% are "1234" Also, when you log into the United w

Also, when you factor in the human tendency to pick very easily guessed PIN codes, it's laughably easy. [1] 11% are "1234" Also, when you log into the United website, you can transfer airline miles. True, once someone complains about their miles disappearing, United might pull them back and ban the receiving account, but it might take a while. It would be trivially easy to steal lots of airline miles into one hacked account and then sell them onto other people on the open market. When United takes them back, the buyers will be without recourse. [1] http://www.datagenetics.com/blog/september32012/index.html http://www.datagenetics.com/blog/september32012/index.html

nadams 11y ago
> Also, when you log into the United website, you can transfer airline miles. True, once someone complains about their miles disappearing, United might pull them back and ban the receiving account, but it might take a while. Put that into context - there are several groups of people: A - those who are accruing miles who don't know/care B - those who accrue miles but only use them/care when they are going somewhere in which they want to redeem them (ie vacation) C - those who check their accounts daily I would argue the vast majority of United's customers fall into A or B. Which means that by the time the customer figures out what happened - the miles will be long gone. And I'm sure United's response will be "sorry can't do anything". > When United takes them back, the buyers will be without recourse. That is assuming they are even willing or the miles haven't been redeemed already. Playing devil's advocate this isn't United's fault really - what is the balance between security and ease of use? From a business stand point you want the service as easy as possible to use so people give you money. The average person doesn't want to deal with email verification, complex passwords, or one time passwords - they just want to enter their credit card number and buy the ticket. Though, I'm sure United is making enough to lose a few customers...but it's all about money.

nadams 11y ago

> Also, when you log into the United website, you can transfer airline miles. True, once someone complains about their miles disappearing, United might pull them back and ban the receiving account, but it might take a while. Put that into context - there are several groups of people: A - those who are accruing miles who don't know/care B - those who accrue miles but only use them/care when they are going somewhere in which they want to redeem them (ie vacation) C - those who check their accounts daily I would argue the vast majority of United's customers fall into A or B. Which means that by the time the customer figures out what happened - the miles will be long gone. And I'm sure United's response will be "sorry can't do anything". > When United takes them back, the buyers will be without recourse. That is assuming they are even willing or the miles haven't been redeemed already. Playing devil's advocate this isn't United's fault really - what is the balance between security and ease of use? From a business stand point you want the service as easy as possible to use so people give you money. The average person doesn't want to deal with email verification, complex passwords, or one time passwords - they just want to enter their credit card number and buy the ticket. Though, I'm sure United is making enough to lose a few customers...but it's all about money.