> Using just these two values, an attacker could completely manage any aspect of a flight reservation using United’s website.
Don't most airline websites allow that when you get the last name and date of departure right?
Don't most airline websites allow that when you get the last name and date of departure right?