I recommend watching the talk.
I watched the entire talk days ago as it was happening and didn't see anything new or interesting in it. Record locators are short and you can scan bar codes on boarding passes was basically all of it.
They also made some pretty ridiculous suggestions that simply wont work, like the proposed scheme with adding your FF# to other peoples tickets. The name on the ticket has to match yours for you to get the miles, this is the worst imaginable way of stealing them.
The talk isn't terrible, it's entertaining and relatively well presented, but it certainly only provides a very basic look at these systems through the eyes of someone who clearly isn't all that familiar with them yet. It's good for a beginner but seems like it might be a bit out of place in an international conference where you'll have lots of frequent fliers who already know all of these things.
You must have missed the bit in the Q&A session when they addressed this very issue. They suggested creating a new frequent flyer account in the name of the person travelling and transferring the stolen miles to your own account – or simply changing the name attached to your own account if the system permits. They also claimed to know of people who were doing this as they spoke, and their talk gives little reason to doubt them.
> I watched the entire talk days ago as it was happening and didn't see anything new or interesting in it. Record locators are short and you can scan bar codes on boarding passes was basically all of it.
I disagree. The (in)security of travel agency systems was something I suspected but had no evidence of, and they presented some novel, fairly clever and disturbingly feasible ways of exploiting the bruteforceability of sequential PNRs, like sending highly targetted credit card phishing emails to people with recent bookings.
>They suggested creating a new frequent flyer account in the name of the person travelling
So then they end up with an account with 1 trips worth of miles on it, that'll rarely be worth anything at all.
>transferring the stolen miles to your own account –
Seriously? Do you have any idea how many miles you'd have to steal for that to be worthwhile. You have to pay $ to transfer miles.
>or simply changing the name attached to your own account if the system permits.
I can't think of anyone who permits this without a painful process, can you?
>They also claimed to know of people who were doing this as they spoke, and their talk gives little reason to doubt them.
Yeah, people also collect empty bottles off the streets.
If you want easy cheap miles this isn't the way to do it.
How about you go try it, just to be sure :)
Well, a return flight FRA-SIN in First is worth 40,000 miles which is about 100 USD on most partner shops
Sure, you can successfully commit fraud and earn a few $, is it worth your time? nah.