Hacker News Reader

Comment by ryanlol | Hacker News Reader

I recommend not making comments like this on HN.

I watched the entire talk days ago as it was happening and didn't see anything new or interesting in it. Record locators are short and you can scan bar codes on boarding passes was basically all of it.

They also made some pretty ridiculous suggestions that simply wont work, like the proposed scheme with adding your FF# to other peoples tickets. The name on the ticket has to match yours for you to get the miles, this is the worst imaginable way of stealing them.

The talk isn't terrible, it's entertaining and relatively well presented, but it certainly only provides a very basic look at these systems through the eyes of someone who clearly isn't all that familiar with them yet. It's good for a beginner but seems like it might be a bit out of place in an international conference where you'll have lots of frequent fliers who already know all of these things.

View on HN

> They also made some pretty ridiculous suggestions that simply wont work, like the proposed scheme with adding your FF# to other peoples tickets. The name on the ticket has to match yours for you to get the miles, this is the worst imaginable way of stealing them.

You must have missed the bit in the Q&A session when they addressed this very issue. They suggested creating a new frequent flyer account in the name of the person travelling and transferring the stolen miles to your own account – or simply changing the name attached to your own account if the system permits. They also claimed to know of people who were doing this as they spoke, and their talk gives little reason to doubt them.

> I watched the entire talk days ago as it was happening and didn't see anything new or interesting in it. Record locators are short and you can scan bar codes on boarding passes was basically all of it.

I disagree. The (in)security of travel agency systems was something I suspected but had no evidence of, and they presented some novel, fairly clever and disturbingly feasible ways of exploiting the bruteforceability of sequential PNRs, like sending highly targetted credit card phishing emails to people with recent bookings.

>You must have missed the bit in the Q&A session when they addressed this very issue.

>They suggested creating a new frequent flyer account in the name of the person travelling

So then they end up with an account with 1 trips worth of miles on it, that'll rarely be worth anything at all.

>transferring the stolen miles to your own account –

Seriously? Do you have any idea how many miles you'd have to steal for that to be worthwhile. You have to pay $ to transfer miles.

>or simply changing the name attached to your own account if the system permits.

I can't think of anyone who permits this without a painful process, can you?

>They also claimed to know of people who were doing this as they spoke, and their talk gives little reason to doubt them.

Yeah, people also collect empty bottles off the streets.

If you want easy cheap miles this isn't the way to do it.

How about you go try it, just to be sure :)

>So then they end up with an account with 1 trips worth of miles on it, that'll rarely be worth anything at all.

Well, a return flight FRA-SIN in First is worth 40,000 miles which is about 100 USD on most partner shops

That's basically the functional equivalent of tying a string around a bottle and then returning it to the machine multiple times.

Sure, you can successfully commit fraud and earn a few $, is it worth your time? nah.

With a system you can automate? Where you could likely use a single account for everyone who shares a name? (How many John Smiths, how many Mike Davies, how many Ahmed Muhammads?) Something that could likely be coded in an afternoon and left to run on some Amazon instances that never actually get the bill paid on? I think you may be overestimating the setup cost and vastly underestimating the potential haul.

Reply on news.ycombinator.com