Hacker News Reader

Comment by Too | Hacker News Reader

That's pretty bad, but frankly he could have communicated better to Emirates. If I was working as first line support and received that message with "omg do you know you are sharing fields a, b and c to partners. And maybe you are sharing with x, y and z also?", without any technical details at all, I would also give a canned response, tag it as tinfoil hat and throw it into the junk.

View on HN

He does address that though:

>Please note that I could not find a dedicated channel for reporting security bugs on Emirates website

I agree that he should've found an email channel but Twitter is their official customer support interaction.

He also says that he wrote an email to the Product Manager -

"I also wrote an email to the Product Manager highlighting the security flaws. I was met with a deafening silence.

So, Social media team gives a canned response and the Product Manager doesn't bother to even respond to an email just goes on to show that Data security is not their priority.

I guess you missed out on this part -

"In the wake of responsible behaviour, on discovering these serious security flaws that violate user-data privacy, I decided to flag them to Emirates through Twitter DM in October 2017. Please note that I could not find a dedicated channel for reporting security bugs on Emirates website.

I also wrote an email to the Product Manager highlighting the security flaws. I was met with a deafening silence."

Proper first-line support setup makes the staff send any queries they don't understand to higher levels, not throw away.

The new thing now even with big travel booking companies is to have one tier of phone support that can literally only provide canned answers, and a very difficult to get to escalation to an email team that will give you a canned answer.

Exactly. Twitter isn't the medium to report this sort of problem. Ask for an email address for security vulnerabilities, and send it there.

That was the first question I asked on Twitter support, to which they replied, I can report the issues here. https://cdn-images-1.medium.com/max/1600/1*VvnWUPs8xnWRtH92M...

Again, I am more than happy to report it proper channels. I understand the reasons of ethically reporting such issues.

I would really appreciate it, can you help me find correct channel even now for Emirates, Lufthansa, KLM, Air-France ?

Well: «Please note that I could not find a dedicated channel for reporting security bugs on Emirates website.»

I guess you completely missed the paragraph titled "Reporting it to Emirates:"

I will write it here for you - "In the wake of responsible behaviour, on discovering these serious security flaws that violate user-data privacy, I decided to flag them to Emirates through Twitter DM in October 2017. Please note that I could not find a dedicated channel for reporting security bugs on Emirates website.

The Social Media Team immediately responded to my Twitter DM with a canned response but I was not ready to give up hope. I also wrote an email to the Product Manager highlighting the security flaws. I was met with a deafening silence."

Reply on news.ycombinator.com