Hacker News Reader

Comment by ClumsyPilot | Hacker News Reader

> an attacker could easily book many flights without checking in. This would cause the airline to fly at a loss.

An attacker could easilly ask for many ambulances to random addresses, by calling from different phone numbers. They can do the same with the police and fire department, and as a result real people will die because emergency services are not avaliable.

An attacker can book hotels where you pay on arrival. They can order thousands of pizzas with cash payment on delivery. They can probably do even order a truck full of cement if they can pull off an act.

There are thousands of possible contrived scenarios, life is full of possibilites. You aren't designing an API

This is like 'men will pretend to be transgender and be hanging out in feemale toilets' - random fictitious scenario divorced from reality.

View on HN

> An attacker could easilly ask for many ambulances to random addresses, by calling from different phone numbers.

Phone numbers can be traced, and anonymous sources like a payphone are relatively rare. Getting access to more than a few phone numbers is generally going to be difficult unless they all trace to a central source (office, school, etc.) - at which point your odds of getting caught go way up.

> They can order thousands of pizzas with cash payment on delivery.

Um. Really? Is "cash on delivery" even an option where you live? I would certainly expect any sane company to get suspicious here.

There's a huge difference between exploiting a company's lack of validation VS exploiting a legally required lack of validation. The pizza company is choosing to accept cash on delivery, whereas this proposal is to force airlines. That's a huge difference and it's alarming that you don't see the relevance.

> You aren't designing an API

When you force the rule on others, I think you do owe some responsibility to think about the consequences.

> random fictitious scenario divorced from reality.

It seems ridiculous to dismiss concerns about a proposed policy by saying we have no evidence it will happen. Of course we haven't seen it happen yet: the law hasn't passed. Conversely, we have centuries of data on whether men will pretend to be transgender. Again, this is a very big difference.

I'm not against reasoning by analogy, but these are all terrible analogies.

> Um. Really? Is "cash on delivery" even an option where you live?

I can order a fridge with cash on delivery. There is a hundred of other examples.

I can come up with a fictisious 'attack' for any policy you will ever propose. The budgen is on you to argue that this 'attack' makes any sence and would be common, not on me to disprove every scenario you come up with.

You provided no argument whatsoever, why would anyone bother with this 'attack'. It doesnt. make you any money, it does nothing usefull

Swatting someone doesn't make any money. It doesn't do anything useful. And yet it still happens. The notion of people on the internet using tools solely out of malice should not be a novel one.

> I can order a fridge with cash on delivery. There is a hundred of other examples.

But again, that's an example of a corporation choosing to trust you. This is about a policy requiring it. The corporation can trivially stop sending fridges if this becomes an issue, but government policies are a lot slower to react.

I still doubt you can actually meaningfully order a large quantity of anything without providing substantial proof of your identity, to avoid exactly this sort of abuse.

You keep saying you can, but you're not providing any actual concrete examples - what specific store are you ordering these fridges from, and we can compare their policy to this proposed law. If I can really order a thousand fridges, I will happily concede the point, but I somehow doubt they'll let me.

All of those things you listed have happened and continue to happen. Now what?

Now nothing, they don’t happen nearly enough to rethink our systems entirely. Let not perfect be the enemy of “good enough”.

You Can Help By Expanding It. People with user-level access to our systems are becoming less trustworthy. You can tell because abuses used to never ever happen at all.

Reply on news.ycombinator.com