Hacker News Reader

Comment by OtherShrezzing | Hacker News Reader

Seems like a problem booking.com could instantly eliminate by enforcing 2FA for hoteliers.

Not really. In the article it says hackers are getting malware onto the hotel's computers using social engineering. That's really hard to counteract. They could steal cookies, or also just control the existing session using the malware. 2fa won't help if you're already logged in and the hacker hacks your computer.

Then why is only booking affected? Surely many of these hotels are also affiliated with hotels.com and similar portals.

Every big hospitality broker is under these kinds of attacks. Hotels.com data got exposed en-masse through one of their service providers.

Booking is the largest and thus a juicy target for both attackers and articles. Having worked there, I know that competitors had the same problems though.

you can always do geo and browser signature checks aginst sessions

If you have malware on the hotel computers presumably you could make the malware make the request. You can't get too aggressive with your geo/browser checks because there are probably a lot of legitimate logins where the owner is doing some work from home or from a different location.

I mean if the malware has total control of the computer, there is nothing you can do. But if it’s just stealing cookies, then there’s already a lot of existing technologies to prevent that.

And 'after hours' if you happen to come by the front desk it isn't all that rare to see the computers up and running but unattended because the desk clerk stepped away for a moment.

This begets a new problem.

The hotel gets "an" account for Booking. We now need to provide a 2FA credential that essentially needs to be accessed by any hotel front desk/office staff. What methods do we use for "many 2FA, one account"? (And then, how do all those second-factors get secured? Email accounts? Shared phones? Shared token? Shared Authenticator?).

It's probably bad enough the password's probably on a post-it under the front desk keyboard, but I don't think the average hotelier is going to be standing up something like Delinea Secret Server. ;)

The ideal solution is that each of the front desk / office staff use their work credentials to access booking.com. One customer accounts, many user accounts. Use OIDC so you’re not entering your work password on booking.com.

I know it’s not gonna happen industry-wide. But this is how we do things everywhere I’ve worked for the past many years.

"We" don't. "We" need to create individual accounts for each eligible staff member and provide each with a 2FA system, for example a Fido key or a TOTP auth app, or an app that uses push notifications and asks for a "yes".

Reply on news.ycombinator.com