United declares 4-digit pin login and lack of SSL “functioning as designed”

To be honest both the email and tweet read like someone trying very very hard to sound smart. They're over-using concepts that don't help clarify the issue, so the only reason I can assume they even included that was so that we knew they knew that those concepts existed.

Is he perhaps joking? Even a brief read of the Wikipedia article makes it clear that NP-hard isn't a mathematical expression in which 'N' stands for a number...

> The mention of "NP hard" in the first place just seems...unnecessary.

Furthermore, trying all possible passwords of length n for a fixed alphabet can be done in polynomial time, hence finding the password deterministically only takes polynomial time. Thus, it's only NP-hard if P=NP.

Edit: You're right, I mixed up length and size of the alphabet, so disregard that comment. I probably should go to sleep.

Yes, it's a different N. He didn't say or imply they were the same N. It makes perfect sense to talk about the size parameter when discussing complexity.

Agreed. However, United still has very glaring security issues with their site that go far beyond the 4 digit PIN. I can't provide concrete details because I still have a pending bug bounty report, but stuff along the lines of bad/missing HTTPS and easy hijacking of account management sessions.

> Also, when you log into the United website, you can transfer airline miles. True, once someone complains about their miles disappearing, United might pull them back and ban the receiving account, but it might take a while.

Put that into context - there are several groups of people:

A - those who are accruing miles who don't know/care

B - those who accrue miles but only use them/care when they are going somewhere in which they want to redeem them (ie vacation)

C - those who check their accounts daily

I would argue the vast majority of United's customers fall into A or B. Which means that by the time the customer figures out what happened - the miles will be long gone. And I'm sure United's response will be "sorry can't do anything".

> When United takes them back, the buyers will be without recourse.

That is assuming they are even willing or the miles haven't been redeemed already.

Playing devil's advocate this isn't United's fault really - what is the balance between security and ease of use? From a business stand point you want the service as easy as possible to use so people give you money. The average person doesn't want to deal with email verification, complex passwords, or one time passwords - they just want to enter their credit card number and buy the ticket. Though, I'm sure United is making enough to lose a few customers...but it's all about money.