2

Many booking websites or tickets "re-sellers" expose in plain view for the current authenticated user the commonly used "Frequent flyer number".

Should this be considered a security risk? Can this number be used with malicious intentions?

4

On United States legal fields and privacy laws, PII (Personally Identifiable Information) should be protected and should not be disclosed. PII is any information used to identify a person and your frequent flyer number is unique to tag you.

In this ground, yes exposing your PII is a security concern (If this is visible in public).

  • by visible in public you mean: If you can see it unauthenticated or if you can see it for another user. Am I right? – Lucian Nitescu Jul 7 '18 at 9:35
  • 1
    Yes you are right. If anyone can see without proper authentication/authorization will be a security violation. – Sayan Jul 7 '18 at 10:01
1

I don't think that this is a security risk as you said the user is authenticated therefore only authenticated user can see "Frequent flyer number", it's up to the user if the user exposes that number. Also, I think that ticketing services have some security in place which would detect if two users try to use the same "Frequent flyer number", at least I would expect them to do some security checks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.