Hacker News Reader

Comment by helloka | Hacker News Reader

https://krebsonsecurity.com/2016/08/united-airlines-sets-min...

United began debuting new authentication systems wherein customers are asked to pick a strong password and to choose from five sets of security questions and pre-selected answers.

This has been in place for 3 years despite public shaming.

View on HN

I'm stuck flying United most of the time and I get the sense their cybersecurity posture is consistent with their broader business posture: "If you do nothing, nothing will happen. If something external forces change, deny, deny, deny." Very old school. In all the worst ways.

Does this mean that United Airlines is still using the inadequate system described in the article? In my opinion, public shaming is the last resort: when you tried everything and failed to make your legitimate concerns about cyber-security heard by the company, you go public and hope that the bad press creates some kind of PR issue... But what if it doesn't? What if the public shaming proves useless? What can be done then?

"boycott"? you can quit flying with them, but individuals doing this will have pretty much 0 effect. in many cases, a specific airline may be the only practical way to get from A to B, so you're generally stuck. This is even more grating on me when I fly and hear "we know you have a choice, thank you for flying with _____ today!". No, really, most of the time, I don't have much of a choice. Drive 7 hours or spend 4 hours in airport. Fly ABC direct or DEF via 2 layovers. Neither are great choices (if they exist at all).

Reply on news.ycombinator.com