Re:Booking.com hackers increase attacks on customers
by dietrichepp on Friday December 01, 2023 @10:34AM
(#38487921)
The ideal solution is that each of the front desk / office staff use their work credentials to access booking.com. One customer accounts, many user accounts. Use OIDC so you’re not entering your work password on booking.com.
I know it’s not gonna happen industry-wide. But this is how we do things everywhere I’ve worked for the past many years.
Re:Booking.com hackers increase attacks on customers
by isotopp on Friday December 01, 2023 @11:17AM
(#38488416)
"We" don't. "We" need to create individual accounts for each eligible staff member and provide each with a 2FA system, for example a Fido key or a TOTP auth app, or an app that uses push notifications and asks for a "yes".
The hotel gets "an" account for Booking. We now need to provide a 2FA credential that essentially needs to be accessed by any hotel front desk/office staff. What methods do we use for "many 2FA, one account"? (And then, how do all those second-factors get secured? Email accounts? Shared phones? Shared token? Shared Authenticator?).
It's probably bad enough the password's probably on a post-it under the front desk keyboard, but I don't think the average hotelier is going to be standing up something like Delinea Secret Server. ;)