News for hackers. Stuff that matters.

jdmath

Re:Staying with the US Digital Service on Thursday January 19, 2017 @09:23AM (#13435949)
Not a question, I wanted to say that I am impressed with vets.gov and the pace of improvement. Thank you and your team for the work that you do! I can see it getting way better than ebenefits. Hoping it will allow vets more access to their information such as C-File and medical records without a FOIA request.
I used to work for an airline that used Amadeus and was fairly familiar with it. Every booking agent had access to a terminal connection to the mainframe (similar to ssh or telnet). Everyone had unique login credentials and every action can be tracked through the booking history.

Here are a few notes:

- Credit card numbers are obfuscated right after they are first used. Only certain back offices have unrestricted access.

- Viewing all the travel information in the PNR is important. For example, if a flight is arriving late, it can be useful to know that the passenger has a connecting flight with another airline on the same ticket to arrange for another connecting flight.

- Reservations are archived after a certain amount of days after the last flight. They can be retrieved in view only mode but you have to specify a date range.

- Most tickets and vouchers are non-transferable (at least for the airline I worked for) . Even changing a name on a reservation is a pain. You either have to make a new booking and re-issue the ticket or get a support desk to change the name on the current reservation and re-issue the ticket. A regular agent changing more than 3 letters of a name will result in a cancelled itinerary.

- It is possible to enter restricted comments on a PNR. You can even set who can view them. Agency only, Airline only even a specific office.

I get that he was saying that the system is unsafe but a lot of it is only in relation to the web interfaces. You can't get direct GDS access unless you're working directly for an airline or travel agency. Those people definitely need to see most of the information on the record.

Anyways, just thought I would provide some info.