Travel Site Typo Reveals Security Loophole

Travel site Booking.com says one customer getting access to another customer's bookings was not a security breach. The problem appears to be a system that was set up without considering the possibility of human error.

Website Arstechnica.com reported the case of a customer identified only as "Alfie," who received a confirmation email for a trip he knew nothing about. He was surprised to login to his account and find the details of the booking. (Source: arstechnica.com)

Typo Trouble

After Alfie made multiple enquiries to Booking.com's support staff, he received no useful response. He then reported the situation to Arstechnica, which also took "weeks" to get a proper response.

They explained the problem was simple: another customer had mistakenly typed Alfie's email address while making an online reservation. It appears the two customers had similar email addresses that meant a simple typo (and the fact they both had accounts with the site) was enough to cause the error. (Source: techradar.com)

The way the site works meant the booking was automatically added to Alfie's account. To make things worse, Booking.com said it was unable to remove the trip from his account, citing a violation of the privacy of the actual user - something that doesn't really make much sense. Instead the only option was for Alfie to manually delete the trip himself which, thankfully for the real customer, he did only after the travel dates had passed.

Nothing To See Here

Pressed on the problem, Booking.com reportedly said there was nothing to fix as the system was working as designed and there was no security breach. That may be the case, but there certainly appear to be data protection issues. Curious about the implications, Alfie asked Booking.com to "confirm" details about the booking and was given identifying personal information about the real customer.

Alfie also noted that although there's no obvious way for somebody acting maliciously to start this process, it's a matter of luck whether the unintended "recipient" of the booking was good-natured. He pointed out that a less charitable person might have cancelled the trip.

What's Your Opinion?