New Hilton website

Reply

Old Apr 12, 19, 2:02 pm
  #31  
JBD
 
Join Date: Apr 2005
Posts: 501
Security Issues with New Site

On a regular basis I monitor my miles and points accounts to confirm accurate activity being recorded, and most importantly, to confirm that it is still my email address/phone/physical address listed in my profile page.

[To those unaware of why this is important, hackers who get into your account will change your contact info prior to setting up points transfers or booking awards for themselves - most commonly they'll change your email address. See the current threads about HH points stolen for Amazon purchases for recent experiences with this.]

But on the new site it's impossible to check your personal data. You're first given a page that shows your email address with only its last letter and the email domain, and there's an "Edit" button. But when you select "Edit" you're shown another page which also does not display your full contact info, but rather it's as I described above. So there seems to be no way to confirm that the email address that HH has associated with your account is actually yours. The only option I see is to re-enter your email as if it's a true update to your account.

Am I missing something? Is there a way to confirm that HH has your accurate email address on their new website?

Last edited by JBD; Apr 12, 19 at 2:11 pm Reason: typos
JBD is offline  
Reply With Quote
Old Apr 12, 19, 2:51 pm
  #32  
 
Join Date: Feb 2014
Programs: Amex Plat, Hilton Gold, SPG Gold, Carlson Gold, CM Presidential / *A Gold, Hertz 5*
Posts: 811
Hopefully you see that it is in fact more secure than them displaying all your info

If you are very concerned about security, then buy your own domain and use a different email address for everything
pmarrsouth is offline  
Reply With Quote
Old Apr 12, 19, 3:20 pm
  #33  
JBD
 
Join Date: Apr 2005
Posts: 501
Originally Posted by pmarrsouth View Post
Hopefully you see that it is in fact more secure than them displaying all your info

If you are very concerned about security, then buy your own domain and use a different email address for everything
I've learned to follow the great suggestions from my fellow FTers. That's how I know to check my accounts the way I do. Your suggestion that I should pay for my own domain to circumnavigate HH's flawed new website, though, seems questionable.

Marriott's site similarily doesn't show the personal data unless you click on Edit, but when you do, you then see what's stored in there. I'd bet that's what the HH programmers were going for.

But perhaps the programmers thought as you seem to, that by prohibiting the customer from verifying their data is an enhancement. If so, I stand by my opinion that this is unwise as it gives hackers even more cover.

I've pm'd Lauren about this, asking her to please pass my concern along to the appropriate department. The new site is so buggy, I'm hoping that this does get ironed out.
JBD is offline  
Reply With Quote
Old Apr 12, 19, 4:10 pm
  #34  
 
Join Date: Apr 2018
Posts: 17
Originally Posted by corporate-wage-slave View Post
Just bookmark this link to the old world, it seems to work for me:

https://secure3.hilton.com/en/hh/cus...ogin/index.htm

and thereafter as a hotlink to your list of bookings:

https://secure3.hilton.com/en/hh/cus...servations.htm

They'll sort themselves out eventually.......
Thank you, corporate-wage-slave, for coming to the rescue yet again. Using your link I was able to view rates applicable to my company rate code, but when I tried to book a room I was taken back to the 'new, enhanced' site which does not allow me to plug in my rate code. It is late on Friday and high time to book another hotel chain instead of wasting my time with this.
JasWon is offline  
Reply With Quote
Old Apr 12, 19, 4:25 pm
  #35  
 
Join Date: Feb 2014
Programs: Amex Plat, Hilton Gold, SPG Gold, Carlson Gold, CM Presidential / *A Gold, Hertz 5*
Posts: 811
Originally Posted by JBD View Post
Your suggestion that I should pay for my own domain to circumnavigate HH's flawed new website, though, seems questionable.
It will generally help with your overall security. Apologies for sounding questionable while trying to assist you with such an issue. Its also a great and easy way to track & block SPAM, plus see what companies are selling your info, etc

Originally Posted by JBD View Post
But perhaps the programmers thought as you seem to, that by prohibiting the customer from verifying their data is an enhancement. If so, I stand by my opinion that this is unwise as it gives hackers even more cover.
Hacker gains access to a HH account, due to a data breach, using a HH number and password. Hacker does not have the email address associated to that account. Hacker goes to the preferences/profile page and finds the email address attached to that account. Hacker then goes and tries to log into said email account using the same password, and it works due to [insert large percentage here] of people use the same password for everything. Once they log in, they can see all the emails that the person gets and can see which programs that person is part of. Hacker now has access to pretty much every one of them

So yea, them hiding some/most of an email address can enhance security, much like HH (and most other sites) hide some/most of your CC details on file too


Originally Posted by JBD View Post
The new site is so buggy...
True
pmarrsouth is offline  
Reply With Quote
Old Apr 12, 19, 4:47 pm
  #36  
JBD
 
Join Date: Apr 2005
Posts: 501
Originally Posted by pmarrsouth View Post
...Hacker gains access to a HH account, due to a data breach, using a HH number and password. Hacker does not have the email address associated to that account. Hacker goes to the preferences/profile page and finds the email address attached to that account. Hacker then goes and tries to log into said email account using the same password, and it works due to [insert large percentage here] of people use the same password for everything. Once they log in, they can see all the emails that the person gets and can see which programs that person is part of. Hacker now has access to pretty much every one of them...
What I've read here and on other FT forums over the years, is not what you described above, but rather reports that a hacker got into someone's account, changed their email address on file, then booked a room or transferred to Amazon, or what have you, and the confirmation email didn't come to them, it went instead to the new email address.

Is is this fraudulent activity that can be harnessed when you check your account data on a regular basis. And the HH's new website makes this self-verification impossible.

What you describe is not a concern of mine since I have different, and complex passwords for every account I access online. Because I learned to do that on FT
JBD is offline  
Reply With Quote
Old Apr 12, 19, 5:03 pm
  #37  
 
Join Date: Feb 2014
Programs: Amex Plat, Hilton Gold, SPG Gold, Carlson Gold, CM Presidential / *A Gold, Hertz 5*
Posts: 811
Originally Posted by JBD View Post
What I've read here and on other FT forums over the years, is not what you described above, but rather reports that a hacker got into someone's account, changed their email address on file, then booked a room or transferred to Amazon, or what have you, and the confirmation email didn't come to them, it went instead to the new email address.

Is is this fraudulent activity that can be harnessed when you check your account data on a regular basis. And the HH's new website makes this self-verification impossible.
Sites who take security somewhat seriously should be at minimum sending an email to users if the email address on file is changed (saves you logging in every few minutes to make sure that your account is secure). Hilton does this:



You will rightly have issue with the second sentence

Originally Posted by JBD View Post
I have different, and complex passwords for every account I access online
Good work, you are halfway there
pmarrsouth is offline  
Reply With Quote
Old Apr 13, 19, 8:35 am
  #38  
stc
 
Join Date: Aug 2000
Location: Newton Centre, MA, USA
Programs: DL 2MM Gold, AA Plat Pro, UA ex-?; Hilton Diamond, Bonvoy Lifetime Titanium (via SPG), Hyatt ex-?
Posts: 1,957
For the record, I was able to get the old webpage back by clearing all my cookies that had "hilton" in them.

Last edited by stc; Apr 13, 19 at 8:26 pm Reason: spelling
stc is offline  
Reply With Quote
Old Apr 13, 19, 8:55 am
  #39  
 
Join Date: Dec 2014
Location: On the Road Again
Programs: UA 1K MM, HH Diamond, Marriott Life time Titanium Elite (whateverthat is)
Posts: 686
Originally Posted by sbiddle View Post
Is anybody else totally confused by the new Hilton website?

It doesn't even have an option anywhere (that I can see) to login to your account to view bookings! Clicking on the Hilton logo at the top even redirects to a webpage giving an error!


I have the same today (4/13) I need to select find a hotel to have access to a login box.
reCapta is also screwy some images are so blurred as to be useless.
Dublin_rfk is offline  
Reply With Quote
Old Apr 13, 19, 9:22 am
  #40  
 
Join Date: Oct 2016
Programs: DL Gold, AA Plat, Hilton Diamond
Posts: 171
I still can't get over how stretched the image is. Some junior programmer just found an image and dragged it to make it fit the screen. That poor woman looks like her face is being reflected in a fun house mirror.
Sisosig and pmarrsouth like this.
DCAFly is offline  
Reply With Quote
Old Apr 15, 19, 10:03 am
  #41  
 
Join Date: Mar 2003
Location: Los Angeles, CA
Programs: UA 1K 1MMer & LT UC (when flying UA); Hyatt Credit Cardist; HHonors Gold; Marriott Gold via UA 1K
Posts: 6,292
Originally Posted by Carl Christensen View Post
Thank you for this. I had to go into my profile to change something, and there is no way to do that on the new website that I could find -- even after logging into my account. MASSIVE FAIL!
SS255 is offline  
Reply With Quote
Old Apr 15, 19, 11:11 pm
  #42  
 
Join Date: May 2016
Posts: 13
Just use the HHonors page instead:
https://hiltonhonors3.hilton.com/en/index.html
wontfix is offline  
Reply With Quote
Old May 22, 19, 1:46 pm
  #43  
FlyerTalk Evangelist
 
Join Date: Aug 2001
Location: SF CA USA. I love large faceless corporations. And they cherish me in return (sometimes). ;)
Programs: UA Premier Gold/disappointed 1MM, HH Gold, IHG Plat, MB Gold, BW Diam Sel
Posts: 15,645
Thumbs down Still insanely buggy

Originally Posted by wontfix View Post
Just use the HHonors page instead:
https://hiltonhonors3.hilton.com/en/index.html
Even if I start on this page, I still get the same garbage. For example, it is not possible to edit certain preferences (such as Travel Partners) -- you just get a message "There was an error saving your changes."
KathyWdrf is offline  
Reply With Quote
Old May 23, 19, 8:25 pm
  #44  
stc
 
Join Date: Aug 2000
Location: Newton Centre, MA, USA
Programs: DL 2MM Gold, AA Plat Pro, UA ex-?; Hilton Diamond, Bonvoy Lifetime Titanium (via SPG), Hyatt ex-?
Posts: 1,957
Originally Posted by KathyWdrf View Post
Even if I start on this page, I still get the same garbage. For example, it is not possible to edit certain preferences (such as Travel Partners) -- you just get a message "There was an error saving your changes."
I had the same problem trying to change my primary credit card to the Aspire card. I kept trying over a few days and eventually it worked.

Hilton IT seems to be taking lessons from Marriott.
stc is offline  
Reply With Quote
Old Jun 13, 19, 7:39 am
  #45  
 
Join Date: Oct 2011
Location: ATL
Programs: DL Scattered Smothered Covered Medallion, Some hotel & car stuff, Kroger Plus Card
Posts: 9,655
I'm just now noticing the new page. Went in to check points on a stay, and nothing shows up for any of my past stays (and certainly no way to expand to see the usual details of base+bonus+promo points). Is this happening to anyone else?

I can still see everything in the Android app; just not sure if there's a new place to find this info on the actual website.

gooselee is online now  
Reply With Quote

Thread Tools
Search this Thread