KIXman

Got this email from ROP saying I can save 50% on award travel.
Seems to have something to do with 20 years of ROP so I guess it's separate from the 50% gold award?
Anyway its a good excuse to find a way to use up those miles expiring on Sept.

planetshakers

Does the email come with a list of destinations and does the travel need to commence from BKK?

All classes of travel?

forumpersona999

The full text is here:

True Thai Style, the "if you cannot read this e-mail, click here" link goes to the URL I just referenced above + a 4 digit ID string that then personalizes the page with the ROP member's real name. Not only is it a poxy 4 digit numerical string but it is also sequential

You can pretty much enumerate the ROP Gold user-base by adding a ?id=xxxx, xxxx being 4 digit string and then adding +1 to it each iteration.

In 15 minutes one could make a python script to automate this and harvest all the names. Nice one, THAI.

Edit: Actually it's fully sequential and not just 4 digits. Starts with ?id=1 and goes up from there.

A_Lee

Well, looks like ROP only has 14,929 members. A bit of information I don't think a FFP would normally want to make public, but which they did by their IT department's incompetence. I wonder what the sort order is, by joining date, status, or some other criteria.

joy16

Maybe they only counted who changed the PIN (or password) after new system launch.

A_Lee

I suppose it's possible, but doesn't seem likely. They've been emailing me and other ROP members stuff all along and I don't know why they'd suddenly target this kind of an email only to those who updated their passwords. Especially being the update process is only days old. It's a general offer to ROP members, with nothing to do with the new system. Now I suppose there could be some ROP members who don't have an email, and those might not be included in those numbers, depending on how their system is programmed. I also don't know if they allow members to have names using Thai script only. If so, they might be separated in the database, being I didn't see any names in Thai script when randomly checking some numbers.

Regardless of the actual numbers, it's a real bonehead move by TG's IT department to be doing something like this. But then everything their IT department has done with respect to ROP as of most recently has been completely retarded. Seems nobody did even the most basic testing before they made the changeover. Not really picking on TG per se, because this is a very common problem with IT departments the world over. Even major corporations have some real bozos making the decisions about how much money to spend on IT and they're only willing to pay peanuts and end up getting a bunch of monkeys working for them that don't know the first thing about how to design world-class IT solutions. Well, that's one of my biggest pet-peeves about not only TG and other airlines, but corporations in general. Unfortunately there's not a good solution because there's not enough IT people to go around that can do a good job, and if everyone tried to hire just the good people, salaries would go through the roof.

Still though, simply hiring one competent manager who can properly supervise the monkeys and don't release anything that's only half-baked should be the absolute minimum any IT department strives for.

forumpersona999

The offer is only for Gold and would only go out to those who have an up to date profile and not opted out of marketing emails so it is not possible to quantify the member base off this data alone.

Still, a sloppy implementation that violates e-commerce 101. These kind of ID strings need to be long and randomized.

forumpersona999

But here in Thailand not many people are hired on merit, right ?

It's usually corruption or nepotism.

A_Lee

Ah, I missed that it was only for Gold members. So I guess we know the minimum number of ROP gold members now. I wouldn't think too many members would opt out of being on the email list, being you could miss some important offers or news if you did. But yeah, I guess there are some who have.

yosithezet

Didn't opt out and didn't get the mail.

A_Lee

Looking at one of my earlier emails from ROP, April, 2013, it gives this URL:
http://www.royal-orchid-plus.com/ene...php?id=xxxxxxx
Where xxxxxxx is a number between 1 and 1127564. So I guess there were 1,127,564 members as of that point, whether those members include those who opted out of emails or not, who knows. And out of those, 14,929 are gold members, again not knowing if that number includes those who've opted out or not. So perhaps about 1% of the ROP members are gold members.

Even more disturbing with that URL is that it not only gives the person's name, but their ROP number, their status, and their mileage balance. One could theoretically write a script to harvest all of ROP's members names/numbers, and balances, then choose those with high balances and attempt to steal the person's identity in order to cash in on their miles. With the old 5-digit PIN, it wouldn't take much time at all to go through all possible PIN combinations and gain access to people's account.

Very, very amateurish security.

Starting with number 1, and incrementing up, you come to what looks like a Thai general very soon. I wonder if these generals and politicians know that their names and mileage balances are open for anyone to view like this. If they knew, they might have some stern words with the current TG president.

asnarong

Believe me,THAI has much more than 14929 gold members,at least 4-5 times.HA HA

50%mile is for gold member right now.
For others it starts 16 June 13.

You can start travel from outside BKK
but destination must be BKK AND BACK TO SAME CITY AS DEPARTURE ONLY.

Airbumps

Well picked up A_Lee,

I got the 50% Gold email with the unique ID as well. Very amateurish and clearly a security issue.

I wonder what Lars has done to be #1 on the list?

forumpersona999

Offer not valid to and from LAX so perhaps you have a US mailing address with ROP and they didn't send it to you for that reason?

EzzerBKK

nothing from Thailand as well

So our loyalty at home base is not worth their while?

glad BR is joining *A...