jimmc66

I don't want "cookies that last forever".

I have a high-level IT contact at UA in Chicago. I recently had password reset attempts (not me) on my UA, AA, and IHG accounts. I reached out to UA and was told that the travel companies generally under attack by identity thieves - a leak at one unnamed travel company was being exploited. United's philosophy is in part to tighten up login procedures via web browsers during these periods of vulnerability. I note the same lack of persistence in my UA connection on MacOS (Ventura) but not on my iOS devices, which are inherently more secure.

As always, complex passwords are required especially on accounts where financial exposure is likely. And don't use the same password from place to place. This isn't an issue to joke about, or ..... about IMHO.

fly2nrt

Still crappy....

mahasamatman

I do. When I login on my laptop, I never want to be logged out. Ever. Just like gmail. The more often you have to login, the higher the probability that your login will be compromised.

50Kthehardway

Yeah, but it would be nice to have them last a little longer than this:

1. Go to united.com (Chrome)
2. log in
3. answer the security questions
4. click on check-in to print a boarding pass
5. receive message that session has expired
6. go back to step 2 and endlessly loop

txirish

Long lasting cookies aren't necessarily weak security. Why not keep people logged in (and stop the annoying auto-logouts, too) so they can easily search flights with their status reflected, book tickets in their own name, and perform other low risk functions. If they want to transfer miles, book tickets for others, etc., then reauthenticate them. (Amazon does that, for example, if you ship to a new address or want to send gift cards.)

Hipplewm

Maybe this is also why we can't see LH awards either....or hopefully it is fixing why we can't see LH awards....

mfirst

As touched on- I wonder if this is intentional due to some increased hacking attempts against the site?

Lux Flyer

Believe this was an error on Lufthansa's end providing correct availability and it should have been fixed as of end of last week.

mjm

There are no ANA awards listed in any class either. It would seem the system is very out of whack

Hipplewm

Maybe you got them, but I didn't.

I just searched again - for an easy one - ORD-FRA - the ONLY LH options I got where ORD-CDG-FRA where CDG-FRA was operated by LH - basically not a single flight over the pond was operated by anything other than UA in my search results

Maybe it is just me....

rsolomon

Then they should at least get rid of the "Remember this device" option and replace it with "Until further notice you'll have to enter these answers every time you connect" with no options.

I don't agree this is the right response to the claimed situation, but if it is then communicate better and consider doing something actually effective like requiring stronger passwords rather than continuing to inconvenience customers.

"To improve security of your accounts, the bank will no longer offer online services" - I mean yeah, that's true, but something about babies and bathwater comes to mind.

Waldofriend

I had expert mode working fine on my PC up until a day or two ago. That's OK - I can live without it until they fix it. However, today for the first time I got a new error when I tried to check in for tomorrow's flight. After login, as soon as I hit the check in button, I get a 'session expired' error message and it kicks me out. I've rebooted, cleared the cache and cookies and tried it again four times now, with the same result. No problem though when I went to the app on my phone and I checked in without issue and got the boarding pass. However, when I went back to the computer and to the UA website and logged in, it shows me as still needing to check in. Guess what happens when I click on the check in button? ;-)

legalalien

My (fairly long) career in software development and application security has taught me that if it looks like broken functionality, it likely is broken functionality. Not a deliberate choice. If they were serious about security, they'd implement multi-factor authentication, replace forever-cookies with 30-day cookies, and get rid of passwords altogether.

2ptraveler

What UA is doing with pull down responses to security questions is the dumbest thing ever. This method in and of itself is considered one of THE worst security failings in the IT security world.

They need to deploy a proper 2FA/MFA for browser based connections. There's simply no reason this can't also work with TA's access to your account. Personally, I'd want to have to respond to a 2FA request when my account is being accessed.

mfirst

Look on the bright side- we don’t have to deal with captchas