United Airlines Sets Minimum Bar on Security
Summary: United Airlines replaced its frequent flyer 4-digit PIN with a password plus five security questions whose answers are pre-selected from drop-down menus, such as choosing a month for when you met your spouse or a pizza topping. United's director of IT security intelligence Benjamin Vaughn said the questions are randomized to confound bots and that wrong answers get locked, while CISO Arlan McMillan said the system sets a minimum bar and is built to add controls such as TOTP later.
Key Takeaway: Krebs unlocked his own locked account with a customer service agent who asked only for his frequent flyer number and his name, and Google's research cited here found that when users must answer two secret questions, an attacker's chance of getting both in ten guesses is 1% while users recall both only 59% of the time.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026