It turns out that the travel reservation site 'I see people other than you now' was a lie

When searching for accommodations or boarding passes on accommodation reservation sites, flight reservation sites, etc., a small message next to the search candidate such as “None of you are watching the same page now” is displayed. There are times. In overseas travel reservation site OneTravel, security researcher Ophir Harpaz discovered that this displayed number was not a real-time number of simultaneous connections to the page, but actually a random number.

When Mr. Harpaz tried to reserve a boarding pass for an airplane with OneTravel, it was said that '38 people are checking this boarding pass', in order to expedite the reservation purchase. “Is 38 people checking?” Harpaz was impatient, but he seemed to have doubts that 38 people were checking this boarding pass.

Therefore, when Harpaz confirmed how this number was acquired, it turned out that the class name of the element corresponding to “38” is “view_notification_random”.

Furthermore, when Harpaz checked the source code using Chrome's developer tools, he found the following parts in JavaScript. It turned out that numbers from 28 to 44 were completely randomly generated and only displayed. In other words, the part “One person is checking this boarding pass” of One Travel was a lie, and it was meant to prompt the user to make a flight reservation.

Isn't this way illegal for Harpaz's tweet? There are many voices.

“I don't know what will happen in the US, but in the EU, OneTravel is penalized for scamming consumers.”

Some people sympathized with the site developers, 'Maybe the developers haven't agreed with this method, so they didn't hide the source code on purpose.'

On the other hand, 'Math.random () is not secure for encryption. I use Crypto.getRandomValues (),' and some people messed up the code for random number generation.

in Web Service, Posted by log1i_yk