5

In general, when someone has the six number-letter combination reservation number aka. record locator and the last name of the traveler they can alter and cancel the reservation. Is there a generic way to add additional protection?

Edit: the answer is no and this is a known security problem.

  • 1
    Don't tell anyone what your PNR is. –  Apr 15 '16 at 02:41
  • 2
    Six letters and digits are providing less than 32 bit of secrets. That's extremely poor these days. There are botnets with two million computers, if each tries one combination every four seconds then you tried all there are in an hour. –  Apr 15 '16 at 03:02
  • 1
    @ctx it's six letters and digits + a last name, which is a lot more secure. – JonathanReez Apr 15 '16 at 08:56
  • My last name is not exactly a secret... but beyond a very expensive to resolve prank there are many scenarios where someone else might've paid for your trip (not everyone has credit cards etc) and so they might have your PNR and you just don't want them to mess up. –  Apr 15 '16 at 09:43
  • @chx if someone paid for your trip then I guess you're at their mercy. Buying a plane ticket implies a certain amount of trust in a relationship, after all. – phoog Apr 15 '16 at 12:10
  • @JonathanReez - actually it would be the six digit PNR plus the last name plus 100+ airline companies to choose from. But sounds like maybe someone had a 3rd party pay for their and perhaps a falling out has occured and they are worried about the credit card holder reneging on the ticket. –  Apr 15 '16 at 12:44
  • @Tom There are only four major GDSes and a handful of airlines who use an in house solution. So for instance if you have a BA/CX/QR/AY/QF... reservation (on Amadeus), you can look it up on Qatar's site or any other generic Amadeus site such as classic.checkmytrip.com. You can also guess a GDS from the PNR, for instance Sabre only uses letters. – Calchas May 21 '16 at 14:09
  • @chx Most airlines outside of North America continue to accept cash :) – Calchas May 21 '16 at 14:15

2 Answers2

5

I have looked into this in the past and it's very disappointing how insecure this functionality is in general. The only specific additional security I could find was the Amadeus PNR Security Element which states this:

PNR Security

Amadeus individual pnr security allows you to set up special security rules so that a pnr can be accessed by one or several other offices.
The PNR security functions may allow access to a PNR even when there are no other special agreements in place and can override agreements that are contained in the current security tables. PNR security allows you to share PNR viewing and/or updating capabilities, without changing PNR accordingly.

Creating a pnr security element

The individual pnr security element is an un-numbered and can only be created by the responsible office.
R = For read only access: it is possible to view the pnr, but no updates are allowed. In this case the agent is given an error message at the time any pnr update entry is attempted.
B = For both read and write access: full pnr update is allowed, except for change of ownership.
N = For no access: the office id specified cannot retrieve this PNR via extended security agreements. (This overrides EOS)

Office IDs can include wildcards.

To enable this, it sounds like you'd have to book via a trusted travel agent who could set these specific GDS parameters for your PNR.

Glorfindel
  • 6,075
  • 7
  • 42
  • 54
Berwyn
  • 28,476
  • 6
  • 72
  • 141
  • 1
    It also sounds like this could cause you serious inconvenience if you come across someone who is not familiar with the security and you needed to make an urgent reservation change. – Calchas May 21 '16 at 14:14
  • Yes, I think it's safe to say if you go down this route, everything you do will be via your TA – Berwyn May 21 '16 at 16:26
2

A secret key of 6 alphanumerics is, in itself, reasonably secure. There are 2,176,782,336 possible combinations, making it (in combination with a single username) effectively unguessable.

There are a lot of infrastructure problems -- you have give the key to agents and CSRs, it is delivered by email, etc. -- but any secret of any length has that problem.

Michael Lorton
  • 8,556
  • 27
  • 34
  • 2
    I booked several flights a few days ago, all of them started with 5W. I don't think the entropy of record locators is anywhere near of that of a random character sequence generator – Berwyn May 21 '16 at 17:43
  • It depends on the airline. The airline controls what can and cannot go in the PNR. If all your PNR are starting with 5W, it seems that the airline is controlling it. I booked two flights with Emirates; and the PNR is wildly different. – Burhan Khalid Jan 02 '17 at 07:36