Qantas ff account hacked

[opusman]

The less people that know you pin, including 3rd party apps the better! Without knowing where and how they store / transmit your data, it is another risk I am not exactly comfortable with. All it takes is one rogue employee regardless of how secure they think things are.

One rogue employee, one badly configured server, one unpatched bug - the number of ways your data can be stolen from a website are numerous. Look at the recent Yahoo breach, 1 billion accounts stolen back in 2013 and they've only just decided to let people know. Plug your email address into https://haveibeenpwned.com/ and see how many breaches it turns up in - you might be surprised.

This is why I'll never use the AFF Verified feature. AFF themselves may have the purest of intentions but how can you know for sure how secure their system is?

Same as that POLi thing, I can't understand why anyone would trust that. You are giving out your internet banking login details to a third party and trusting them to keep them safe. If (when) their system is breached, and your account details stolen, do you think the banks are going to reimburse you?

 

[prozac]

...
This is why I'll never use the AFF Verified feature. ...

What's that?

Same as that POLi thing, I can't understand why anyone would trust that. You are giving out your internet banking login details to a third party and trusting them to keep them safe. ...

And that too?

 

[opusman]

What's that?

AFF Verified Airline Status

And that too?

https://www.polipayments.com/

 

[prozac]

AFF Verified Airline Status
https://www.polipayments.com/

Thanks, just googled also - https://en.wikipedia.org/wiki/POLi_Payments
CBA not recommending it.

 

[JohnK]

I use Awardwallet - it provides notification of changes to point tallies at least once per week.

I wouldn't feel comfortable giving my pin to a third party.

 

[moa999]

POLi's original version opened the actual bank site in a frame but injected some scripting to auto create BPay accounts and confirm the result.

The more recent version of the POLi site which substantially simplifies the experience is very much pass thru...

I was always surprised that BPay never countered POLi by supplying some form of secure hash.

Eg. Pay $199 to this Jetstar account. You go into internet banking and pay it, and it generates a hash of some sort.
Paste that back into the Jetstar site and payment validated and ticket confirmed

 

[opusman]

The more recent version of the POLi site which substantially simplifies the experience is very much pass thru...

Makes no difference, you're still giving your credentials to a third party.

 

[ozbeachbabe]

POLi's original version opened the actual bank site in a frame but injected some scripting to auto create BPay accounts and confirm the result.

The more recent version of the POLi site which substantially simplifies the experience is very much pass thru...

When JQ were charging $8.50 as a credit card fee unless you paid with a JQ Mastercard POLi nay have been atteactive for some however JQ have reduced the fees substantially almost eliminating the need for POLi at all.

The fare I purchased last month for BNE/SYD on JQ58 was a $65.00 hot fare and the total cost was $65.69 with the cc fee.

Pretty happy with that plus enjoyed a nice brekkie in the new QF J Lounge at BNE Intl.