An airline's horribly flawed online ticket reservation system



  • Lately, I was browsing the homepage of an airline holiday flights. The prospective flight date wasn't too far off, so there weren't many low-price seats left on those planes. When I had decided on a route for my friend and me, I clicked 'next' in their online form, taking me from the date/price overview to entering the names of the passengers. I entered my name, and... Aw, shoot. I'd forgotten to choose 'two passengers'. So I went back, picked our date/price again, entered my name and... Oh dammit, I forgot to put in my friend's name as well. So I went back, and did it all right this time, only to see that they wouldn't accept any other means of payment other than credit cards. Well shoot, I don't have one.

    So I called up their hotline (which has a very good service and friendly operators) and asked them how I could book a flight witout a credit card, and the lady told me that this would only be possible through a travel agent's. Very well, it would mean an extra booking fee, but I didn't seem to have a choice. I thanked her, hung up and called up Germany's two or three most popular online booking sites. I entered our flight dates and... WTF!? All of a sudden, the flight costs almost 100 Euros more per person. Wait, they had to be wrong, I'd been about to book the flight at the lowest possible price just five minutes ago! But all the other booking sites concurred. I headed back to the airline's homepage - at least they would have to be right about the state of their reservations. But there it was, no more cheap seats, and my holiday looking blown.

    Determined to get to the root of this, I called up their hotline and explained my dilemma. "Well," the lady said, "somebody must have booked all the remaining seats just now!" Something horrible was dawning on me, and I asked very carefully, "C-Could it have been... me?" I told her my name and that I had entered it into the reservation form a couple of times, but always aborted the process for some reason or other. She went clickety-click, and - "Oh yes, that's you! I see that you've made three reservations!" She was kind enough to cancel the redundant reservations and call me back later so I could book the flights with a friend's credit card.

    Only when I had hung up did I realize what this incident revealed about their website. Any person with a browser could pick out a flight, enter the names of Donald Duck and Oscar Wilde for travellers, click 'next' and then just close their browser window, and to any travel agent's office and travel booking site in the world, these seats would be shown as unavailable, forcing others to pick seats at higher prices or even change their flight dates. IMO, this is a terrible vulnerability, allowing people to DoS the airline itself without anybody noticing.

    Now, I don't know what to do. I can't call the hotline about this, because the ladies there don't know anything about their website's design, and I'm sure they couldn't just get a developer on the phone. If I wrote and email to some service address of theirs, I'm certain it would be answered with some standard response about how they appreciate my input and then be forgotten. In short: I seem to be unable to reach anybody at that company who would understand the seriousness of this and be able to do something about it. What do you suggest I do?



  • @mtu said:

    So I went back, and did it all right this time, only to see that they wouldn't accept any other means of payment other than credit cards. Well shoot, I don't have one.

    So I called up their hotline (which has a very good service and friendly operators) and asked them how I could book a flight witout a credit card [ . . . ] I headed back to the airline's homepage - at least they would have to be right about the state of their reservations. But there it was, no more cheap seats, and my holiday looking blown.

    As a matter of interest, which airline is this? A similar thing happened to me this week - fill in details, get to last page credit card only - OK, ring the helpline to see if I can pay by debit card. In this case, the UK hotline was not so much "friendly" as "non-existent". "You are being connected to a chargeable service", blah blah - then a few seconds of old-style "no such number" tone, and then silence.

    The fare for that flight on that date has since gone up as well. That's over a period of a couple of days though, so could be genuine i.e. not due to this WTF. I could try their homeland contact number, but I don't think my conversational Slovak is up to the task.

     



  • Well, IMHO, the best way to "report" this problem would be to actually DOS a couple* of flights. Through Tor of course, don't want them tracking you down and arresting you as a "cyber terrorist"...

    If they have anybody approaching competent working for them , then they should fix the issue fairly quickly if it starts eating into their bottom line.

    *Depending on how malevolent you feel, "couple" can mean as many as you like... At peak times...



  • @mallard said:

    Well, IMHO, the best way to "report" this problem would be to actually DOS a couple* of flights. Through Tor of course, don't want them tracking you down and arresting you as a "cyber terrorist"...

     

    No, you don't want to do that, since it increases the price for people who do want to go on that flight and it might also increase revenues for the airline company. So you're hurting the innocent and pleasing the guilty. Seems wrong to me.

    Just write them a letter, like you know, snail mail? Usually, larger companies have a decent staff that responds to these letters and they might actually find the IT-department responsible.



  • It's not uncommon for sites to reserve your tickets the moment they show them to you, so as to avoid getting you all the way to the end of purchasing them and then informing you that all the tickets are already gone. Typically the sites only hold such reservations for a short period of time, usually a few hours or less. The airline probably isn't going to see it as a big problem, especially because many airlines intentionally overbook flights anyway. It's also not uncommon for ticket prices to jump up suddenly. Airlines are funny in that on really popular flights, they up their prices, and on really unpopular flights, they up their prices.



  • @bstorer said:

    Typically the sites only hold such reservations for a short period of time, usually a few hours or less. The airline probably isn't going to see it as a big problem, especially because many airlines intentionally overbook flights anyway. It's also not uncommon for ticket prices to jump up suddenly. Airlines are funny in that on really popular flights, they up their prices, and on really unpopular flights, they up their prices.

    You're right, but I do think this is significant. In my case, I have observed that the reservations were active in the system for more than three hours, which is a long time if you consider the number of requests that are likely made by travel agents and travel sites all over the world. 



  • @mtu said:

    You're right, but I do think this is significant. In my case, I have observed that the reservations were active in the system for more than three hours, which is a long time if you consider the number of requests that are likely made by travel agents and travel sites all over the world. 
    Oh, I don't doubt that their system is poorly designed, just whether they'll even care.



  • @mtu said:

    Only when I had hung up did I realize what this incident revealed about their website. Any person with a browser could pick out a flight, enter the names of Donald Duck and Oscar Wilde for travellers, click 'next' and then just close their browser window, and to any travel agent's office and travel booking site in the world, these seats would be shown as unavailable, forcing others to pick seats at higher prices or even change their flight dates. IMO, this is a terrible vulnerability, allowing people to DoS the airline itself without anybody noticing.
     

    I did some work on an online reservation site (not an airline). When you make an reservation there, it is temporary locked in the system with a precofigured timeout (shown as unavailable to everyone). If you do not go to checkout within the timelimit, and complete the payment, the reservation is automatically removed from the system.

    IMHO the WTF is not showing the seats as unavailable. But if they do not free them after a while, that would be a problem.

    The alternative is not to make a reservation until the payment is made, at which point, the requested timeslot may not be available any more. 




  • TRWTF is that we have two people so far that are unfamiliar with credit cards being required for reservations -- whether airline, hotel or rental car. 



  • Not necessarily, credit cards are very common in some parts of the world (anglo-saxon and Scandinavia spring to mind) but a lot less or even quite rare in other parts (most of the rest of Europe, for instance).



  • @Monomelodies said:

    Not necessarily, credit cards are very common in some parts of the world (anglo-saxon and Scandinavia spring to mind) but a lot less or even quite rare in other parts (most of the rest of Europe, for instance).

    So, like, how are they guaranteed to get compensated when you have one of your epic post-show parties and the entire room ends up trashed with feces smeared all over the walls, plumbing ripped out of the bathroom and reassembled on the balcony and several small furniture fires?  Huh?



  • @morbiuswilters said:

    TRWTF is that we have two people so far that are unfamiliar with credit cards being required for reservations -- whether airline, hotel or rental car.

    @Monomelodies said:

    Not necessarily, credit cards are very common in some parts of the world (anglo-saxon and Scandinavia spring to mind) but a lot less or even quite rare in other parts (most of the rest of Europe, for instance).

    Credit cards are common enough here -- and so is being able to use a debit card instead (if you've got the funds of course). It's just that this website doesn't make it clear whether you can do that in this case. (FAQ and reservations form disagree.)

    @morbiuswilters said:

    So, like, how are they guaranteed to get compensated when you have one of your epic post-show parties and the entire room ends up trashed with feces smeared all over the walls, plumbing ripped out of the bathroom and reassembled on the balcony and several small furniture fires?  Huh?

    Oh well, I guess I'm not taking my troupe of juggling, fire-eating carpenters, upholsterers, plumbers and wallpaper-faeces-removers on that European tour this year after all then. The irony is, if we weren't so gosh-darn successful at home, then maybe I'd need a credit card rather than a debit card...

     



  • @morbiuswilters said:

    So, like, how are they guaranteed to get compensated when you have one of your epic post-show parties and the entire room ends up trashed with feces smeared all over the walls, plumbing ripped out of the bathroom and reassembled on the balcony and several small furniture fires?  Huh?
     

    LOL... I dunno. They'd probably consider calling the rozzers on me ;-)



  • @mtu said:

    Only when I had hung up did I realize what this incident revealed about their website. Any person with a browser could pick out a flight, enter the names of Donald Duck and Oscar Wilde for travellers, click 'next' and then just close their browser window, and to any travel agent's office and travel booking site in the world, these seats would be shown as unavailable, forcing others to pick seats at higher prices or even change their flight dates. IMO, this is a terrible vulnerability, allowing people to DoS the airline itself without anybody noticing.

    S.O.P. for most of these sites. I remember running into this while booking a bus ticket for the return leg of a trip some months ago. The page timed out (I was checking with a friend on the phone about my timing and such) and when I went back to the page, I found that somebody had already taken my seat. I selected another seat, then something else happened with the page, so I had to begin all over again... and found my seat taken again.

    I figured the system was doing some kind of pre-reservation. I proceeded to complete the thing and ... wham, my Credit Card is declined. Oh well ... try again with another one, right? Except I had to do the entire process again. And guess what, I accidentally swapped the origin and destination fields when I finally went through ... so I had to go to the Ticketbus agency to change the damn ticket. Ugh.

    Anyway ... if you don't have a credit card, you should have a "Mastercard" debitcard, shouldn't you? Those work on these sites as well. I expect any respectable website to accept creditcards, as they are the only truly international payment method.



  • @bstorer said:

    It's not uncommon for sites to reserve your tickets the moment they show them to you, so as to avoid getting you all the way to the end of purchasing them and then informing you that all the tickets are already gone.
     

    Even "worse", a popular airline booking system requires you to reserve some number of seats before checking availability, and before booking. And if you want to book a multi-segment flight (that provides you with a discount over the single flights), you will have to reserve the exact combination of segments you want to book. Which can lead to a problem if you want to check several alternative "second segment" alternatives for the only available"first segment", because your reservations will eventually block each other's seats. Or if you release each "alternative" reservation before trying the next one, it can happen that at the point where you want to reserve the right combination for booking, someone else has taken your seat.

     

    But in practice, this does not seem to be a big problem, it is just "WTF"y when you hear it first.

     

     



  • Once I was able to "reserve" blocks of concert tickets this way until I managed to bypass all the seats I didn't want and get the exact center aisle seats I wanted. I'm fat, I needed the room!



  • Second world, meet third world.



  • I suggest you forget it--that's how the system works.  I've spent the last 12 years of my life in this business, so I know something about how this works.  The seats would have returned to inventory once a timeout had expired.  The airline usually does a short sell instead of a long sell, which would have required you to get all your information entered before they tried to officially mark the seats for you.  By that time, someone could have scarfed them out from under you, and they'd have had to reverse the charge approval, etc.  So, had you and the nice ladies at the call center waited long enough, the holds would have expired and the seats returned to inventory.

    The sad fact is, if they don't sell the seats first, they can't get a price to show you in the first place.  That's not so much the airline's issue as the host (GDS - Global Distribution System) behind the airline.  I don't understand why it works that way myself, but be kind to the airline.  In most cases they're dealing with 30-year-old seating inventory systems that were written in COBOL, and there's not a lot they can do about it, because there aren't that many GDSes to choose from.  Most GDSes were designed to be run from terminals, not driven by software, and the things that can happen when software drives the process just didn't happen when plain old people spent hours checking in large queues of passengers at the airport.  Most of the GDSes are still working on accommodating the demands of automation, even 12 years after this sort of thing came into vogue.

    I'm currently leading a team working on a booking engine, and I promise you, trying to determine if someone is making a second reservation on the same flight by mistake is a fairly difficult task to parse out.  The reservations aren't stored by names, addresses, and shoe sizes, they're stored by unique identifiers that generally aren't used again until check-in.  Pulling an entire flight manifest and doing name-matching to determine whether or not the latest reservation form submit represents someone already on the plane (hey, the odds are there are already two other guys named "Jim Smith" on the flight if the plane is big enough) is a computationally slow and error-prone process.  You really don't want me to go there.  There are other approaches I'm looking at, and I'm not going into any details (intellectual property and patent issues, etc.), but trust me, it isn't as easy as it looks.  Don't try this at home, kids.

    But, if you just must have this fixed, write your own GDS and start selling it to the airlines.  I'll be happy to write a booking engine for it.



  • If you actually go to a real travel agent and watch them operating the system, it's quite amazing. As Prog Guy said, it's a lot more complex than you think. In fact, it's possibly even more complex than air traffic control and we all know how many billions of WTFs that can create. (Google for FAA Advanced Automation System.)

    There's all sorts of special keystrokes that "reserve" a seat and a heck of a lot more classes than just first, business and economy. The fact that this can be condensed down into something that's reasonably usable for first-time users in a stateless environment is one of the great triumphs of software development. This is the exact opposite of a WTF.



  •  My wife did a similar thing booking our holiday to Japan (due next year). She is a constant worrier so she was checking the site every few hours and getting increasingly worried as the flight was filling up! Not only that but the seats that we wanted were going first! (We are both over 6 foot tall so we require the extra legroom seats. We had requested a redraw on the home loan which took a few days before we could pay for the tickets.) Within a day all the suitable seats were gone!

    Then we realised what was happening. It took 24 hours for the seats to become available again, so at least it all ended well. Our tickets are booked in now.



  • @Qwerty said:

    If you actually go to a real travel agent and watch them operating the system, it's quite amazing. As Prog Guy said, it's a lot more complex than you think. In fact, it's possibly even more complex than air traffic control and we all know how many billions of WTFs that can create. (Google for FAA Advanced Automation System.)

    There's all sorts of special keystrokes that "reserve" a seat and a heck of a lot more classes than just first, business and economy. The fact that this can be condensed down into something that's reasonably usable for first-time users in a stateless environment is one of the great triumphs of software development. This is the exact opposite of a WTF.

    Back in 2005, we had a school project involving a proposal for an airline baggage tracking system. As part of our investigation, we got to know how the SABRE system works (Prog Guy, you already know what I'm talking about!) and well, it might look archaic to regular users, but travel agents love it! I remember this guy showing us how he could basically check seating availability with 5 keystrokes and such.

    I remember that one guy in our team said something like "geeze, those airlines would wish they had a Windows GUI!", to which our friendly agent rebuked him, telling us that changing the few-keystroke system to a mouse-driver GUI would slow them down (not to mention adding unnecesary instability.)



  • Put the unique id in a cookie. Problem solved.

    Admittedly, I've heard from a friend in the biz that *implementing* that solution requires a major overhaul of the system, due to trusting certain forms of security by obscurity. Also, the powers that be actually *like* the fluctuating prices, as some people buy the overly expensive tickets not realizing that they'll be going down when some phantom reservations time out, or not wanting to bother waiting, so they're not motivated to fund the fix.



  • @mrprogguy said:

    The sad fact is, if they don't sell the seats first, they can't get a price to show you in the first place.  That's not so much the airline's issue as the host (GDS - Global Distribution System) behind the airline.  I don't understand why it works that way myself, but be kind to the airline.  In most cases they're dealing with 30-year-old seating inventory systems that were written in COBOL, and there's not a lot they can do about it, because there aren't that many GDSes to choose from.  Most GDSes were designed to be run from terminals, not driven by software, and the things that can happen when software drives the process just didn't happen when plain old people spent hours checking in large queues of passengers at the airport.  Most of the GDSes are still working on accommodating the demands of automation, even 12 years after this sort of thing came into vogue.

    But, if you just must have this fixed, write your own GDS and start selling it to the airlines.  I'll be happy to write a booking engine for it.

    As someone who worked on the reservations system for 3 airlines, and 2 GDSes, let me correct some mistakes.

    1. it's written in TPF, not COBOL. About as old, but far more esoteric. Essentially 370 assembler but is slowly migrating to C++. the reservations system was built 20 years before the internet came along, and has lots of business processes that aren't going to change overnight just because it makes more sense from a web customer point of view.
    2. booking and ticketing are 2 seperate processes. You can book (reserve your seat) generally 24 hours ahead of when you have to ticket. It used to be 3 days. Obviously this changes when you get closer to flight date.

    What the airline ticket agent should have (and could have) done is say: you have 3 reservations - let me correct one of them for you. You can then go buy it / pick it up at the airport or a ticket office (for the airline), OR she could have even released it to a travel agent. The travel agent would have to call the airline, but assigning it from one to the other is possible. At least on Galileo / Travelport it was.

    You're right though, the airlines have had 20 years to complicate the living bejesus out of this system. Ask about flying with a Cello sometime. I'm glad to be out of that business though. Airlines are perpetually going out-of-business.



  • @morry said:

    What the airline ticket agent should have (and could have) done is say: you have 3 reservations - let me correct one of them for you. You can then go buy it / pick it up at the airport or a ticket office (for the airline), OR she could have even released it to a travel agent.

    In my case, that is what she (how come it's automatically a 'she'?) did. As I said, their hotline was very friendly and helpful.



  • This post is deleted!

Log in to reply