Skip Links

Network World

  • Social Web 
  • Email 
  • Close

Uniqueness, hotels and OpenID

Arriving at a hotel that doesn’t have records of your reservation
Security: Identity Management Alert By Dave Kearns , Network World , 06/13/2007
Kearns
Sign up for this newsletter now!

Dave Kearns provides the information you need to evaluate, install and maintain your corporate identity management system.

  • Share/Email
  • Comment
  • Print

Back in 1996 I wrote a column for Network World talking about some travel woes I’d had. A recent discussion about OpenID reminded me of that column, and I think that it’s still relevant today.

Back then, Comdex was the biggest thing going in technology trade shows; participants pretty much bought out all of the hotel space in Las Vegas for the duration of the show – you needed to reserve a year in advance to get any hope of landing a good room. I made a last minute decision to go that year, and was faced with finding a room with only two weeks to go. It seemed like an ideal time to try out the then new Expedia travel service. I booked a room through Expedia, but on arrival in Vegas the hotel denied any knowledge of me. Even the confirmation number I had was different from the style used by the hotel. The kicker, though, was that the rate I’d been quoted was actually higher than the hotel charged. After some three-way conversations with the hotel and Expedia, the hotel did put me up. I later discovered that the reservation service Expedia used had booked me into a hotel in Moscow, not Las Vegas! You can read the whole story here.

Expedia, like most travel agents, didn’t book directly with the hotel but with a reservation service. The reservation service keeps a database of all its hotels, identified by a property number so that there’s no confusion about which hotel is being booked. Did you know, for example, that Florence, Italy has at least three hotels called “The Grand Hotel”? When Expedia made a reservation, it was done by property number, not by hotel name or location. The Las Vegas hotel had dropped out of the reservation service some months before this booking, but Expedia’s database hadn’t been updated. The reservation service, though, re-issued the property number to a Russian hotel. Thus the mix-up.

The reservation service’s property number is meant to be a unique identifier for the property. And, under one definition of unique, it was. The number did only exist once in its database. But because the data from that database was distributed to many other places (such as Expedia), and because there weren’t good synchronization procedures in place (if any at all), it really wasn’t unique – the same identifier was attached to two different entities!

Dave Kearns is a consultant and editor of IdM, the Journal of Identity Management.

  • Share/Email
  • Comment
  • Print
Partner Content

Brilliantly simple security and control solutions for email, web and endpoint

www.sophos.com

Stopping data leakage

Learn how to exploit your current security investment to control the information that flows into, through and out of your network.

Download the white paper.

Why detection rates aren't enough

Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.

Download the white paper.

Applications: taking back control

Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.

Learn more today.

Comment
Login
Forgot your account info?
Add comment
Anonymous comments subject to approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed