Comment by phphphph

> Using just these two values, an attacker could completely manage any aspect of a flight reservation using United’s website.

Don't most airline websites allow that when you get the last name and date of departure right?