28

I tried opening the home pages of a few airline websites through the Tor browser and instead of the home page all I see is a low-key page with "Access Denied".

Why would airlines want to prevent access / ticket purchasing through Tor?

  • 7
    You might get more answers on the Tor StackExchange site: tor.stackexchange.com – DavidSupportsMonica Dec 27 '19 at 19:41
  • 6
    @DavidSupportsMonica this seems more of an airline issue than a Tor issue. If I was asking "how" then yes, for sure – Sparkler Dec 27 '19 at 19:43
  • 2
    @DavidSupportsMonica They will probably close it as a duplicate of this question though, which is what they've done with every other similar question. – Michael Hampton Dec 27 '19 at 20:53
  • 3
    Airline websites are not something that will normally be hazardous to access. Hence most anyone using TOR to access one is probably up to no good. – Loren Pechtel Dec 28 '19 at 4:05
  • 3
    The very simple answer here is "lots and lots of everyday, larger corporate web sites block TOR." It's really not "a big deal". And there's no "really specific" reason it's done. – Fattie Dec 29 '19 at 18:41
70

Credit card fraud is a considerable problem for airlines. You would think the fraud risk would be low—after all, passengers usually have to appear in person with photo ID to make use of the service—but as there are a number of types of fraud, "airlines alone lose from $2.4 billion to $4.8 billion to credit card fraud annually." In particular, fraudsters can buy airline tickets with stolen credit cards and then setup fake travel agencies (online or offline) to resell them to real travelers. Sometimes fraud occurs within real travel agencies, with an insider pocketing the real funds and booking the ticket with stolen card details. Frequently flyer accounts can be compromised and the miles used to book flights that are resold. Others fly using stolen cards as part of criminal activity (if travelers are caught when this happens, they can claim to be a legitimate traveler who has fallen victim to one of the above types of fraud), with tickets sold on blackmarkets accessible over Tor.

Airlines seek to reduce their exposure with a variety of fraud detection and risk management systems. Bookings via Tor can represent a high risk. Airlines don't want anonymous customers; they want customers who provide as much information about themselves as possible. Customer IP addresses can be used as part of fraud detection systems to identify high risk transactions (this is more difficult for airlines than in other industries, as legitimate customers are likely to need to purchase tickets while traveling). Airline policy may require more scrutiny in these cases, such as requiring the original credit card be presented at check-in (this sometimes varies depending on the country of purchase, in accordance with fraud risk) or even declining the transaction and requiring the customer purchase the tickets in person at a sales office in some countries.

Airlines also use rate-limiting on their websites to prevent bulk automated access. They want to block repeated login attempts to compromise frequent flyer accounts and don't want people trying to scrape their fares from the booking engine. They block anonymity networks that could be used to help defeat such measures.

I suspect airlines see no real upside in allowing bookings over Tor; legitimate customers need to identify themselves anyway, and few travelers will refuse to purchase if Tor is blocked. But there's clearly a cost, in that it makes things easier for those committing fraud. As such, the decision to block access comes easy for them.

| improve this answer | |
  • 2
    what about geosegmentation? – Sparkler Dec 28 '19 at 4:09
  • 10
    +1, but it's not just credit card fraud, but also bots nabbing cheap tickets and holding inventory. Blocking them by IP becomes impossible if you allow Tor. – lambshaanxy Dec 28 '19 at 5:05
  • 8
    @Sparkler Some airlines do have different prices based on the booking country on some routes, but that's usually handled through things like the booking channel used, payment method, and route chosen (round trip with a particular origin) rather than just IP address detection. I doubt "someone could use a Tor exit node in a particular country" is the main concern given the broader existence of VPNs and the other factors that go into airfare pricing, but it could be part of the reason it's blocked. – Zach Lipton Dec 28 '19 at 5:57
  • 6
    Zach, I would just say I doubt that Airline X, sat down, had a careful meeting about the issue, and decided "Due to > credit card fraud < we will now specifically block TOR users." More than likely some low or mid level staff member ticked a "might as well block TOR" box somewhere with little thought on the matter. – Fattie Dec 29 '19 at 18:45
  • 2
    How is that reselling even possible? Don't airlines forbid it by default? – vsz Dec 31 '19 at 9:09
43

This doesn't happen with all airlines, obviously. I tried to visit several airlines with Tor and found I could not access Lufthansa or Air Canada, but I could access British Airways, American Airlines, Air India, Emirates and Etihad.

In the two cases, I saw the following error:

Access Denied

You don't have permission to access "http://www.aircanada.com/" on this server.

Reference #18.acbc3b17.1577480243.f2b7aef9

This error comes from the Akamai CDN, which blocks all Tor exit nodes. Any web site that uses Akamai to serve its content will also, as a side effect, block Tor access. This is not necessarily a decision that those airlines have taken explicitly, but Akamai does offer its customers the option of blocking Tor exits, so they may have chosen to do so, either explicitly or by default. The airline could turn this off, but good luck getting through to the person (or people) who can actually do it or order it done.

| improve this answer | |
  • 18
    The decision to block Tor or not when using Akamai is configurable by the customer. So in effect, the Airline HAS made the decision (either implicitly or explicitly) to block Tor traffic. – Doc Dec 27 '19 at 21:07
  • 1
    @Doc Yeah that's a good point. Now I wish anyone good luck in getting them to change it. The people who answer the phones and email aren't going to even know anything about this. And of course, the people who did do this probably just accepted the defaults without much consideration. – Michael Hampton Dec 27 '19 at 21:36
  • 9
    Having worked in the web anti-fraud industry for several years, including having worked with some airlines during that time, I seriously doubt this is a "accepted the defaults without much consideration" type of situation. – Doc Dec 27 '19 at 22:00
  • 1
    @MichaelHampton, And this is actually truer still if my IT department was vastly underfunded. After all, if I'm only getting underpaid to keep things running and for keeping things secure, and if this setting was only a checkbox on Akamai, you can be sure that this decision would be a no-brainer for me. The fact is, the extra revenue that Tor users represents means absolute nothing to me, I'm just the IT guy. If someone in finance or marketing wants to override that decision, I'm fine with that. But as an IT guy, the only thing that I'm really concerned with is uptime and security. – Stephan Branczyk Dec 29 '19 at 20:08
  • 1
    And if someone did override my decision, you can be sure that I would confirm that override over email (plus, I would probably carbon copy a couple of other stakeholders as well). This way, if something does go wrong after having turned off that setting, I couldn't be blamed for it. Because like I said, in IT no one ever gets fired for being too security conscious. – Stephan Branczyk Dec 29 '19 at 20:14
9

In my experience, it's not just Tor; I have found that many companies either block or restrict access via VPN networks. Sometimes the restriction is subtle (e.g., Hilton often reports a login error if I am access it it via a VPN, American Airlines often just spins and never loads when I am on a VPN). I assume they believe that VPN users are more likely to be conducting attacks attempting to gain access to users' accounts to fraudulently redeem points/miles, gain access to the site itself, or some other malicious activity.

| improve this answer | |
  • 2
    Yes, not just Tor and not just airlines. Tor does seem to get blocked more than most VPNs, though. Lots of merchants block Tor for fraud prevention. – reirab Dec 31 '19 at 5:06
-1

Tor is blocked by airlines most probably not due to "security" concerns, but rather because airline websites are notorious for using all manner of browser traffic/history sniffing to alter the price for different customers to maximize the ticket price.

To test this out, visit a few airline websites in Private Mode versus Normal Mode in your browser. Its not unusual to see some price differences for the same flights between the two. The airline companies are highly vested in tech that tries to detect when you are price insensitive for flights (like regular trips back home to visit families) and will raise the price accordingly.

Since Tor effectively stops that kind of browser tracking right at the root, it is simply in the airlines best interest to shut down at the root as soon as Tor is detected. Everyone would be writing their airline price crawlers under Tor if such a trick was possible.

In opposition to the assertion regarding the airlines doing it for credit card fraud, I would be suspicious of this simply given that the fact that a lot of other large sites still allow card purchases under Tor browsers.

| improve this answer | |
  • I've often heard it said that airlines do this, and I've read a few articles that also make this claim. However, in my experience the claim is false (like getting an upgrade by wearing a suit). Airlines publish fares and flight inventory in global distribution systems (GDSs) such as Amadeus and Sabre. Airline booking engines, travel agents, online travel agencies, etc. have systems that price trips by checking the availability on flights against the published fares using a GDS. The GDS share data. It would be exceedingly difficult to alter these numbers for particular people/browsers. – jetset Jan 1 at 23:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.