[phphphph]

> Using just these two values, an attacker could completely manage any aspect of a flight reservation using United’s website.

Don't most airline websites allow that when you get the last name and date of departure right?

[fphilipe]

Yes. But the point is that he was able to gain these two bits of information.