No password required: Mobile carrier exposes data for millions of accounts (opens in new tab)

(arstechnica.com)

52 pointsmarshmallow_125y ago10 comments

10 comments

8 comments · 2 top-level

MattGaiser5y ago· 6 in thread

I suspect this was deliberate. Customer service is expensive and this seems very low margin. When I worked in banking, password issues were 1/4 of call centre volume.

290830113977785y ago

If nothing else, it was deliberately ignored. The customer contacted support last year via email, then in February, and again in April. Then we get to reviews (left by different users) for both the iOS and Android apps, stating this is a problem. Fortunately, the devs commented on the feedback! They replied with "Thank you so much for your suggestion, [name], feedback from users like you help us!"

Note none of this is implies they're working on it, just that they acknowledge the issue; which, to me, is absolutely incredible.

MattGaiser5y ago

They are nobody's choice of provider. They are the provider you use if you are poor or cheap. That means they don't need to compete, including on security.

MomoXenosaga5y ago

Companies know how much they are fined if they get caught. Its just an easy calculation for them if compliance is worth it.

maddyboo5y ago

If they didn’t want to use passwords to avoid support calls, they could have sent one-time login codes to the phone number or email address associated with the account. Or literally anything other than neglecting security altogether.

hippira5y ago

They could use OTP - OT Login Links to log users in, no call center required.

unobatbayar5y ago

I like OTP. But I fear when I change phone number or leave country, the next owner could literally login to any of my online accounts using OTP on my previous number. That's why I always remove it from every account when I update, but can't keep track of all my accounts or emails.

1 more reply

notjulianjaynes5y ago

Issa Asad, the CEO of this company, murdered his groundskeeper over $65 in 2014. He killed Michael Kramer by running over him with his Mercedes. [1]

For this he paid a $225 fine and was sentenced to 1 year probation. [2]

Here is evidence of what was certainly an astroturfing campaign to cover this up: https://www.reddit.com/r/HITsWorthTurkingFor/comments/2ot7h3...

[1] https://www.sun-sentinel.com/news/fl-davie-man-charged-folo-...

[2] https://miami.cbslocal.com/2014/07/22/girlfriend-of-groundsk...

j / k navigate · click thread line to collapse