13 ms·

T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their Security Is Awful’

248 points by jbegley 5y ago

newbamboo 5y ago
Blame the victim. The reality is, it’s all about incentives. He is going to make a few million. If their security were great they’d still have gotten hacked. Everyone who knows anything about computers knows, where there’s a will there’s a way. You cannot stop a determined hacker. Full stop. The problem is there are great incentives and not enough deterrents. Bitcoin. This will only get worse until the public decides it’s had enough. I’m already there. It’s an education problem now.
- breakfastduck 5y ago
  This is a really odd take to me. No, you may not get every single thing right, and if someone is really determined then they might get through. But does that mean you shouldn't put the effort in to make that as difficult as possible? Of course not. What you're saying is essentially the equivalent of saying "If someone had a bulldozer they could smash through the wall into my house anyway, so I'm going to stop locking my doors and closing my windows when I'm out"
  - newbamboo 5y ago
    I’d rather live in a world where people don’t lock their doors. That world existed not long ago. What you see as normal and acceptable differs from my ideal. The question I pose to you: how much is enough in a world with constantly escalating threat? I’d submit that locking doors is a reaction to somewhat static threat. Digital crime is accelerating due to changes in the feasibility and incentives for the criminal- more exploits and digital currencies that make it easy and low risk for the criminal. The more crime, the more value and “adoption” of the digital currencies, the more motivation and less risk for criminal. Not at all like locking your door. It’s a treadmill that will ultimately destroy the fabric of society. We once lived in a world without door locks. We can choose our future. That’s the opposite of fatalism.
    - breakfastduck 5y ago
      You can want to live in that world all you like. But it's not anywhere close to a reflection of reality.
- hakmad 5y ago
  > You cannot stop a determined hacker. Maybe not, but you can reduce the list of potential attackers from relatively average Joes to more experienced, specialised and well funded actors (such as the NSA - who would probably just issue a warrant anyway) with better security practises. It isn't ideal - someone might still access your data without your consent - but it is realistic and achievable. > The problem is that there are great incentives and not enough deterrents. Again, true, but that doesn't mean that the public should just live with this. It's not unreasonable to ask a company to take the security of their customers seriously and take steps to ensure that their data is secure from an attacker. There are other things that can be done: harsher penalties for companies who don't take issues like this seriously, setting out (and enforcing!) standards for security, incentivising security research, and so on. Are these suggestions achievable? Probably. Are they going to be achieved? Probably not. Are there a better ideas for solving this problem? Definitely, but I'm not smart enough to think of them. But just giving up and labelling this as an "education problem" is defeatist and doesn't help.
post_break 5y ago
Been a T-Mobile customer for ages. Sim swaps are too easy. 2 factor is a joke. This is like the 3rd time my data has been lifted. But I stay with them, why? Because I have 3 free lines, unlimited everything, for $32 a month. They have crazy phone trade in deals from time to time, T-Mobile tuesday usually nets me 15c off per gallon at shell. Am I happy that they keep getting hacked? Absolutely not, but I'm happy pretty much any phone with a sim card works, my bill is low, and I have 5G pretty much everywhere.
- jbluepolarbear 5y ago
  Similar for me, I have 4 lines (2 I’m using) unlimited everything, no data caps for $100 a month. I looked at other options and there’s nothing close that compares.
  - r00fus 5y ago
    Grandfathered "simple choice" plan with 10 lines for $160. I have upgrade to 5G phones with no problems. Not unlimited, but I never use up the data anyway. I really hope TMO takes security seriously going forward.
    - unexpected 5y ago
      ...but what do you do with 10 lines?
      - moate 5y ago
        Have a large family or a small business? My wife's immediate family is 9 adults, 6 of whom are all on the same cell plan because it's cheap and convenient for everyone involved. If everyone gets along, there's not a whole lot of downside here.
        lotsofpulp 5y ago
        The biggest security risk with being on someone else's mobile network account in the US is that someone else has control of your phone number. These days, access to your phone number basically constitutes verification and authorization from you for many things, including transfers of money. I control the phone lines for myself, my wife, my mom, one of my cousins, and my sister. But I would not give someone other than my wife control of mine or my wife's phone number, no matter how much I trust them. >If everyone gets along, there's not a whole lot of downside here. Everyone always gets along, until they do not.
wgj 5y ago
https://archive.is/tO0ty https://archive.is/tO0ty
coldcode 5y ago
Everyone's security is awful, as the penalty for failure is less than the expense required to make it secure. Until the former becomes higher the latter will guarantee insecurity rules.
- RJSquirel 5y ago
  >Everyone's security is awful True, but the Polaris (East Wenatchee) data center is a complete joke in every way.
- spyder 5y ago
  Does the basic security scanning the hacker was doing costs hundreds of millions for big companies? Because that's the fines some big companies are getting: https://www.csoonline.com/article/3410278/the-biggest-data-breach-fines-penalties-and-settlements-so-far.html https://www.csoonline.com/article/3410278/the-biggest-data-b... or at least tens of millions in the EU thanks to GDPR: https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ We understand it's nothing compared to their profits but is it nothing compared to the cost of basic security?
  - ldoughty 5y ago
    Equifax agreed to pay 600 million, but still saw profits up 20% for the year... Sure they could have made 600 million MORE in profit, but that's still just 15% of their profits for the year.. sure they'll spend a few million in the area they need to shore up one time and wait for the next incident... It's just good for business... Invest enough to keep these incidents down to one every 5 years, pay fine, repeat.
  - BrandonMarc 5y ago
    Scanning is pretty inexpensive. Maintaining a complex system that passes the scans? That's something different altogether. If I take a clunker to a mechanic, how much will it cost me to hear everything that needs fixing? About $150. But actually performing the fixes? One order of magnitude greater - and that's if I'm very, very lucky!
- f38zf5vdt 5y ago
jdofaz 5y ago
I don't know if this is still the case, but in the past when I changed a line to a different SIM on T-Mobile an alert about the SIM change was texted to me, on the new SIM. :/ It didn't inspire much confidence in me regarding their security practices
- streptomycin 5y ago
  Once there was a billing snafu and they cut off my line, with no notice given. I was freaking out a bit cause I thought it might be a SIM swap attack or something. After figuring it out and getting reconnected, I realized that actually they had told me about it. Via a text message. To the phone number they disconnected. After they disconnected it.
sneak 5y ago
It would be nice to be able to open these accounts without providing PII, so that it would be harder to attack specific users, and breaches would not be so damaging to customers. This US trend of requiring government-issued ID for even routine transactions (like phone service) that aren’t ID-related is insane and dangerous.
- beepboop43 5y ago
  Anyone know of a provider that doesn't mandate storing this info? I understand they want to know your credit to open an account so need your pii to get credit info, but does any cell provider not store it after that? I tried to get tmobile to delete mine and they won't so I'm open to switching to any post-paid service that does.
  - tbihl 5y ago
    Not post-paid. If you want privacy, you need to be more serious than that. Mint mobile prepaid (no personal info) on a device you bought outright in cash. Obviously, no one should know that phone number; you should do all interactions through your publicly known VOIP number that's forwarded. That phone shouldn't be turned on any time you're near home; that should be done with a separate home iPad or the like. And no traffic should ever happen outside of a VPN...
huibf 5y ago
Let's see how T-Mobile's security compares to life in prison, criminal.
- moate 5y ago
  I'll bite: How do you make that comparison? What are you comparing? Not being demeaning, but literally what does this sentence mean?
  - huibf 5y ago
    I'm comparing how awful T-Mobile's security is to how awful his life in prison will be for leaking the private data of millions of people. Not an apt comparison, just a very bad joke :D
datameta 5y ago
What I don't understand is why the hacker (whose full name is used in the article - alias?) is being public about this? Shit security or not, they made a clear cut black hat move purely for money. Or I suppose the other factor is fame/infamy. Pretty sure there are at least a few pissed off hackers among those 50M people who would want to track this person down digitally and pull something as retaliation.
- toomuchtodo 5y ago
  I'm going out on a limb, but based on signal from the article and actions the person has taken, I don't think they're mentally well.
  - CSSer 5y ago
    I was about to comment this. He says he went public to raise awareness about allegedly being illegally detained in a "fake mental hospital". Obviously anything is possible, but that sounds a lot like he could've been legally detained and doesn't really understand the law i.e. he could've been a danger to himself or others. His other bombastic comments to press and relatives also make him sound insecure and immature. Obviously he had to be somewhat adept and dedicated to gain access, but he didn't discover any incredible exploit here. He also takes credit for discovering a well known zero-day but admits he had nothing to do with the code for the exploit. To me that supports the idea that he hangs out in black hat circles because he wants to be one of the 'cool kids', put in the time and got lucky. I imagine the press love that because a lot of the public doesn't really know the difference.
  - deleted 5y ago
    [deleted]
- hpoe 5y ago
  From the article "John Binns, a 21-year-old American who moved to Turkey a few years ago" I'm assuming it is the Turkey thing, probably counting on that to be a significant barrier. Yes they have extradition but I've also heard that Turkish authorities are quite amenable to bribes as well.
jvanderbot 5y ago
"A booming industry of cybersecurity consultants, software suppliers and incident-response teams have so far failed to turn the tide against hackers and identity thieves who fuel their businesses by tapping these deep reservoirs of stolen corporate data." Sure, blame the consultants with their "booming industry". I'm sure T-Mobile spent adequate amounts of money on securing their data, hired all the best people, and it was all the security peoples' fault for not doing it properly.
- disintegore 5y ago
  I'm sure it's both. As in, much of what they did spend likely went to snake oil salesmen. I've met lots of security consultants who did not have backgrounds in math or compsci.
  - Aperocky 5y ago
    Probably memorized a checklist and passed a multiple choice tests or two to become certified.
    - mrtranscendence 5y ago
      It's surprisingly easy to get certified. I managed to pass the difficult-by-reputation CISSP exam without any deep knowledge of or really interest in information security. I just took the five-day crash course my company paid for and bob's your uncle, I passed the CISSP. Of course, I never actually got certified because I left the role immediately afterward and never bothered following up. Moreover, I didn't really meet the requirements, which included having some tenure as a security professional. But I'm sure I could have finagled it if I had any interest in working security (I absolutely did not).
      - DaiPlusPlus 5y ago
        Are there any certifications that require you to solve a CTF or otherwise demonstrate understanding of the field? (Just spitballing, but maybe an oral-defence of strategy against a board of defcon panelists? Etc) Braindump-able IT certs benefit no-one, and expecting people to have MSc degrees in infosec is elitist and very impractical.
strictnein 5y ago
I hope he enjoys his free flight back to the US. The FBI has an office in Ankara.
mixmastamyk 5y ago
Payment too, to add $$$ you go to a external noname site from the nineties. Until a month ago your balance on the main site would not update until you logged out and in again.
deleted 5y ago
[deleted]
umvi 5y ago
Every security person ever: "security is laughably easy to get right yet every company in the world is incompetent"
dleslie 5y ago
Data is a liability. It's hoarded because it's also a gold mine, and the risk to those hoarding it is minimal even if it's stolen. The risk for hoarding data needs to be made comparable to the harm that theft would cause to the individuals effected by it; or hoarding data needs to be strictly regulated.
lkbm 5y ago
Does anyone have a good solution for sites that only support SMS 2FA? I'm mostly using Google Voice for 2FA right now, but I'm iffy on tying access to my entire life to a Google account. Ideally I'd like a dirt-cheap, just-for-2FA phone number from a provider that's got decent security (specifically regarding SIM swapping).
- BenjiWiebe 5y ago
  Same. I actually (stupidly) had my Google voice number as sms 2fa for Google. Makes it tricky to log in to even access Google voice.
- Saris 5y ago
  I have a voip.ms number left over from another project, and it does support SMS although I've had fairly crappy luck getting it to work for services that need it for 2FA. Seems like there's no good option, as VOIP numbers are fairly secure but ironically not allowed by many companies for SMS.
fitblipper 5y ago
Best way to secure customer's data? Don't have it to begin with! All that data is not needed when all you need to do is charge people $ and let their phone call another.
deleted 5y ago
[deleted]
davesque 5y ago
It seems almost like a combinatorial impossibility that any software could be secure nowadays. Given that security basically depends on the interactions between various components being sound, and the fact that most systems nowadays are built from countless layers each with their own complex and confusing API, how could any software be even remotely secure?
88840-8855 5y ago
I blame HR. I used to work in that industry; it was openly communicated that key roles were not appropriately staffed. The comment was: "we could hire the right people, but we are not allowed to pay them the money they are worth". Again, it is HR.
mehrdada 5y ago
I remember getting my plaintext password back over email through one of their forgot password flows a few years back, so yeah...
Threeve303 5y ago
If you received the text about the account hack as I did, it had this at the end of the message: “Learn more about practices that keep your account secure and general recommendations for protecting yourself: “ When on a support call with them, they claimed that my account was fine and I had nothing to worry about. And then the last thing they tell you is to improve your security.

248 points by jbegley 5y ago

Blame the victim. The reality is, it’s all about incentives. He is going to make a few million. If their security were great they’d still have gotten hacked. Everyone who knows anything about computers knows, where there’s a will there’s a way. You cannot stop a determined hacker. Full stop. The problem is there are great incentives and not enough deterrents. Bitcoin. This will only get worse until the public decides it’s had enough. I’m already there. It’s an education problem now.

breakfastduck 5y ago
This is a really odd take to me. No, you may not get every single thing right, and if someone is really determined then they might get through. But does that mean you shouldn't put the effort in to make that as difficult as possible? Of course not. What you're saying is essentially the equivalent of saying "If someone had a bulldozer they could smash through the wall into my house anyway, so I'm going to stop locking my doors and closing my windows when I'm out"
- newbamboo 5y ago
  I’d rather live in a world where people don’t lock their doors. That world existed not long ago. What you see as normal and acceptable differs from my ideal. The question I pose to you: how much is enough in a world with constantly escalating threat? I’d submit that locking doors is a reaction to somewhat static threat. Digital crime is accelerating due to changes in the feasibility and incentives for the criminal- more exploits and digital currencies that make it easy and low risk for the criminal. The more crime, the more value and “adoption” of the digital currencies, the more motivation and less risk for criminal. Not at all like locking your door. It’s a treadmill that will ultimately destroy the fabric of society. We once lived in a world without door locks. We can choose our future. That’s the opposite of fatalism.
  - breakfastduck 5y ago
    You can want to live in that world all you like. But it's not anywhere close to a reflection of reality.
hakmad 5y ago
> You cannot stop a determined hacker. Maybe not, but you can reduce the list of potential attackers from relatively average Joes to more experienced, specialised and well funded actors (such as the NSA - who would probably just issue a warrant anyway) with better security practises. It isn't ideal - someone might still access your data without your consent - but it is realistic and achievable. > The problem is that there are great incentives and not enough deterrents. Again, true, but that doesn't mean that the public should just live with this. It's not unreasonable to ask a company to take the security of their customers seriously and take steps to ensure that their data is secure from an attacker. There are other things that can be done: harsher penalties for companies who don't take issues like this seriously, setting out (and enforcing!) standards for security, incentivising security research, and so on. Are these suggestions achievable? Probably. Are they going to be achieved? Probably not. Are there a better ideas for solving this problem? Definitely, but I'm not smart enough to think of them. But just giving up and labelling this as an "education problem" is defeatist and doesn't help.

post_break 5y ago

Been a T-Mobile customer for ages. Sim swaps are too easy. 2 factor is a joke. This is like the 3rd time my data has been lifted. But I stay with them, why? Because I have 3 free lines, unlimited everything, for $32 a month. They have crazy phone trade in deals from time to time, T-Mobile tuesday usually nets me 15c off per gallon at shell. Am I happy that they keep getting hacked? Absolutely not, but I'm happy pretty much any phone with a sim card works, my bill is low, and I have 5G pretty much everywhere.

jbluepolarbear 5y ago
Similar for me, I have 4 lines (2 I’m using) unlimited everything, no data caps for $100 a month. I looked at other options and there’s nothing close that compares.
- r00fus 5y ago
  Grandfathered "simple choice" plan with 10 lines for $160. I have upgrade to 5G phones with no problems. Not unlimited, but I never use up the data anyway. I really hope TMO takes security seriously going forward.
  - unexpected 5y ago
    ...but what do you do with 10 lines?
    - moate 5y ago
      Have a large family or a small business? My wife's immediate family is 9 adults, 6 of whom are all on the same cell plan because it's cheap and convenient for everyone involved. If everyone gets along, there's not a whole lot of downside here.
      - lotsofpulp 5y ago
        The biggest security risk with being on someone else's mobile network account in the US is that someone else has control of your phone number. These days, access to your phone number basically constitutes verification and authorization from you for many things, including transfers of money. I control the phone lines for myself, my wife, my mom, one of my cousins, and my sister. But I would not give someone other than my wife control of mine or my wife's phone number, no matter how much I trust them. >If everyone gets along, there's not a whole lot of downside here. Everyone always gets along, until they do not.

wgj 5y ago

https://archive.is/tO0ty https://archive.is/tO0ty

coldcode 5y ago

Everyone's security is awful, as the penalty for failure is less than the expense required to make it secure. Until the former becomes higher the latter will guarantee insecurity rules.

RJSquirel 5y ago
>Everyone's security is awful True, but the Polaris (East Wenatchee) data center is a complete joke in every way.
spyder 5y ago
Does the basic security scanning the hacker was doing costs hundreds of millions for big companies? Because that's the fines some big companies are getting: https://www.csoonline.com/article/3410278/the-biggest-data-breach-fines-penalties-and-settlements-so-far.html https://www.csoonline.com/article/3410278/the-biggest-data-b... or at least tens of millions in the EU thanks to GDPR: https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ We understand it's nothing compared to their profits but is it nothing compared to the cost of basic security?
- ldoughty 5y ago
  Equifax agreed to pay 600 million, but still saw profits up 20% for the year... Sure they could have made 600 million MORE in profit, but that's still just 15% of their profits for the year.. sure they'll spend a few million in the area they need to shore up one time and wait for the next incident... It's just good for business... Invest enough to keep these incidents down to one every 5 years, pay fine, repeat.
- BrandonMarc 5y ago
  Scanning is pretty inexpensive. Maintaining a complex system that passes the scans? That's something different altogether. If I take a clunker to a mechanic, how much will it cost me to hear everything that needs fixing? About $150. But actually performing the fixes? One order of magnitude greater - and that's if I'm very, very lucky!
f38zf5vdt 5y ago

jdofaz 5y ago

I don't know if this is still the case, but in the past when I changed a line to a different SIM on T-Mobile an alert about the SIM change was texted to me, on the new SIM. :/ It didn't inspire much confidence in me regarding their security practices

streptomycin 5y ago
Once there was a billing snafu and they cut off my line, with no notice given. I was freaking out a bit cause I thought it might be a SIM swap attack or something. After figuring it out and getting reconnected, I realized that actually they had told me about it. Via a text message. To the phone number they disconnected. After they disconnected it.

sneak 5y ago

It would be nice to be able to open these accounts without providing PII, so that it would be harder to attack specific users, and breaches would not be so damaging to customers. This US trend of requiring government-issued ID for even routine transactions (like phone service) that aren’t ID-related is insane and dangerous.

beepboop43 5y ago
Anyone know of a provider that doesn't mandate storing this info? I understand they want to know your credit to open an account so need your pii to get credit info, but does any cell provider not store it after that? I tried to get tmobile to delete mine and they won't so I'm open to switching to any post-paid service that does.
- tbihl 5y ago
  Not post-paid. If you want privacy, you need to be more serious than that. Mint mobile prepaid (no personal info) on a device you bought outright in cash. Obviously, no one should know that phone number; you should do all interactions through your publicly known VOIP number that's forwarded. That phone shouldn't be turned on any time you're near home; that should be done with a separate home iPad or the like. And no traffic should ever happen outside of a VPN...

huibf 5y ago

Let's see how T-Mobile's security compares to life in prison, criminal.

moate 5y ago
I'll bite: How do you make that comparison? What are you comparing? Not being demeaning, but literally what does this sentence mean?
- huibf 5y ago
  I'm comparing how awful T-Mobile's security is to how awful his life in prison will be for leaking the private data of millions of people. Not an apt comparison, just a very bad joke :D

datameta 5y ago

What I don't understand is why the hacker (whose full name is used in the article - alias?) is being public about this? Shit security or not, they made a clear cut black hat move purely for money. Or I suppose the other factor is fame/infamy. Pretty sure there are at least a few pissed off hackers among those 50M people who would want to track this person down digitally and pull something as retaliation.

toomuchtodo 5y ago
I'm going out on a limb, but based on signal from the article and actions the person has taken, I don't think they're mentally well.
- CSSer 5y ago
  I was about to comment this. He says he went public to raise awareness about allegedly being illegally detained in a "fake mental hospital". Obviously anything is possible, but that sounds a lot like he could've been legally detained and doesn't really understand the law i.e. he could've been a danger to himself or others. His other bombastic comments to press and relatives also make him sound insecure and immature. Obviously he had to be somewhat adept and dedicated to gain access, but he didn't discover any incredible exploit here. He also takes credit for discovering a well known zero-day but admits he had nothing to do with the code for the exploit. To me that supports the idea that he hangs out in black hat circles because he wants to be one of the 'cool kids', put in the time and got lucky. I imagine the press love that because a lot of the public doesn't really know the difference.
- deleted 5y ago
  [deleted]
hpoe 5y ago
From the article "John Binns, a 21-year-old American who moved to Turkey a few years ago" I'm assuming it is the Turkey thing, probably counting on that to be a significant barrier. Yes they have extradition but I've also heard that Turkish authorities are quite amenable to bribes as well.

jvanderbot 5y ago

"A booming industry of cybersecurity consultants, software suppliers and incident-response teams have so far failed to turn the tide against hackers and identity thieves who fuel their businesses by tapping these deep reservoirs of stolen corporate data." Sure, blame the consultants with their "booming industry". I'm sure T-Mobile spent adequate amounts of money on securing their data, hired all the best people, and it was all the security peoples' fault for not doing it properly.

disintegore 5y ago
I'm sure it's both. As in, much of what they did spend likely went to snake oil salesmen. I've met lots of security consultants who did not have backgrounds in math or compsci.
- Aperocky 5y ago
  Probably memorized a checklist and passed a multiple choice tests or two to become certified.
  - mrtranscendence 5y ago
    It's surprisingly easy to get certified. I managed to pass the difficult-by-reputation CISSP exam without any deep knowledge of or really interest in information security. I just took the five-day crash course my company paid for and bob's your uncle, I passed the CISSP. Of course, I never actually got certified because I left the role immediately afterward and never bothered following up. Moreover, I didn't really meet the requirements, which included having some tenure as a security professional. But I'm sure I could have finagled it if I had any interest in working security (I absolutely did not).
    - DaiPlusPlus 5y ago
      Are there any certifications that require you to solve a CTF or otherwise demonstrate understanding of the field? (Just spitballing, but maybe an oral-defence of strategy against a board of defcon panelists? Etc) Braindump-able IT certs benefit no-one, and expecting people to have MSc degrees in infosec is elitist and very impractical.

strictnein 5y ago

I hope he enjoys his free flight back to the US. The FBI has an office in Ankara.

mixmastamyk 5y ago

Payment too, to add $$$ you go to a external noname site from the nineties. Until a month ago your balance on the main site would not update until you logged out and in again.

deleted 5y ago

[deleted]

umvi 5y ago

Every security person ever: "security is laughably easy to get right yet every company in the world is incompetent"

dleslie 5y ago

Data is a liability. It's hoarded because it's also a gold mine, and the risk to those hoarding it is minimal even if it's stolen. The risk for hoarding data needs to be made comparable to the harm that theft would cause to the individuals effected by it; or hoarding data needs to be strictly regulated.

lkbm 5y ago

Does anyone have a good solution for sites that only support SMS 2FA? I'm mostly using Google Voice for 2FA right now, but I'm iffy on tying access to my entire life to a Google account. Ideally I'd like a dirt-cheap, just-for-2FA phone number from a provider that's got decent security (specifically regarding SIM swapping).

BenjiWiebe 5y ago
Same. I actually (stupidly) had my Google voice number as sms 2fa for Google. Makes it tricky to log in to even access Google voice.
Saris 5y ago
I have a voip.ms number left over from another project, and it does support SMS although I've had fairly crappy luck getting it to work for services that need it for 2FA. Seems like there's no good option, as VOIP numbers are fairly secure but ironically not allowed by many companies for SMS.

fitblipper 5y ago

Best way to secure customer's data? Don't have it to begin with! All that data is not needed when all you need to do is charge people $ and let their phone call another.

deleted 5y ago

[deleted]

davesque 5y ago

It seems almost like a combinatorial impossibility that any software could be secure nowadays. Given that security basically depends on the interactions between various components being sound, and the fact that most systems nowadays are built from countless layers each with their own complex and confusing API, how could any software be even remotely secure?

88840-8855 5y ago

I blame HR. I used to work in that industry; it was openly communicated that key roles were not appropriately staffed. The comment was: "we could hire the right people, but we are not allowed to pay them the money they are worth". Again, it is HR.

mehrdada 5y ago

I remember getting my plaintext password back over email through one of their forgot password flows a few years back, so yeah...

Threeve303 5y ago

If you received the text about the account hack as I did, it had this at the end of the message: “Learn more about practices that keep your account secure and general recommendations for protecting yourself: “ When on a support call with them, they claimed that my account was fine and I had nothing to worry about. And then the last thing they tell you is to improve your security.