4 ms·

Why does a phone company store a customer’s passport number?

by grecy 4y ago

anakaine 4y ago
And why is it stored in clear text. And why was it exposed to a regular API. And why was real data being used on a dev API. And why wasn't that API secured at all? These are all really good questions.
- nineteen999 4y ago
  Why was unscrubbed customer data being used in a dev system that was connected to the internet at all.
  - sumedh 4y ago
    Perhaps they wanted test data similar to their Prod data.
    - 2muchcoffeeman 4y ago
      So obfuscate the data before exporting it.
      - nineteen999 4y ago
        ... or don't connect it directly to the internet.
- waste_monk 4y ago
  The answer for pretty much all of these are "woeful incompetence". Knew a guy who used to work for Optus, he said their business SIP service was constantly getting hacked and their strategy for dealing with it was just to eat the losses and give out account credit like water, because their infrastructure was so outdated and poorly designed that it was functionally impossible to secure. Honestly, Ausgov should rip Optus to shreds for this... not only for the data breach specifically, but also as a critical infrastructure operator they should be held to a far far higher standard than an ordinary business.
Aerroon 4y ago
And this is why they should be made to pay for it. Companies should only collect data that they really need. One way to encourage this behavior is to punish them when a breach happens based on the amount of data they collect. A data breach on a service that only has an email address on it matters a lot less to me than one that has my name, phone, address or picture of my id.
- ecdavis 4y ago
  > Companies should only collect data that they really need. Collecting and keeping this data is a regulatory requirement for Optus. The problems with this breach have their roots in how identity is proven and verified in Australia. Far too much relies on possession of a physical document.
  - collegeburner 4y ago
    in America i usually prove identity for postpaid services with something like a utility bill which is at least not a government id document. i understand a telco wants some identity before extending credit for any postpaid plan but can y'all not do the same?
    - ecdavis 4y ago
      You can see Optus' ID requirements here: https://www.optus.com.au/for-you/support/answer?id=9438 https://www.optus.com.au/for-you/support/answer?id=9438 Here are the ID requirements for their major competitor, Telstra: https://www.telstra.com.au/support/account-payment/id-check-for-new-account https://www.telstra.com.au/support/account-payment/id-check-... These are legislated: https://www.legislation.gov.au/Details/F2022L00548 https://www.legislation.gov.au/Details/F2022L00548
tlyleung 4y ago
To have an account with Optus, you need to provide a Primary ID such as an Australian Drivers Licence or current passport. (See: https://www.optus.com.au/for-you/support/answer?id=9438 https://www.optus.com.au/for-you/support/answer?id=9438) They probably kept it on file, instead of verifying and discarding, potentially due to regulatory requirement.
- ryan-allen 4y ago
  My understanding is that it's a regulatory requirement, the Govt wants to know who specifically owns what SIM. If I remember right, this was introduced post 9/11. I may be spectacularly wrong on both fronts, though!
  - jackvalentine 4y ago
    You are correct, but I’m pretty sure for prepaid services under a low threshold (4 SIMs?) a bank card is sufficient. That doesn’t stop these companies just going for the big ID though, and for postpaid they are offering credit and will definitely require 100 points of ID.
    - tmnvix 4y ago
      That's news to me. I've purchased two prepaid sims in Australia within the past ten years and each time a passport or driver's licence was required.
      - jackvalentine 4y ago
        Actual law is here: https://www.legislation.gov.au/Details/F2017L00399/Html/Text#_Toc478627161 https://www.legislation.gov.au/Details/F2017L00399/Html/Text... and you can see what Amaysim requires here: https://www.amaysim.com.au/help/mobile/getting-started/acceptable-forms-identification https://www.amaysim.com.au/help/mobile/getting-started/accep... The ACMA determination is pretty hard to parse unfortunately.
  - HKH2 4y ago

Why does a phone company store a customer’s passport number?

by grecy 4y ago

Why does a phone company store a customer’s passport number?

And why is it stored in clear text. And why was it exposed to a regular API. And why was real data being used on a dev API. And why wasn't that API secured at all? These are all really good questions.

nineteen999 4y ago
Why was unscrubbed customer data being used in a dev system that was connected to the internet at all.
- sumedh 4y ago
  Perhaps they wanted test data similar to their Prod data.
  - 2muchcoffeeman 4y ago
    So obfuscate the data before exporting it.
    - nineteen999 4y ago
      ... or don't connect it directly to the internet.
waste_monk 4y ago
The answer for pretty much all of these are "woeful incompetence". Knew a guy who used to work for Optus, he said their business SIP service was constantly getting hacked and their strategy for dealing with it was just to eat the losses and give out account credit like water, because their infrastructure was so outdated and poorly designed that it was functionally impossible to secure. Honestly, Ausgov should rip Optus to shreds for this... not only for the data breach specifically, but also as a critical infrastructure operator they should be held to a far far higher standard than an ordinary business.

Aerroon 4y ago

And this is why they should be made to pay for it. Companies should only collect data that they really need. One way to encourage this behavior is to punish them when a breach happens based on the amount of data they collect. A data breach on a service that only has an email address on it matters a lot less to me than one that has my name, phone, address or picture of my id.

ecdavis 4y ago
> Companies should only collect data that they really need. Collecting and keeping this data is a regulatory requirement for Optus. The problems with this breach have their roots in how identity is proven and verified in Australia. Far too much relies on possession of a physical document.
- collegeburner 4y ago
  in America i usually prove identity for postpaid services with something like a utility bill which is at least not a government id document. i understand a telco wants some identity before extending credit for any postpaid plan but can y'all not do the same?
  - ecdavis 4y ago
    You can see Optus' ID requirements here: https://www.optus.com.au/for-you/support/answer?id=9438 https://www.optus.com.au/for-you/support/answer?id=9438 Here are the ID requirements for their major competitor, Telstra: https://www.telstra.com.au/support/account-payment/id-check-for-new-account https://www.telstra.com.au/support/account-payment/id-check-... These are legislated: https://www.legislation.gov.au/Details/F2022L00548 https://www.legislation.gov.au/Details/F2022L00548

tlyleung 4y ago

To have an account with Optus, you need to provide a Primary ID such as an Australian Drivers Licence or current passport. (See: https://www.optus.com.au/for-you/support/answer?id=9438 https://www.optus.com.au/for-you/support/answer?id=9438) They probably kept it on file, instead of verifying and discarding, potentially due to regulatory requirement.

ryan-allen 4y ago
My understanding is that it's a regulatory requirement, the Govt wants to know who specifically owns what SIM. If I remember right, this was introduced post 9/11. I may be spectacularly wrong on both fronts, though!
- jackvalentine 4y ago
  You are correct, but I’m pretty sure for prepaid services under a low threshold (4 SIMs?) a bank card is sufficient. That doesn’t stop these companies just going for the big ID though, and for postpaid they are offering credit and will definitely require 100 points of ID.
  - tmnvix 4y ago
    That's news to me. I've purchased two prepaid sims in Australia within the past ten years and each time a passport or driver's licence was required.
    - jackvalentine 4y ago
      Actual law is here: https://www.legislation.gov.au/Details/F2017L00399/Html/Text#_Toc478627161 https://www.legislation.gov.au/Details/F2017L00399/Html/Text... and you can see what Amaysim requires here: https://www.amaysim.com.au/help/mobile/getting-started/acceptable-forms-identification https://www.amaysim.com.au/help/mobile/getting-started/accep... The ACMA determination is pretty hard to parse unfortunately.
- HKH2 4y ago