3 ms·

Last major T-mobile hack was 2 years ago: https://news.ycombinator.com/item?id=28202399 https://news.ycombinator.com/item?id=28202399 Already had to freeze my

Last major T-mobile hack was 2 years ago: https://news.ycombinator.com/item?id=28202399 https://news.ycombinator.com/item?id=28202399 Already had to freeze my credit reports because of last time, this new breach is ridiculous.

SkyMarshal 4y ago
Calling T-mobile’s security “ludicrous” would be a compliment. For a company with their resources, especially after multi-billion $ injection from ATT’s failed merger, they are so bad at it, it’s inconceivable. I don’t know who they’re hiring or contracting with to secure their systems and design their protocols, but they are garbage.
- namaria 4y ago
  So much of enterprise level 'cybersecurity' is a box ticking exercise on one side and snake oil selling on the other. I have seen so many 'security products' presentations where you basically just tag resources versions and scan the tags, it's such an obvious scam. But the GUI looks awesome and they use 'AI'! sight It's all just a big compliance and cost x benefit balance act. We won't get any real security at scale until damages actually hurt insurers enough that they actually invest in understanding and mitigating the problems.
  - SkyMarshal 4y ago
    That's exactly my impression of what's going on at T-mobile. With the ATT settlement they could have hired the best from security research community and/or the whitehat community to design and implement world class systems, protocols, and procedures - Apple and Google level stuff. But they seem to instead be doing exactly what you describe.
    - kjellsbells 4y ago
      Not defending t-mobile here, but perhaps the local talent pool wasn't interested in solving security problems for a telco when just up the street either of AWS or MSFT could give them planet scale security problems to sink their teeth into.
      - SkyMarshal 4y ago
        Possibly, thought T-mobile is nation-scale at least, and after the ATT payment they had the financials to pay for the best.

SkyMarshal 4y ago

Calling T-mobile’s security “ludicrous” would be a compliment. For a company with their resources, especially after multi-billion $ injection from ATT’s failed merger, they are so bad at it, it’s inconceivable. I don’t know who they’re hiring or contracting with to secure their systems and design their protocols, but they are garbage.

namaria 4y ago
So much of enterprise level 'cybersecurity' is a box ticking exercise on one side and snake oil selling on the other. I have seen so many 'security products' presentations where you basically just tag resources versions and scan the tags, it's such an obvious scam. But the GUI looks awesome and they use 'AI'! sight It's all just a big compliance and cost x benefit balance act. We won't get any real security at scale until damages actually hurt insurers enough that they actually invest in understanding and mitigating the problems.
- SkyMarshal 4y ago
  That's exactly my impression of what's going on at T-mobile. With the ATT settlement they could have hired the best from security research community and/or the whitehat community to design and implement world class systems, protocols, and procedures - Apple and Google level stuff. But they seem to instead be doing exactly what you describe.
  - kjellsbells 4y ago
    Not defending t-mobile here, but perhaps the local talent pool wasn't interested in solving security problems for a telco when just up the street either of AWS or MSFT could give them planet scale security problems to sink their teeth into.
    - SkyMarshal 4y ago
      Possibly, thought T-mobile is nation-scale at least, and after the ATT payment they had the financials to pay for the best.