4 ms·
Not exactly. He also had to change the User-agent header. Also: let's say someone accidentally exposes their password because it's on a post-it in the backgrou
by BryantD 14y ago
Not exactly. He also had to change the User-agent header.
Also: let's say someone accidentally exposes their password because it's on a post-it in the background of a photo. Clearly this is crappy security; clearly, at that point, information protected by that password is readily available until the password is changed.
The intent of the owner of the data does, in fact, count.
- sp332 14y agoI'm not convinced that intent of the owner counts, but let's say it does. AT&T intentionally put the information on a publicly accessible server. They even distributed a script that fetched the data when it was requested, when users set up an iPad. So as far as "intent" counts, this data was intended to be accessed.
- BryantD 14y ago... by the user setting up that iPad. Sort of as if AT&T had chosen really bad, unchangeable default passwords for all their users.
- sp332 14y agoThe ICCID is not a password, it's an ID. It's not secret. In fact it's printed on the outside of the SIM card.
- lukeschlather 14y agoMost ID numbers are used as weak authentication: Driver's license numbers, SSNs, etc. The security on a ICCID is arguably better than any of these things. Unless it's transmitted in the clear? I don't know.
- sp332 14y agoIt's an ID, not an authentication token. If it helps, you can think of it as a username, not a password. It has to be transmitted in the clear or you wouldn't even know who you're talking about.
- hn-miw-i 14y agoDoesnt have to be transmitted in the clear; that's exactly what TLS does; allows usernames and passwords to be transmitted with encryption so only the other party can recover them.
- k3n 14y agoI do not intend for anyone to read this comment, and if you do so you are breaching my privacy. This is all silly.