Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

An 8 digit, all numerals password? Really, Mitnick?

Also, it wasn't just AT&T that is refusing service to him, his webhost HostedHere.net did the same thing.

And if this has been happening over and over again for 9 years why didn't he just want to go to another service provider?



Indeed. Other providers host and maintain the security of as-high-profile "targets".

More importantly you have to question how much of the security problem Mitnick poses in this? If he is part of the cause I think AT&T & HostedHere probably are reasonable to want to get rid of him

(btw I suspect the 8 numeral password is a pin number: similar to the ones handed out by banks for online logins. Could still be his fault it is out in the wild though)


How is it reasonable for AT&T to admit blatant incompetence? Couldn't they have worked with Mitnick to secure his account and even use his case to attract more celebrity customers?


It's probably just a business decision. (assumption)They can provide cell phone service for 1000 people for the same cost as Mitnick since he is a target.

It's the same thing Sprint did a couple years ago when they dumped people that called customer service too much.


I'm sure it is, but it doesn't seem like a bright business decision. He claims he spends up to $20K a year - sure, maybe this still isn't worth it to AT&T. But more importantly, you'd think they would see this as an opportunity to make their system more robust for all their clients, save money that way (more than $20K/year? likely), AND turn it into a good PR piece.


Hi, we're AT&T. The company that is SO secure we can even protect legendary hacker Kevin Mitnick!!

Cue mass attempts to break into AT&T from every angle (which is sure to end badly) :)


well we have no specific information on any of the problems (plus Im a little biased personally in that Mitnick seems to be in a habit of loudly crying foul no matter what - I do that sometimes because it gets results, takes one to know one)

It's been 9 years (we dont even know how much of it is AT&T vs. Mitnicks fault and what contact he has had with them): it's looking like an infinite battle to "secure" his identity. If there are crucial security flaws in their process then yes I am in agreement - but I doubt that is the case (because Mitnick would then be the least of their problems :)). Wash hands, move on.


I had to re-read the article about the eight digit password. As it is for his phone provider, I presume it has to be numbers so it can be typed in from any phone keypad. I can't believe someone with Mitnick's track record would use an all-numbers password by choice.


"Mitnick said that per AT&T policy, his password could only be digits and no more than eight characters long."


Thanks branden, I didn't re-read far enough down the article.


An 8 digit, all numerals password? Really, Mitnick?

It's not super secure, but it really should be secure enough if a website cares about security -- they should be limiting login attempts, and shouldn't be storing them in plain text.


Not really his fault a couple paragraphs down he reveals this gem:

Mitnick said that per AT&T policy, his password could only be digits and no more than eight characters long.


"Mitnick said that per AT&T policy, his password could only be digits and no more than eight characters long."


That's the kind of password an idiot would have on his luggage!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: