Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

An 8 digit, all numerals password? Really, Mitnick?

Also, it wasn't just AT&T that is refusing service to him, his webhost HostedHere.net did the same thing.

And if this has been happening over and over again for 9 years why didn't he just want to go to another service provider?



Indeed. Other providers host and maintain the security of as-high-profile "targets".

More importantly you have to question how much of the security problem Mitnick poses in this? If he is part of the cause I think AT&T & HostedHere probably are reasonable to want to get rid of him

(btw I suspect the 8 numeral password is a pin number: similar to the ones handed out by banks for online logins. Could still be his fault it is out in the wild though)


How is it reasonable for AT&T to admit blatant incompetence? Couldn't they have worked with Mitnick to secure his account and even use his case to attract more celebrity customers?


It's probably just a business decision. (assumption)They can provide cell phone service for 1000 people for the same cost as Mitnick since he is a target.

It's the same thing Sprint did a couple years ago when they dumped people that called customer service too much.


I'm sure it is, but it doesn't seem like a bright business decision. He claims he spends up to $20K a year - sure, maybe this still isn't worth it to AT&T. But more importantly, you'd think they would see this as an opportunity to make their system more robust for all their clients, save money that way (more than $20K/year? likely), AND turn it into a good PR piece.


Hi, we're AT&T. The company that is SO secure we can even protect legendary hacker Kevin Mitnick!!

Cue mass attempts to break into AT&T from every angle (which is sure to end badly) :)


well we have no specific information on any of the problems (plus Im a little biased personally in that Mitnick seems to be in a habit of loudly crying foul no matter what - I do that sometimes because it gets results, takes one to know one)

It's been 9 years (we dont even know how much of it is AT&T vs. Mitnicks fault and what contact he has had with them): it's looking like an infinite battle to "secure" his identity. If there are crucial security flaws in their process then yes I am in agreement - but I doubt that is the case (because Mitnick would then be the least of their problems :)). Wash hands, move on.


I had to re-read the article about the eight digit password. As it is for his phone provider, I presume it has to be numbers so it can be typed in from any phone keypad. I can't believe someone with Mitnick's track record would use an all-numbers password by choice.


"Mitnick said that per AT&T policy, his password could only be digits and no more than eight characters long."


Thanks branden, I didn't re-read far enough down the article.


An 8 digit, all numerals password? Really, Mitnick?

It's not super secure, but it really should be secure enough if a website cares about security -- they should be limiting login attempts, and shouldn't be storing them in plain text.


Not really his fault a couple paragraphs down he reveals this gem:

Mitnick said that per AT&T policy, his password could only be digits and no more than eight characters long.


"Mitnick said that per AT&T policy, his password could only be digits and no more than eight characters long."


That's the kind of password an idiot would have on his luggage!




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: