I seem to remember their authentication was a combination of your phone number and the IMEI of your handset, which is woeful security through obscurity at best.