[travisjeffery]

An 8 digit, all numerals password? Really, Mitnick?

Also, it wasn't just AT&T that is refusing service to him, his webhost HostedHere.net did the same thing.

And if this has been happening over and over again for 9 years why didn't he just want to go to another service provider?

[ErrantX]

Indeed. Other providers host and maintain the security of as-high-profile "targets".

More importantly you have to question how much of the security problem Mitnick poses in this? If he is part of the cause I think AT&T & HostedHere probably are reasonable to want to get rid of him

(btw I suspect the 8 numeral password is a pin number: similar to the ones handed out by banks for online logins. Could still be his fault it is out in the wild though)

[fauigerzigerk]

How is it reasonable for AT&T to admit blatant incompetence? Couldn't they have worked with Mitnick to secure his account and even use his case to attract more celebrity customers?

[dundun]

It's probably just a business decision. (assumption)They can provide cell phone service for 1000 people for the same cost as Mitnick since he is a target.

It's the same thing Sprint did a couple years ago when they dumped people that called customer service too much.

[alex_c]

I'm sure it is, but it doesn't seem like a bright business decision. He claims he spends up to $20K a year - sure, maybe this still isn't worth it to AT&T. But more importantly, you'd think they would see this as an opportunity to make their system more robust for all their clients, save money that way (more than $20K/year? likely), AND turn it into a good PR piece.

[ErrantX]

Hi, we're AT&T. The company that is SO secure we can even protect legendary hacker Kevin Mitnick!!

Cue mass attempts to break into AT&T from every angle (which is sure to end badly) :)

[ErrantX]

well we have no specific information on any of the problems (plus Im a little biased personally in that Mitnick seems to be in a habit of loudly crying foul no matter what - I do that sometimes because it gets results, takes one to know one)

It's been 9 years (we dont even know how much of it is AT&T vs. Mitnicks fault and what contact he has had with them): it's looking like an infinite battle to "secure" his identity. If there are crucial security flaws in their process then yes I am in agreement - but I doubt that is the case (because Mitnick would then be the least of their problems :)). Wash hands, move on.

[paulsilver]

I had to re-read the article about the eight digit password. As it is for his phone provider, I presume it has to be numbers so it can be typed in from any phone keypad. I can't believe someone with Mitnick's track record would use an all-numbers password by choice.

[branden]

"Mitnick said that per AT&T policy, his password could only be digits and no more than eight characters long."

[paulsilver]

Thanks branden, I didn't re-read far enough down the article.

[zngtk4]

An 8 digit, all numerals password? Really, Mitnick?

It's not super secure, but it really should be secure enough if a website cares about security -- they should be limiting login attempts, and shouldn't be storing them in plain text.

[weaksauce]

Not really his fault a couple paragraphs down he reveals this gem:

Mitnick said that per AT&T policy, his password could only be digits and no more than eight characters long.

[Hexstream]

"Mitnick said that per AT&T policy, his password could only be digits and no more than eight characters long."

[kmcgivney]

That's the kind of password an idiot would have on his luggage!