Hacker News Reader

I'm not convinced that intent of the owner counts, but let's say it does. AT&T intentionally put the information on a publicly accessible server. They even distributed a script that fetched the data when it was requested, when users set up an iPad. So as far as "intent" counts, this data was intended to be accessed.

View on HN

... by the user setting up that iPad.

Sort of as if AT&T had chosen really bad, unchangeable default passwords for all their users.

The ICCID is not a password, it's an ID. It's not secret. In fact it's printed on the outside of the SIM card.

Most ID numbers are used as weak authentication: Driver's license numbers, SSNs, etc.

The security on a ICCID is arguably better than any of these things. Unless it's transmitted in the clear? I don't know.

It's an ID, not an authentication token. If it helps, you can think of it as a username, not a password. It has to be transmitted in the clear or you wouldn't even know who you're talking about.

Doesnt have to be transmitted in the clear; that's exactly what TLS does; allows usernames and passwords to be transmitted with encryption so only the other party can recover them.

Reply on news.ycombinator.com