Hacker News Reader

... by the user setting up that iPad.

Sort of as if AT&T had chosen really bad, unchangeable default passwords for all their users.

The ICCID is not a password, it's an ID. It's not secret. In fact it's printed on the outside of the SIM card.

Most ID numbers are used as weak authentication: Driver's license numbers, SSNs, etc.

The security on a ICCID is arguably better than any of these things. Unless it's transmitted in the clear? I don't know.

It's an ID, not an authentication token. If it helps, you can think of it as a username, not a password. It has to be transmitted in the clear or you wouldn't even know who you're talking about.

Doesnt have to be transmitted in the clear; that's exactly what TLS does; allows usernames and passwords to be transmitted with encryption so only the other party can recover them.

Reply on news.ycombinator.com