Virgin Media (UK) stores passwords in plain text, sends them through the mail

Post by hallihax » Mon, Aug 19, 2019, 12:45 PM UTC

benj111 wrote: post #14

wutbrodo wrote: post #3

I learned a long time ago that the default assumption for non-tech-first companies should be deep, deep incompetence, below the level of an undergrad with a decent CS degree, when it comes to basic security practice. Even having your system be Incredibly Important isn't enough to force basic competence: there were plenty of government and bank systems through the 2000s that were apparently designed and maintained by…

"non-tech-first companies" Is an ISP not tech first? Bell labs is an off shoot of a phone company, early computing was based on the efforts of phone companies. Phone companies, which ISPs are the modern variant are the original tech companies. Edit to add: Virgin maintains a fibre optic network so we aren't just talking about a sales front end to someone else's network.

Post by wutbrodo » Tue, Aug 20, 2019, 1:04 AM UTC

hallihax wrote: post #51

benj111 wrote: post #14

Earlier quoted context omitted.

"non-tech-first companies" Is an ISP not tech first? Bell labs is an off shoot of a phone company, early computing was based on the efforts of phone companies. Phone companies, which ISPs are the modern variant are the original tech companies. Edit to add: Virgin maintains a fibre optic network so we aren't just talking about a sales front end to someone else's network.

Virgin Media is profit-first, above all else. It's an error to assume that the part of the company that builds out infrastructure is in any way joined up with the part of the company that keeps customers secure (if indeed, they even have people responsible for that, which they apparently don't). This is why things like GDPR end up being foisted on us. Corporations have proven themselves capable of simply ignoring leg…

Post by hallihax » Tue, Aug 20, 2019, 12:06 PM UTC

wutbrodo wrote: post #53

hallihax wrote: post #51

Earlier quoted context omitted.

Virgin Media is profit-first, above all else. It's an error to assume that the part of the company that builds out infrastructure is in any way joined up with the part of the company that keeps customers secure (if indeed, they even have people responsible for that, which they apparently don't). This is why things like GDPR end up being foisted on us. Corporations have proven themselves capable of simply ignoring leg…

This model wouldn't seem to explain why eg Google and Facebook have world-class security. You can think whatever you want about the stuff they do intentionally, but I don't think leaving yourself open to hacking is that sound a business strategy for anyone, and I don't think it's a coincidence that more technically-competent companies also tend to be more secure.