O2 joins Virgin Media as member of weak crypto software club

And the Reg...

...supports?????

Surprising (or perhaps not) how common this still is

I found the same issue recently with a phone app from a financial organisation who shall remain nameless. It was a server-side issue. Credit to them, they fixed it pretty quickly in comparison to the usual big org timescales after I alerted them. Since the app has been around for a while I was surprised no-one else had found it before I decided to use it.

Weak passwords

Don't forget that Virgin Media insists on both a maximum password length and no special characters. Other security howlers shouldn't come as a surprise.

Three..

If you think that Voda and O2 are bad, you should check the other operators, 3 doesn't score at all well either...

But in real life...

Not defending poor security practice but let's be fair, cracking RC4 is still "hard enough" to deter blackhats from snaffling that ten quid you just paid to O2.

Keeping up with technology

And you expect O2 to be keeping up with technology?!? Don't make me laugh. It's 2015 and the self-service systems for corporate customers are still non-existent. Their only offering (My O2 Business system) is stuck in Flash hell with no indication that they're going to move away from it.

Translation

FOR...

A company spokesbeing told us: "We are aware of this issue and are planning to move away from this system in good time before browser makers remove support next year."

...READ

"We have no idea what you mean but we're all looking forward to our Christmas party piss up."

Pretty much the same answer O2 gave when you give them proof that I could access almost any account, including address and billing details, which happened a decade ago.

It's a good job that no telco has been hacked....

Typical fucking shambles, and these companies ought to be hit heavily for not sufficiently protecting their customer data, regardless of whether they have actually lost any or not.