Telstra fails basic security checks
Telstra is exposing customers' accounts to unauthorised access by failing to ask for passwords over the phone.
In most cases simply a date of birth and full name is required when customers call the telco. Telstra argues it isn't legally required to check passwords, something which James Turner, a security industry analyst at IBRS, says defeats the purpose of allowing account passwords.
"Security is meant to help streamline a process ... whereas this is sounding like it's a process which [Telstra staff are] able to bypass," Turner said. "And that's the thorne in every security practitioners side. Because we don't want security processes that people can bypass at their leisure. That defeats the purpose. If there's the mechanism for a password to be used but nobody's actually using it then that's bypassing the process."
