Quote:This essentially means that a potentially rogue customer service agent who accesses the first four characters can generate the remaining part of the passwords with relative ease using a brute-force method. And if there's a data breach, the passwords will be available to the attacker in plain text. When this was explained to the T-Mobile representatives, they went on to state how there is nothing to fear because T-Mobile's security is "amazingly good".
...
While T-Mobile Austria customers have genuine reasons to be worried, T-Mobile CEO John Legere has clarified that the company's US division doesn't store passwords in plain text.