I can’t fault a low-level employee too much for enthusiastically defending their company. I can’t expect someone at that level to know about sound development practices.

What’s often lacking though is a clear path for reporting security issues to people such as this representative. They don’t have a process to flag something for the security team.

If they're storing passwords in plaintext, the reason they don't have a process to flag something for the security team is probably that there is no security team.

“Excuse me? Do you have any idea how telecommunication companies work? Do you know anything about our systems? But I'm glad you have the time to share your view with us. ^Käthe”

And doubling down as well, that’s a bold strategy.

> Do you have any idea how telecommunication companies work?

I know, and it ain’t fucking pretty. Plaintext passwords (and stupid customer service) are just the tip of the iceberg.

Telcos are right up there with internet-connected industrial control systems when it comes to security and the huge fallouts of a breach.

"challenge accepted"

Looks like someone found a XSS vulnerability at T-Mobile Austria website [1]

[1] https://twitter.com/fabricio_giglio/status/98236273592413798...