"Friend" was using my username and password

Bradfield

Let me explain:

For several months I had been having severe connection problems trying to log in to my then ISP, Orange. I often could not access the internet for several days at a time. Orange customer service advisors (when they bothered to answer the phone) told me there was nothing wrong with the line but they could not identify the problem.

Eventually I asked for my Mac code and departed for BT. About the middle of January Orange finally terminated my connection and account. I had no problem getting connected with BT and my internet was back to normal (as it had been with Orange for over ten years). Strangely however, my friend who lives two miles away and comes under a different exchange found that her internet connection was suddenly down. She rang Orange and was told that the line was ok and she should check her router setup.

She checked her router setup and discovered (to her amazement and mine) that the username and password in her router was not hers but mine.

Then the penny dropped. Several months ago she had been having problems with her router and I had given her mine. It never occurred to me to change the user name and password, presumably because when we plugged in the router; it just "worked" and we thought no more about it.

Perhaps I am naive but I did not think something like this could happen. She was using my name and pasword on her router for many months and getting a perfect connection. I had always believed that the user name and password was checked by the ISP as well as the telephone line. Apparently this is not so.

We were both on unlimited broadband but it does make you wonder about the ISP's ability (when measuring data usage) to accurately identify who is using what.

This raises many questions about "authentication". How do ISP's authenticate their customers internet usage. If someone can use my name and password (and it was entirely my own fault that they had it) to connect to their ISP then it must be possible, for example, for an employee of an ISP to "borrow" a customers user name and password if they so wish.

Im_just_careful

I've seen exactly the same happen with what is now Plusnet. I took a working router to another address on a different exchange and it "just worked".

Actually it is no great surprise. If you plugged it in to a BT broadband line I guess it wouldn't authenticate but there is no great advantage in tieing one physical line to an account between lines all served by the same ISP.

Bradfield

Im_just_careful wrote: »

I've seen exactly the same happen with what is now Plusnet. I took a working router to another address on a different exchange and it "just worked".

Actually it is no great surprise. If you plugged it in to a BT broadband line I guess it wouldn't authenticate but there is no great advantage in tieing one physical line to an account between lines all served by the same ISP.

My friend and I were both with the same ISP (Orange) so I suppose it is possible that Orange recognized that her number was that of a valid Orange subscriber (albeit, not one entitled to use that user-name and password.) Whilst she was using my router she never had a problem getting a connection; I was the one who was having difficulties. I am wondering if this is because Orange had registered my router (mac address) with my user-name and password. After all, I had used the same router for many years.

I understand that BT use a subscribers telephone no (instead of a password) in order to authenticate a connection. I wonder why Orange dont do this.