Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equifax Faces Multibillion-Dollar Lawsuit Over Hack

bloomberg.com

Post reply on HN
Print view View original

291–300 of 670 posts

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#291

Post by privaroonie »

Yeah, I would think so. So far, we've learned that they've exposed virtually everyone's data through their incompetence (thus exposing nearly every adult in the US to a high risk of identity fraud), sold stock to avoid personal financial losses before the news broke, and set up a scam site to trick people into giving up their right to sue.

If this isn't criminal, then nothing is. If someone doesn't go to jail over this, why the hell shouldn't I just go out and commit fraud on a daily basis myself? It seems to be rewarded in our society...

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#293

Post by moomin »

bsenftner wrote: post #290
devy wrote: post #260

Earlier quoted context omitted.

No amount of governmental regulations can solve the current date breach trends. Even government's own intel agencies got hacked too. No organization is immune to data breaches. It's a matter of time and effort. A lot of us here are engineers and coders. It's our responsibility to design better architecture, security conscious protocols and write securer softwares. And it's up to all of us (regardless which country yo…

"No amount of governmental regulations can solve the current date breach trends." I'm sorry, but that is just flat out false. That type of thinking is just bizarre to me. It would make a gargantuan difference. Hold executives personally accountable, with whistle blower laws protecting the developers who identify weak security. It would change the freaking world over night.

Forget regulation. Pass laws and just fine them. A lot. So much it's a threat to the company's existence. Pretty sure it'll turn out to be a solvable problem.

If it isn't a solvable problem then we need to start talking about getting this data off the Internet.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#294

Post by bsenftner »

api_or_ipa wrote: post #259
larrykwg wrote: post #245

So let me get this right, this company collects credit information and someone hacked into their web server and stole highly sensitive information about most of the adult american population. Then the executives sold their stock a day before they announced the hack to the public. Besides the troubling fact that you still use social security and credit card numbers as any form of reliable authentication, how aren't th…

I think your comment can be easily interpreted as a knee-jerk criticism of American regulatory environment en mass . At best this is a straw-man, and at worse it's a hyperbolic jump to assumptions about the attack vector, existing regulations, and how you believe them to be insufficient. It's too early to know anything for sure about the breach and certainly holding pre-made assumptions prevents a more level headed,…

Finance industry regulation is a joke in the USA. It's largely self monitoring based! http://scholarship.law.cornell.edu/cgi/viewcontent.cgi?artic...

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#295

Post by RangerScience »

adrr wrote: post #272
ineptech wrote: post #150

Is it time for a Federal Department of Verifying Whether People Are Who They Say They Are? Veryifying identity with SSN is broken. The right way is probably more or less how big webapps do it - MFA + a password that the user can reset by providing a bunch of info. The government has the necessary private info to do this in most cases (e.g. DL# plus your income from last year's taxes), and can fall back to "Show up at…

Won't work. Once companies start gathering private data stored in this DB, it can be compromised and government isn't that great at securing data either. MFA would required everyone having a smart phone or RSA key fobs. SMS/Phone based authentication isn't secure. Only real way to get true identity system is biometrics(Fingerprints,DNA, or Iris) taken at birth. But that will never happen for privacy reasons.

That's also problematic. If I can capture your data, then I can supply that data at a later point. Even if there are "secure" endpoints that collect that data for verification; I'd just need to compromise one of those.

Identity is hard.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#296

Post by paulddraper »

RickS wrote: post #286
devy wrote: post #269

Earlier quoted context omitted.

> If you where (sic) to hold the management criminally responsible for their lack of investment in IT, security etc you might see increased investment. What makes you think lack of investment in IT & security is the main reason they get hacked? Vice versa, NSA has virtually unlimited (let's just say unlimited means tens of billion dollars) budget invested in IT and security. They have the top resources there too. Do…

Correct me if I'm wrong, but the NSA leaks have all been the result of internal employees leaking outward, rather than outside people reaching inward where they shouldn't. That's a meaningful distinction, IMO. They call for two completely different types of defense.

You assume it's different for Equifax.

Hacking humans is quite often the easiest point of entry.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#298

Post by nxsynonym »

privaroonie wrote: post #291

Yeah, I would think so. So far, we've learned that they've exposed virtually everyone's data through their incompetence (thus exposing nearly every adult in the US to a high risk of identity fraud), sold stock to avoid personal financial losses before the news broke, and set up a scam site to trick people into giving up their right to sue. If this isn't criminal, then nothing is. If someone doesn't go to jail over th…

>> why the hell shouldn't I just go out and commit fraud on a daily basis myself?

Because corporations are protected, individuals are not. This is what happens when business(profit) takes precedence over human rights.

There will be no repercussions for those responsible. No changes will be implemented. At best we'll get a public apology, but even that seems far-fetched.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#299

Post by stephenboyd »

adrr wrote: post #272
ineptech wrote: post #150

Is it time for a Federal Department of Verifying Whether People Are Who They Say They Are? Veryifying identity with SSN is broken. The right way is probably more or less how big webapps do it - MFA + a password that the user can reset by providing a bunch of info. The government has the necessary private info to do this in most cases (e.g. DL# plus your income from last year's taxes), and can fall back to "Show up at…

Won't work. Once companies start gathering private data stored in this DB, it can be compromised and government isn't that great at securing data either. MFA would required everyone having a smart phone or RSA key fobs. SMS/Phone based authentication isn't secure. Only real way to get true identity system is biometrics(Fingerprints,DNA, or Iris) taken at birth. But that will never happen for privacy reasons.

Biometric national identification is used in many countries, with India's Aadhaar system being the best example. Those systems are mostly used in developing countries that are leapfrogging their financial technology past the legacy systems that the 1st-world powers developed in the 20th century. 'Privacy reasons' is an American cultural anomaly, especially considering the lack of privacy we suffer from the system used by companies like Equifax.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#300

Post by ebiggs »

Even when there isn't a data breech I don't understand how all big 3 credit agencies survive doing their business as they currently do... which is to expose people to the injury of identify theft by default, and then tell them to pay up if they want a product that protects them from that threat.. How is that not seen as akin to a gangster protection racket?
Post reply on HN