Equifax Faces Multibillion-Dollar Lawsuit Over Hack

> No amount of governmental regulations can solve the current date breach trends.

I think there's a few things that could be done:

1. Invalidate all SSN numbers.

2. Force people to get a new ID card; make it like the smart-card passport card (or make people get such a card). That becomes your ID and number.

3. Getting that card requires you to be present physically for fingerprinting. Put the fingerprint data on the card, and no where else.

4. Make regulations that only allow for loans to be done in person - no more mailings, nothing online - if you want credit, you have to show up in person.

5. To prove who you are: Fingerprint, your card (with picture - and fingerprint data on the card), plus your pin number. Essentially chip and pin identification, with a fingerprint scan (and maybe a face scan too).

6. Make it so if you want to do online transactions - or any transaction for that matter - you must provide all of this. Basically, at home, a card reader that can read the chip, allow you to enter the pin, scan your fingerprint and face, and if all of that matches what's on the card, then an "acknowledgement" is sent.

Essentially the above would implement a 3-factor auth. I am not saying the above is perfect (I am absolutely certain I have screwed something up there - but the basic idea is what I am trying to convey), but we essentially have to do a clean break away from all current ID and credit/loan/payment systems - and move to a system that introduces a TON of friction.

Physical Presence (Something you are)

Physical Token (Something you have)

PIN (Something you know)

And all the data about "who you are" (face scan, fingerprint) stored on the card (hashed of course) only, no where else. Basically - the card, your presence, and your knowledge all have to be present, and the card's processor authenticates you.

And these factors need to be presented each and every time you do a transaction of any sort involving money or identification.

And no online or by-mail signup for credit. That should be done in physical form only.

Finally - allow for at-will changes of the PIN, and yearly a forced change of the PIN.

The problem with the above, though, is many-fold. It would be extremely costly - for everyone. It is also (seems in a way) draconian. But something of the above nature would need to be done, post haste, if we wanted this to go away.

And basically not allow any kind of storage of credit information or whatnot by -any- entity (and I am not sure how that would even work or if it could). Maybe all they have is a hash value and your name, and the card can generate that hash value as "authentication"/"identity" - but you have to have everything there (you, card, pin), and only the card holds the information, and only generates a hash.

I dunno - but again, this is the idea. I'll leave the details to people smarter than I on these things.

I don't expect something like this to be ever implemented, though. One would think this breach would do it, but it won't.

Definitely. E.g. for a $1 million case, the defense likely won't even hire an expert. For a $1 billion case, you'll be responding to thousands of pages of expert reports prepared by half a dozen PhDs in various specialties (and deposing them, fighting over the admissibility of their opinions and the reliability of their methods, etc.). Not to mention that you'll get buried in discovery, etc.

Why is H1B relevant here?

> I never consented to having all my eggs in those three vulnerable baskets

Your information does not just magically make it into the database of a credit bureau. It gets there via public record or because you allowed a creditor to report it to them. You are more than welcome to find a creditor that does not ask for or report to credit bureaus.

Not trying to justify the existence of credit bureaus but let's not kid ourselves. They aren't sending spies to your house or tapping your phone lines to get this info. You personally authorize a large amount of it.

>So why can't I have a mobile app (or three) for free

Yes, and I think it's a bigger question of why we have so little control over or access to our own data in the first place? It's a racket that they monetize our data by selling it to others, then charge us again to access and protect it. And, if you've ever had to go through the pain of having something corrected in a timely fashion, then you know it's doubly-maddening. They are purposely opaque and byzantine.

Yet, without our data, they'd have no business.