Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equifax Faces Multibillion-Dollar Lawsuit Over Hack

bloomberg.com

Post reply on HN
Print view View original

391–400 of 670 posts

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#391

Post by mbillie1 »

g051051 wrote: post #174
simonswords82 wrote: post #158

It's always seemed odd to me that Experian and Equifax have the upside of being both arbitrarily in charge of so much data and wield ridiculous power, and yet somehow they're still largely independent and profit making. I'll watch the outcome of this breach with interest. It strikes me that at the very least credit rating agencies should be non-profit and very closely monitored by government. This will include ensuri…

You're what's called a "consumer", as in "Consumer Financial Protection Bureau". You're only a "customer" of Equifax if you purchase one of their products. The CRAs don't make or break your credit history, that's the businesses that supply information to them. The CRAs are aggregators, and just report what their members tell them.

Credit algorithms, specifically your FICO score, are not transparent. There is no reason beyond the naive assumption of good faith on the part of these companies to believe that they don't make or break at least your credit SCORE.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#392

Post by alkonaut »

ineptech wrote: post #150

Is it time for a Federal Department of Verifying Whether People Are Who They Say They Are? Veryifying identity with SSN is broken. The right way is probably more or less how big webapps do it - MFA + a password that the user can reset by providing a bunch of info. The government has the necessary private info to do this in most cases (e.g. DL# plus your income from last year's taxes), and can fall back to "Show up at…

SSN is an identifier (username), not a verifier (password). Don't deal with anyone using a small number you can't change as an identity verifier.

We got govt + all banks on board with a national digital id. Basically all systems that were considered safe enough such as the major banks online systems (with advanced 2fa) are allowed to issue digital IDs that can be used as logins to all authorities and any other place that needs verified id.

This system probably paid for itself in a hurry.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#394

Post by joe5150 »

cheald wrote: post #386
cletus wrote: post #340

Ok, so credit reporting agency collects sensitive personal and financial data on basically every adult American, loses it to a bunch of criminals and now I have to deal with the consequences? I looked into credit freezes yesterday. This is really a total scam. You have to _call_ each of the three agencies and pay a fee ($5 to $10) each time. If you need to unfreeze your report to make a legitimate credit application…

You don't have to unfreeze the reports to open a new credit application - the credit app gets rejected (on hold), and the credit issuer will ask you for an auth code. You go to the appropriate agency, log in with the credentials you used when you set up the freeze, provide the request code, they respond with an auth code, you relay the auth code to the credit issuer, credit app progresess. It basically just forces an…

That hasn't been my experience applying for credit with frozen reports. I have to unfreeze them (paying the fee), call the creditor to reattempt to pull the report, then refreeze.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#395

Post by homo_lupus »

devy wrote: post #260
larrykwg wrote: post #245

So let me get this right, this company collects credit information and someone hacked into their web server and stole highly sensitive information about most of the adult american population. Then the executives sold their stock a day before they announced the hack to the public. Besides the troubling fact that you still use social security and credit card numbers as any form of reliable authentication, how aren't th…

No amount of governmental regulations can solve the current date breach trends. Even government's own intel agencies got hacked too. No organization is immune to data breaches. It's a matter of time and effort. A lot of us here are engineers and coders. It's our responsibility to design better architecture, security conscious protocols and write securer softwares. And it's up to all of us (regardless which country yo…

Totally agree - 2016 was a record year in terms of breaches and it keeps going.

The problem lies in that security and efficiency have been historically at odds with each other.

This is what inspired us to work on bringing a novel data security technology from the University of Harvard to the market: www.f-lock.ca . Essentially we are allowing for querying functionality, while achieving homomorphic-level of security. Would love to connect with any people here who share the same vision!

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#397

Post by dcosson »

anyfoo wrote: post #381
kcon wrote: post #356

Earlier quoted context omitted.

I believe it depends on your state. I'm in California and I had to pay $10 for freezing on Experian and TransUnion, although it was free for Equifax.

Same experience here (also CA), and I was able to freeze all of them online. It's mildly interesting how different the experience was across the three. Experian gave me the choice between choosing a PIN and getting a generated one, Equifax just gave me a PIN, and for TransUnion I had to choose the PIN (shorter than for the other reports) myself.

How do you freeze them online?

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#398

Post by spinlock »

CoachRufus87 wrote: post #26
spinlock wrote: post #18

Earlier quoted context omitted.

IMO, the best outcome would be to put Equifax out of business. I have had my identity stolen and they were complicit in enabling the fraud against me. Once you tell them you're NPI has been compromised, they get incredibly passive aggressive against you and refuse to allow you to manage the situation (i.e. they won't let you unlock your credit to apply for a mortgage). In short, this breach of public "trust" is only…

> they won't let you unlock your credit to apply for a mortgage So how do you recover from something like that? Are you basically prevented from using credit for the rest of your life?

For many years I could not get a new credit card, overdraft protection on a checking account or a mortgage. I finally was able to completely remove the freeze so that I could secure a mortgage.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#399

Post by cr0sh »

gbarc888 wrote: post #117
Dowwie wrote: post #97

Consider the possibility that the hackers were agents of a sovereign power, such as one who has been hurt by economic sanctions and has a history of cyber warfare. This state could decide to respond to US economic aggression by using the compromised information of hundreds of millions of Americans to engage in fraudulent activity. This event is leading me to about how social security numbers can no longer serve the r…

Undoubtedly Equifax will claim that the hackers were agents of a sovereign power, to escape liability. Regardless, they admitted on their own web page that there was a flaw in their web application. Biometrics would be a terrible idea. Mass surveillance, anyone?

> Biometrics would be a terrible idea. Mass surveillance, anyone?

What if the biometrics were stored on something you have - say a smartcard (definitely not a phone!)? Along with a PIN. Plus, these two items went into a "write only" store on the card (actually, a hashed value of both are stored).

You have a card reader (one at home - and any place you are doing a transaction to confirm identity also has one). You put in your card. Type your PIN. Present your (physical) biometric.

The reader takes the data, passes it to the card (or maybe the card has the reader and pin pad?). The card runs the hashing again, and compares the values. If all is good, it outputs a "Yes" otherwise a "No".

Remember, only the card holds the data (a hashed version) of the biometric and the PIN. That can only be written (you can do this with your terminal at home?). The only output the card has is that "yes/no" value.

All transactions of such nature would be done with this card.

I'm probably missing some steps or such - but the idea is there. That gives a 3-factor authentication system.

Don't expect it to ever be implemented.

Post reply on HN