Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equifax Faces Multibillion-Dollar Lawsuit Over Hack

bloomberg.com

Post reply on HN
Print view View original

501–510 of 670 posts

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#501

Post by ausjke »

Go to hell Equifax, whoever is in charge of security there should be put into custody before all the litigation.

Multiple steps must be taken for nowadays people to get credit card and debit card or whatever(loans, money transfer,...). Use SSN, name, mother maid name, a few security questions, two-step authentication by default, all passwords must be hashed and salted otherwise it is a crime for the DBA,etc.

Just switched away from 15+-year-yahoo-email after its leakage, now it comes Equifax, which is 1000x more critical, it is so bad.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#503

Post by wildmusings »

panic wrote: post #438
wildmusings wrote: post #408

Earlier quoted context omitted.

The government can't just dissolve a corporation on a whim. We have due process and the rule of law.

Since Congress defines what the law is, couldn't they do it? The only law binding Congress's lawmaking powers is the Constitution, and I don't think it restricts their ability to dissolve corporations.

In addition to what others have said, you cannot be deprived of life, liberty, or property without due process in the US.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#505

Post by IncRnd »

cr0sh wrote: post #387
walshemj wrote: post #108

Earlier quoted context omitted.

ah lovely "papers please citizen" and what happen when friend computer with all this proof of identity gets hacked. Maybe the USA needs everyone to have a new ssn and ban with very strict penalties is use by any one other than the state and then only for highly restricted usages as it is in the UK

> ah lovely "papers please citizen" and what happen when friend computer with all this proof of identity gets hacked. While it doesn't solve the "papers please" aspect: 1. Card holds biometric data of person, plus PIN. Card is the only thing that holds this. 2. All card does is output "yes or no" if you are you. 3. You have or use a reader for authenticating who you are. The reader takes you biometric data (fingerpri…

If the card outputs "yes" or "no" you are creating new security incidents just waiting to happen - proxying, oracular attacks, faux cards that respond improperly to the binary question, etc. This means that your system is actually two factor, a pin and biometrics. A pin is extremely weak, and for sure biometrics need to be designed and implemented properly.

Also, notice the other subtle dependency that was introduced with the PIN only kept on the card - the PIN might as well not exist.

This is all known. The issue isn't how to design a security system. The issue is the fly by the seat of the pants lack of security with deadline driven products. Those products only appear to implement a feature set and really don't work, just appearing to work in order to achieve the release exit criteria of a minimum viable product. This gets compounded by products hardly ever revisiting their earlier phases, choosing in this case to add new web features instead of hiring a security team.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#506

Post by IncRnd »

bsder wrote: post #361
tajen wrote: post #99

Earlier quoted context omitted.

One scenario would be SSN being massively used by pirates, so companies would stop trusting SSN altogether. Let's hope a startup creates a "proof of identity" service with a photo ID with a chip, a code, and an online certificate for tax purpose.

Where are the blockchain proponents? Oh, right, this kind of thing isn't a pyramid scheme. It would be a lot of grunt work and wouldn't be worth a VC investment.

I can hear it coming now... A VC backed military contrator is right now creating MilChain and DarpaCoins.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#507

Post by kabdib »

I'm involved in the design and maintenance of a PCI environment. Given the auditing requirements for these environments it is mind-boggling that an intrusion of this magnitude went unnoticed for several months.

I'm left with the conclusion that they were either negligent or incompetent, or layers of management were actively trying to cover things up.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#508

Post by slowmovintarget »

spiznnx wrote: post #172
slowmovintarget wrote: post #152

Earlier quoted context omitted.

Isn't Equifax protected from the class action by a few levels of arbitration clauses?

I never signed anything with Equifax, but they still have my information. I'm sure the great majority of the ~140M records they have are in a similar position.

Yeah, they ought to apply fraud alert status automatically to everyone who was compromised. Every credit application for the next five years requires they contact you personally for new applications.

Doesn't help for all the other issues this will cause, though.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#509

Post by dragonwriter »

subroutine wrote: post #479
joe_the_user wrote: post #426

Earlier quoted context omitted.

The point is that charter revocation requires both the executive and judicial branch to agree. Moreover, I think I can guarantee that any vague sounding statement like "abuse, misuse or nonuse of its corporate powers, privileges or franchises." has been translated into a series of relatively specific conditions by the courts. You can't just sue someone for being vaguely terrible. Basically, however appalling the unac…

It doesn't seem like the executive and judicial branches will need to get involved whatsoever if there is a multibillion dollar lawsuit; if successful this will basically 'dissolve' Equifax.

If there is a lawsuit, the judicial branch is involved.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#510

Post by TheCoelacanth »

fleitz wrote: post #186
rayiner wrote: post #96

Earlier quoted context omitted.

Probably for good reason. $500 per class member is an insanely high damages estimate. 99.9% of people will suffer zero damages because their identities will not be stolen. Even the ones who do have their identities stolen will likely be made whole by the credit card companies. The real damages here are going to be to the banks and credit card companies that will have to absorb the costs of all the fraud. As to the Ti…

There was a class action suit because a company was marking up the cost of the goods / services they were selling? Isn't this just called business?

Most businesses include their markup in their displayed price. Ticket Master was displaying one price and then sneaking in an extra fee later in the process.
Post reply on HN