Equifax security freeze PINs are the timestamp of when you request the freeze
1–10 of 193 posts
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#2Calling all hackers, brute force much?
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#3I am curious what programmer would make such a choice vs. calling random or asking the user.
However, while undeniably stupid, hopefully they have rate limiting in place so guessing the PIN would not be feasible even if you know the day the credit freeze was put into place.
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#4I am curious what programmer would make such a choice vs. calling random or asking the user. However, while undeniably stupid, hopefully they have rate limiting in place so guessing the PIN would not be feasible even if you know the day the credit freeze was put into place.
Do you really think a company that has visibly demonstrated this much incompetence thus far would be making smart decisions where you can't see them?
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#5Whoa... one guy said on Twitter this was the case in 2007!!
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#6I am curious what programmer would make such a choice vs. calling random or asking the user. However, while undeniably stupid, hopefully they have rate limiting in place so guessing the PIN would not be feasible even if you know the day the credit freeze was put into place.
If you have a 1 in 60*24 chance of guessing correctly then after 1000 guesses (potentially against different people) you have a 50 chance of being correct on one.
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#7AMA request: the developer who made this decision.
1. How does it feel to be literally the dumbest engineer on the planet?
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#8Serious question... if there are 3-5 attempt lock out, would this be any less secure than randomly generated number?
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#9I am curious what programmer would make such a choice vs. calling random or asking the user. However, while undeniably stupid, hopefully they have rate limiting in place so guessing the PIN would not be feasible even if you know the day the credit freeze was put into place.
If you have a 1 in 60*24 chance of guessing correctly then after 1000 guesses (potentially against different people) you have a 50 chance of being correct on one.
It's probably even less that 1 in 60 * 24, because usually a freezes is requested during business hours? So 1 in 60 * 8?
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#10I am curious what programmer would make such a choice vs. calling random or asking the user. However, while undeniably stupid, hopefully they have rate limiting in place so guessing the PIN would not be feasible even if you know the day the credit freeze was put into place.
maybe there was no way to save and transfer the pin from one place of the system to another, and the only way to do it is to guess on the other side by timestamp.
pretty hacky implementation but oh well