Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equifax security freeze PINs are the timestamp of when you request the freeze

twitter.com

Post reply on HN
Print view View original

11–20 of 193 posts

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#11

Post by encoderer »

True thing: until recently you could remove hard inquiries from your credit report merely by pulling your own credit so often in one month using an array of daily monitoring services that you would overflow the field and bump off legit inquiries.

I did this in 2009-10, it had been going on for a while, and lasted for a while but sadly I hear they've solved it seemingly by nightly batch job to remove your own credit pulls.

These companies are just barely functional for their purpose.

Experian seemed to have their act together a bit more.

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#12

Post by skj »

foota wrote: post #6
buildbot wrote: post #3

I am curious what programmer would make such a choice vs. calling random or asking the user. However, while undeniably stupid, hopefully they have rate limiting in place so guessing the PIN would not be feasible even if you know the day the credit freeze was put into place.

If you have a 1 in 60*24 chance of guessing correctly then after 1000 guesses (potentially against different people) you have a 50 chance of being correct on one.

Could you explain your math here? Is there something you learn about the other digits when you make a wrong guess?

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#13

Post by wtfequifax »

pcurve wrote: post #8

Serious question... if there are 3-5 attempt lock out, would this be any less secure than randomly generated number?

Not sure I'd count on them having lock out, and even if they do, a shitload of the PINs will be easy to guess since they'll be clustered around now, when many people are rushing to lock their credit.

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#14

Post by mkagenius »

pcurve wrote: post #8

Serious question... if there are 3-5 attempt lock out, would this be any less secure than randomly generated number?

Yes -- if lot of people freeze their accounts on a day and the attacker has a way to try same pin on lot of accounts. (No -- if random number generator is only 2 digits long)

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#15

Post by didgeoridoo »

pcurve wrote: post #8

Serious question... if there are 3-5 attempt lock out, would this be any less secure than randomly generated number?

1) Target individual for identity theft.

2) Search their twitter history for "I just froze my credit" or similar.

3) Try the PIN corresponding to t-1, t-2... t-5.

4) Profit!

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#16

Post by jooke »

skj wrote: post #12
foota wrote: post #6

Earlier quoted context omitted.

If you have a 1 in 60*24 chance of guessing correctly then after 1000 guesses (potentially against different people) you have a 50 chance of being correct on one.

Could you explain your math here? Is there something you learn about the other digits when you make a wrong guess?

60*24 = 1440 possibilities. If you guess half these numbers you would expect to crack half the pins.

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#17

Post by rokhayakebe »

Something worth taking into consideration is these companies are not Engineering/Tech companies at the core. They were probably born as paper-companies and digitized their operations later on. I am hoping for the day something and more appropriate for this age will make them irrelevant.

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#18

Post by raverbashing »

buildbot wrote: post #3

I am curious what programmer would make such a choice vs. calling random or asking the user. However, while undeniably stupid, hopefully they have rate limiting in place so guessing the PIN would not be feasible even if you know the day the credit freeze was put into place.

They don't want to migrate their db to add an extra field?

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#19

Post by wyager »

rokhayakebe wrote: post #17

Something worth taking into consideration is these companies are not Engineering/Tech companies at the core. They were probably born as paper-companies and digitized their operations later on. I am hoping for the day something and more appropriate for this age will make them irrelevant.

> I am hoping for the day something and more appropriate for this age will make them irrelevant.

We have the technology to build vastly superior replacements right now. It's mostly network effect requirements that make this extremely challenging/slow to implement.

An example of something we could do is cryptographically authenticated web-of-trust creditworthiness estimation, with techniques like proof of burn and selective trust anchoring used to establish terminal nodes in the unrolled trust DAG. This sort of thing would allow for pseudonymous, automated determination of trust without the extreme security and privacy risks posed by centralized identity stores like the credit bureaus.

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#20

Post by solomatov »

It's time to have a mandatory certification for people who develop critical systems. After such certification, you can consider such an implementation a malpractice, and sue them for it (of course the penalty is paid by the insurance company which sold the malpractice insurance).

Doctors, lawyers, and many other professions have such system, why can't we have it as well?

Post reply on HN