Equifax security freeze PINs are the timestamp of when you request the freeze

Post by rocqua » Sat, Sep 09, 2017, 7:45 PM UTC

noway421 wrote: post #10

buildbot wrote: post #3

I am curious what programmer would make such a choice vs. calling random or asking the user. However, while undeniably stupid, hopefully they have rate limiting in place so guessing the PIN would not be feasible even if you know the day the credit freeze was put into place.

maybe there was no way to save and transfer the pin from one place of the system to another, and the only way to do it is to guess on the other side by timestamp. pretty hacky implementation but oh well

Post by rbanffy » Sat, Sep 09, 2017, 7:56 PM UTC

rokhayakebe wrote: post #17

Something worth taking into consideration is these companies are not Engineering/Tech companies at the core. They were probably born as paper-companies and digitized their operations later on. I am hoping for the day something and more appropriate for this age will make them irrelevant.

Post by rbanffy » Sat, Sep 09, 2017, 7:57 PM UTC

raverbashing wrote: post #18

buildbot wrote: post #3

I am curious what programmer would make such a choice vs. calling random or asking the user. However, while undeniably stupid, hopefully they have rate limiting in place so guessing the PIN would not be feasible even if you know the day the credit freeze was put into place.

They don't want to migrate their db to add an extra field?

Post by rbanffy » Sat, Sep 09, 2017, 7:58 PM UTC

Keeeeeeeks wrote: post #24

This is embarrassing at this point; a credit authority printing dividends is too busy placating shareholders to even pretend to give a shit about the data of the people who _involuntarily_ have their PII stored on their platform. Whoever files a class action should make a motion such that anyone can purge their PII from a credit authority that's experienced a public hack such that their PII was exposed, or some other…

Post by rhizome » Sat, Sep 09, 2017, 8:00 PM UTC

ben_jones wrote: post #26

solomatov wrote: post #20

It's time to have a mandatory certification for people who develop critical systems. After such certification, you can consider such an implementation a malpractice, and sue them for it (of course the penalty is paid by the insurance company which sold the malpractice insurance). Doctors, lawyers, and many other professions have such system, why can't we have it as well?

Developers don't control budgets and deadlines at large companies, management does. So what does this "certified" individual do when he's given a project without resources allocated for proper security auditing? Does he intentionally get fired for refusing the assignment? That works if he has bountiful savings, no mortgage, no kids. Surely no unethical contracting company will pick up the job after he leaves...