Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equifax security freeze PINs are the timestamp of when you request the freeze

twitter.com

Post reply on HN
Print view View original

41–50 of 193 posts

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#41

Post by scentoni »

rocqua wrote: post #21
noway421 wrote: post #10

Earlier quoted context omitted.

maybe there was no way to save and transfer the pin from one place of the system to another, and the only way to do it is to guess on the other side by timestamp. pretty hacky implementation but oh well

Hash with a secret key (a pepper) solves that. Heck, hashing with a salt or even just plain hashing would be miles better than this.

Hash? I wouldn't trust the folks at Equifax to know the difference between a one-way function, a cannabis concentrate, and a fried potato dish.

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#42

Post by rdtsc »

bluedino wrote: post #28
rbanffy wrote: post #23

Earlier quoted context omitted.

> are not Engineering/Tech companies Which means each and every line of code was written by the lowest bidder.

Or CEO/CTO's buddy's company

The CSO apparently graduated with a music major. Not that it should it disqualify them, many in tech didn't graduate with a CS degree but in light of the incident one has to wonder.

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#43

Post by takeda »

rokhayakebe wrote: post #17

Something worth taking into consideration is these companies are not Engineering/Tech companies at the core. They were probably born as paper-companies and digitized their operations later on. I am hoping for the day something and more appropriate for this age will make them irrelevant.

This sounds like blockchain could have application. But honestly, other countries do fine without them, IMO they should just be abolished.

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#46

Post by vlunkr »

avip wrote: post #33
solomatov wrote: post #20

It's time to have a mandatory certification for people who develop critical systems. After such certification, you can consider such an implementation a malpractice, and sue them for it (of course the penalty is paid by the insurance company which sold the malpractice insurance). Doctors, lawyers, and many other professions have such system, why can't we have it as well?

I may agree, but Equifax is by no reasonable definition "a critical system".

I don't know what definition of "critical" we're going with, but the fact that they have the SSN of basically every American makes them an important weak point.

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#47

Post by ranci »

rhizome wrote: post #29
ben_jones wrote: post #26

Earlier quoted context omitted.

Developers don't control budgets and deadlines at large companies, management does. So what does this "certified" individual do when he's given a project without resources allocated for proper security auditing? Does he intentionally get fired for refusing the assignment? That works if he has bountiful savings, no mortgage, no kids. Surely no unethical contracting company will pick up the job after he leaves...

If only there were more software jobs out there, then they wouldn't be hemmed in so intractably.

Nice red herring

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#48

Post by eberkund »

ranci wrote: post #39
solomatov wrote: post #20

It's time to have a mandatory certification for people who develop critical systems. After such certification, you can consider such an implementation a malpractice, and sue them for it (of course the penalty is paid by the insurance company which sold the malpractice insurance). Doctors, lawyers, and many other professions have such system, why can't we have it as well?

"Critical systems" pretty vague, and could be used to describe any system that processes payments or other basic things we use. It's fundamentally different from malpractice in my opinion. In health care malpractice has obvious pieces of data - we know who the doctor is, we know their credentials, we know what information they had and when they had it, we know what they decided, what they prescribed, what they said.…

The management who told the developers "we need this done by tomorrow, figure something out or it won't be good for you"

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#49

Post by adrianN »

rbanffy wrote: post #23
rokhayakebe wrote: post #17

Something worth taking into consideration is these companies are not Engineering/Tech companies at the core. They were probably born as paper-companies and digitized their operations later on. I am hoping for the day something and more appropriate for this age will make them irrelevant.

> are not Engineering/Tech companies Which means each and every line of code was written by the lowest bidder.

I'm reasonably sure that "tech" companies try to save costs just as much as "traditional" companies. The difference might only be that they how to formulate their requirements better.
Post reply on HN