OK, what is "Equifax security freeze"?
Equifax security freeze PINs are the timestamp of when you request the freeze
51–60 of 193 posts
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#52This is embarrassing at this point; a credit authority printing dividends is too busy placating shareholders to even pretend to give a shit about the data of the people who _involuntarily_ have their PII stored on their platform. Whoever files a class action should make a motion such that anyone can purge their PII from a credit authority that's experienced a public hack such that their PII was exposed, or some other…
>purge their PII from a credit authority I can't see that happening if they do any kind of offsite back up and archiving. They will purge you from the current master, say they purged you, and you'll be none-the-wiser.
I wish someone would go Mr Robot and corrupt their offsite tape backups with the HVAC system.
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#53Anyone else confirmed this? Don't know who Tony is, usually like more sources that a tweet.
Just try it out for yourself, like others did: https://news.ycombinator.com/item?id=15204573
I'm not using anything that Equifax set up in case it waives any of my rights. This is how bad it's gotten, people are afraid/untrusting of their security/protection measures.
Thank you for linking to more accounts of this.
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#54Anyone else confirmed this? Don't know who Tony is, usually like more sources that a tweet.
I worked with Tony a number of years ago and have been following him on social media. He does a lot of public records research, and for the last two+ years or so, he's been fighting the Hennepin Count Sheriffs office over public records requests about law enforcement's use of biometrics. As of April of this year, the Minnesota Court of Appeals ruled against Hennepin county. I'm not sure if the county is planning on appealing to the Minnesota Supreme Court, but based on their behavior so far, I'd bet on an appeal.
If you need more convincing, check out his blog at https://tonywebster.com/.
PS. Direct link to his post about the MN Court of Appeals outcome: https://tonywebster.com/2017/04/minnesota-court-of-appeals-d...
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#55Something worth taking into consideration is these companies are not Engineering/Tech companies at the core. They were probably born as paper-companies and digitized their operations later on. I am hoping for the day something and more appropriate for this age will make them irrelevant.
How does Equifax, a private company, have the rights to access my personal data in the first place? Who exactly is giving it to them without my explicit consent, and why?
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#56Earlier quoted context omitted.
"Critical systems" pretty vague, and could be used to describe any system that processes payments or other basic things we use. It's fundamentally different from malpractice in my opinion. In health care malpractice has obvious pieces of data - we know who the doctor is, we know their credentials, we know what information they had and when they had it, we know what they decided, what they prescribed, what they said.…
The management who told the developers "we need this done by tomorrow, figure something out or it won't be good for you"
truth!
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#57It's time to have a mandatory certification for people who develop critical systems. After such certification, you can consider such an implementation a malpractice, and sue them for it (of course the penalty is paid by the insurance company which sold the malpractice insurance). Doctors, lawyers, and many other professions have such system, why can't we have it as well?
Developers don't control budgets and deadlines at large companies, management does. So what does this "certified" individual do when he's given a project without resources allocated for proper security auditing? Does he intentionally get fired for refusing the assignment? That works if he has bountiful savings, no mortgage, no kids. Surely no unethical contracting company will pick up the job after he leaves...
How does it work with lawyers or engineers?
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#58Earlier quoted context omitted.
> are not Engineering/Tech companies Which means each and every line of code was written by the lowest bidder.
I'm reasonably sure that "tech" companies try to save costs just as much as "traditional" companies. The difference might only be that they how to formulate their requirements better.
I am 100% certain that "tech" companies have an entirely different attitude towards engineering costs than non-tech companies. The former want the best people working on problems and will pay what it takes (within reason), the latter want problems solved for the lowest price.
This is extraordinarily evident in the distribution of engineer salaries.
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#59I am curious what programmer would make such a choice vs. calling random or asking the user. However, while undeniably stupid, hopefully they have rate limiting in place so guessing the PIN would not be feasible even if you know the day the credit freeze was put into place.
maybe there was no way to save and transfer the pin from one place of the system to another, and the only way to do it is to guess on the other side by timestamp. pretty hacky implementation but oh well
Carrying around the password wasn't a problem.
There's an option to pick your own password during the previous step but having an automated one is the default option, so a lot of people miss it.
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#60Earlier quoted context omitted.
Or CEO/CTO's buddy's company
The CSO apparently graduated with a music major. Not that it should it disqualify them, many in tech didn't graduate with a CS degree but in light of the incident one has to wonder.
I don't think that is relevant at all. There are plenty of incompetent CS graduates, and plenty of highly competent non-CS graduates.