Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equifax security freeze PINs are the timestamp of when you request the freeze

twitter.com

Post reply on HN
Print view View original

131–140 of 193 posts

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#131

Post by andrewjl »

Pxtl wrote: post #98
takeda wrote: post #43

Earlier quoted context omitted.

This sounds like blockchain could have application. But honestly, other countries do fine without them, IMO they should just be abolished.

A blockchain is public. You want everybody's credit public?

The data isn't public if it's in encrypted form. When you apply for credit, you'd decrypt it with your own private key and re-encrypt it with the creditors private key and send it to the creditor, they would then decrypt privately, process the application, and discard the data.

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#132

Post by sillysaurus3 »

encoderer wrote: post #11

True thing: until recently you could remove hard inquiries from your credit report merely by pulling your own credit so often in one month using an array of daily monitoring services that you would overflow the field and bump off legit inquiries. I did this in 2009-10, it had been going on for a while, and lasted for a while but sadly I hear they've solved it seemingly by nightly batch job to remove your own credit p…

You seem to be surprised. Ever work at a bank or gargantuan investment company? Same deal.

"Look at how incompetent they are" is more like "Look at how our industry is." They're a representative sample.

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#133

Post by psyc »

adekok wrote: post #95
Keeeeeeeks wrote: post #24

This is embarrassing at this point; a credit authority printing dividends is too busy placating shareholders to even pretend to give a shit about the data of the people who _involuntarily_ have their PII stored on their platform. Whoever files a class action should make a motion such that anyone can purge their PII from a credit authority that's experienced a public hack such that their PII was exposed, or some other…

You're surprised that large companies are incompetent? My experience has been that the main product of most companies is management politics. Actually shipping product is nearly irrelevant to everyone's daily activities. In some cases, people get punished for being competent. One company I worked with made it clear they had no interest in listening to competent people. People were promoted for their ability to suck u…

Suddenly, I'm feeling like it's time to re-read Catch-22.

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#134

Post by nol13 »

ksenzee wrote: post #115
avenoir wrote: post #108

Earlier quoted context omitted.

While I agree, how do you apply software engineering practices in a field where a good chunk of the workforce doesn't have formal computer science education?

Even if the whole workforce had formal computer science degrees, most of us still wouldn't have formal engineering education. The CS programs turn out computer scientists, not professional engineers.

And even if they did have formal engineering education and formal CS degrees and formal whatever most(all?) would still be incapable of writing/designing/implementing bulletproof code.

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#135

Post by supermdguy »

takeda wrote: post #43
rokhayakebe wrote: post #17

Something worth taking into consideration is these companies are not Engineering/Tech companies at the core. They were probably born as paper-companies and digitized their operations later on. I am hoping for the day something and more appropriate for this age will make them irrelevant.

This sounds like blockchain could have application. But honestly, other countries do fine without them, IMO they should just be abolished.

Well, ethereum doesn't exactly have that good of a security record.

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#136

Post by emodendroket »

mikeash wrote: post #118
emodendroket wrote: post #69

Earlier quoted context omitted.

That doesn't really seem comparable.

Why not? The proposal was to license software engineers (at least for "critical" systems) the same way as those.

I'm not a lawyer, but it doesn't seem to me like they work in the same way that software developers do, with management breathing down their throats to do things in less time and telling them to cut this or that corner. If anything is seems more like the opposite with the lawyer directing a lot of his staff to do legwork.

If anything I'd think accounting is a better fit, but even then, I can't say I've met many people in the software industry who think very highly of any sort of existing test or certification; why would this one do so much better at measuring actual skill?

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#137

Post by lawnchair_larry »

stonogo wrote: post #85
ranci wrote: post #39

Earlier quoted context omitted.

"Critical systems" pretty vague, and could be used to describe any system that processes payments or other basic things we use. It's fundamentally different from malpractice in my opinion. In health care malpractice has obvious pieces of data - we know who the doctor is, we know their credentials, we know what information they had and when they had it, we know what they decided, what they prescribed, what they said.…

Real engineers have a system in place for this. It's called "Professional Engineer" and it's managed by NCEES. There is no possible reason that practice cannot directly apply to software engineering, except for the cultural refusal of software engineers to take responsibility for anything.

This concept is really not at all portable to software, especially security. It's a tempting analogy, but an invalid one.

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#138

Post by sokoloff »

andrewjl wrote: post #131
Pxtl wrote: post #98

Earlier quoted context omitted.

A blockchain is public. You want everybody's credit public?

The data isn't public if it's in encrypted form. When you apply for credit, you'd decrypt it with your own private key and re-encrypt it with the creditors private key and send it to the creditor, they would then decrypt privately, process the application, and discard the data.

> you'd decrypt it with your own private key and re-encrypt it with the creditors private key and send it to the creditor

Creditor's public key, not private key.

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#139

Post by KyeRussell »

bspn wrote: post #91
ben_jones wrote: post #26

Earlier quoted context omitted.

Developers don't control budgets and deadlines at large companies, management does. So what does this "certified" individual do when he's given a project without resources allocated for proper security auditing? Does he intentionally get fired for refusing the assignment? That works if he has bountiful savings, no mortgage, no kids. Surely no unethical contracting company will pick up the job after he leaves...

> Developers don't control budgets and deadlines at large companies, management does. True, but that's why good organizations almost always have technical people on the management team who advocate for the technical arm of the company and ensure that it is appropriately resourced.

Seems very beside the point. Equifax obviously isn't a good company.

Re: Equifax security freeze PINs are the timestamp of when you request the freeze

#140

Post by KyeRussell »

morgante wrote: post #58
adrianN wrote: post #49

Earlier quoted context omitted.

I'm reasonably sure that "tech" companies try to save costs just as much as "traditional" companies. The difference might only be that they how to formulate their requirements better.

I am 100% certain that "tech" companies have an entirely different attitude towards engineering costs than non-tech companies. The former want the best people working on problems and will pay what it takes (within reason), the latter want problems solved for the lowest price. This is extraordinarily evident in the distribution of engineer salaries.

That's a massive reach! Have you been spending too long inside the bubble? Define a "tech" company.
Post reply on HN