Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No matter what, Equifax may tell you you’ve been impacted by the hack

techcrunch.com

Post reply on HN
Print view View original

151–157 of 157 posts

Re: No matter what, Equifax may tell you you’ve been impacted by the hack

#151

Post by alkonaut »

Avshalom wrote: post #117
Kiro wrote: post #57

In Sweden your social security number is public information. What's the reason for it being private in the US? Sounds like a horrible thing to rely on for security anyway.

Well I mean, what it comes down to is you need someway of establing that it's actually you over a phone or Internet and you can assume that an equifax-equivalent would be storing that info regardless of exactly what it is in Sweden.

Important thing here: each id number has an address. I.e if you call them and say you are Bob with id 123456789 then they know the street address. So they can send a confirmation letter that needs to be signed, to the address belonging to Bob with id 123456789.

This makes the phone scam a lot more involved because you can impersonate someone on the phone but the mail makes it kind of 2fa. The credit card you tried to open in Bob's name will always be sent to the real address of Bob.

The bank didn't need to store much here - names and addresses they can lookup directly from the id number.

Re: No matter what, Equifax may tell you you’ve been impacted by the hack

#152

Post by quuquuquu »

literallycancer wrote: post #139
quuquuquu wrote: post #131

Earlier quoted context omitted.

What do you mean by, "you can't touch their money"? You can spoof their identity, to instantly acquire material goods / lines of credit. And, if you are extremely persistent, you can spoof identity documents and hack bank accounts.

>What do you mean by, "you can't touch their money"? If you had the number of my credit card, my account number, my social security number (or the local equivalent), my address or my name, or whatever else, short of my 2FA device and my internet banking credentials, you won't be able to steal anything. (And at that point, you might as well walk up to my house, break a window and steal whatever the hell you need while…

>Yes, but against a determined attacker that singles you out, you are fucked regardless of what you do, especially if it's your bank or similar service provider that screws up even if you don't.

Isn't that what we're trying to prevent- becoming the victim of a determined attacker?

I don't really care about protecting myself from /only/ script kiddies.

If I put my money in a bank and they "accidentally" allow someone other than myself to withdraw it, /the bank/ has been defrauded, not me.

Thanks to corporate control of the US gov't, it is now me who has actually been defrauded, thanks to some fun mental gymnastics.

So, I have to spend time and money and frustration trying to convince the bank to uh... what's it called... oh yes, give me my money back, please.

The system is broken for sure, but I really truly hope we can vote some people into office who will turn the tables on how these laws currently work.

Otherwise we will all eventually be hacked, stolen from, or worse.

Re: No matter what, Equifax may tell you you’ve been impacted by the hack

#153

Post by djsumdog »

Kiro wrote: post #57

In Sweden your social security number is public information. What's the reason for it being private in the US? Sounds like a horrible thing to rely on for security anyway.

The social security cards here use to say "Not for identification." Then the IRS started using it as a Tax ID instead of creating their own (my Tax IDs in Australia and NZ, two places I had work visas for, were public as well).

Most countries have some type of citizen identification number, which is attached to some ID with a photo and/or finger prints. The US does not, and the political climate for the past several decades would probably never allow this. The Real ID act has been seen as a sign of the beast by religious fundamentalist and a basic erosion of rights by libertarians et. al.

Passport numbers can't be used either because not all US citizens/residents have a passport and the numbers change when you renew them. Most parents get a SSN for their child at birth. Even people I know with dual citizenship overseas have them (all except for one, and you don't really need one unless you want to go to America to work .. and then you'll also need to pay an immigration/tax lawyer to go back and reconcile all your taxes).

Here's a great video on it: https://www.youtube.com/watch?v=Erp8IAUouus

Re: No matter what, Equifax may tell you you’ve been impacted by the hack

#154

Post by usr1106 »

Kiro wrote: post #57

In Sweden your social security number is public information. What's the reason for it being private in the US? Sounds like a horrible thing to rely on for security anyway.

Yes, it kind of is public, because you have to use it in many contexts.

But knowing a persons name and social security number allows you to do all kind of misuse, i. e. identity theft. I have not lived in Sweden for 30 years, but I assume many things still work similar as here in Finland. Closing other people's credit cards and mobile phone subscriptions typically works by knowing the social security number. Ordering online without credit card and paying the bill (or not) after delivery, too.

Re: No matter what, Equifax may tell you you’ve been impacted by the hack

#155

Post by companyhen »

mbillie1 wrote: post #63
companyhen wrote: post #56

I keep seeing people say Blockchain technology would prevent this type of hack. True?

Blockchain technology would prevent a web app vulnerability? What on earth?

I was wondering the same.. just what I saw some of the crypto people I follow on Twitter say.

Re: No matter what, Equifax may tell you you’ve been impacted by the hack

#156

Post by belovedeagle »

fastball wrote: post #13

This isn't a very rigorous test, and TC's assertion that this may be random is probably untrue given that the results seem to be consistent if you enter the same details multiple times. The idea that Equifax has implemented a random yet deterministic checking system seems beyond the pail of belief. If I had to guess, I would say that Equifax is not checking against a list of people that they know are compromised, but…

Your conclusion is entirely unfounded. Returning the same result for the same input does not in any way refute the claim that it's random. It could just as well seed the RNG with the input or any number of other implementations.

Re: No matter what, Equifax may tell you you’ve been impacted by the hack

#157

Post by fastball »

belovedeagle wrote: post #156
fastball wrote: post #13

This isn't a very rigorous test, and TC's assertion that this may be random is probably untrue given that the results seem to be consistent if you enter the same details multiple times. The idea that Equifax has implemented a random yet deterministic checking system seems beyond the pail of belief. If I had to guess, I would say that Equifax is not checking against a list of people that they know are compromised, but…

Your conclusion is entirely unfounded. Returning the same result for the same input does not in any way refute the claim that it's random. It could just as well seed the RNG with the input or any number of other implementations.

My conclusion fits the facts just as well as TC's does, and my conclusion seems more believable to me.
Post reply on HN