91–100 of 132 posts
The real crisis here is that Equifax isn't being held responsible for providing meaningful fraud protection beyond one year. When I lived in the UK, the banks were constantly trying to sell me "fraud protection" and "identity protection" - trying to argue with the salesdrones about why you think it is insane that they are trying to sell me protection against their own shoddy information security practices was useless…
Earlier quoted context omitted.
> These [ sic ] credit information don't give much benefit to Americans, it gives benefits to businesses Americans own, work at and consume the products of businesses. If there is a class American law generally holds above investors, in terms of protection, it's consumers. I would also argue consumers benefit from our credit rating agency system, shitty as it is--it allows more people to get cheaper credit faster and…
I would suggest that getting credit faster and more easily is not a benefit for consumers but a benefit to business also.
Access to credit reduces poverty, internationally [1] and domestically [2]. It is also critical to letting poor and middle class individuals start small businesses [3]. Consumers and businesses benefit from financial systems that efficiently allocate credit. That's why both consumers and businesses voluntarily finance purchases with credit. (This is not a Panglossian claim that our system is perfect. Credit is better than no credit for consumers. Our current CRA system, while a complete mess, is still probably better than forcing trust to be re-ascertained at every commercial interaction.)
[1] https://www.microfinancegateway.org/sites/default/files/mfg-...
[2] http://www.nytimes.com/2013/10/29/business/microcredit-for-a...
[3] https://pdfs.semanticscholar.org/9b12/726539fadbcaaebcd7ea9d...
I don't know. I found the argument convincing that even naming the breach "identity theft" is beginning to push responsibility away from Equifax and make it seem a personal problem of those affected, or a general societal phenomenon. When in reality it's just Equifax's poor security practices. As you probably know, the exploit basically is using Java's ability to dynamically execute code from JVM bytecodes (supplied…
Before getting too deep in to this, how do we know it had anything to do with injecting bytecode? It's not clear that's what the Struts bug was about.
Something non-US folks don't always get about the US -- in a lot of ways, the US is more analogous to the EU than it is to any one country of Europe. That is to say, the US Government is the national entity, but quite a lot of power is still held in the states. There is a 200+ year wariness of federal power here. One of the ways this manifests itself is that identity is established and maintained largely by the state…
I don't have a drivers' license, but I carry my Passport Card around.
Earlier quoted context omitted.
The scheme was designed in 1935 as a way of identifying people enrolled in the then-new Social Security program (hence the name), and was gradually made a de facto national ID number over the intervening decades as the increasing scale of national population and economic activity prompted a desire for greater legibility to facilitate management and taxation. Greater legibility, management, and taxation are values not…
The UK is also heavily resistant to any sort of national ID scheme, and so National Insurance numbers (our equiv of SSN) are also a sortof proxy ID for people in work etc. But the difference is we don't pretend they are secret. In other words: we use it as a primary key, but we don't assume its a shared secret.
Or is this simply not possible in the UK without visiting a bank branch etc.?
Earlier quoted context omitted.
Why should the government have it at all? Just let private citizens manage their own private key.
And what happens when people inevitably lose their private key? How will they regain access to their SSN?
This would take a lot of solid investment politically, and technically, to make it even slightly feasible to work for the average Joe.
Something non-US folks don't always get about the US -- in a lot of ways, the US is more analogous to the EU than it is to any one country of Europe. That is to say, the US Government is the national entity, but quite a lot of power is still held in the states. There is a 200+ year wariness of federal power here. One of the ways this manifests itself is that identity is established and maintained largely by the state…
There's no reason we can't have national IDs. I don't have a drivers' license, but I carry my Passport Card around.
P.S. if you don't drive, your state probably offers a state ID card equivalent to the driver license. It is generally cheaper to obtain and replace.
Earlier quoted context omitted.
Ability to execute data as code is present in many languages. Almost all of them these days. I think you are saying that banks should only use C or C++ ??
He is saying they should practice process isolation. Example architecture: https://cr.yp.to/qmail/guarantee.html
The qmail architecture would likely be very inefficient with 100M+ users.
Earlier quoted context omitted.
The scheme was designed in 1935 as a way of identifying people enrolled in the then-new Social Security program (hence the name), and was gradually made a de facto national ID number over the intervening decades as the increasing scale of national population and economic activity prompted a desire for greater legibility to facilitate management and taxation. Greater legibility, management, and taxation are values not…
Use SSN for identity, but use a shared secret as authorization to use that identity. Get SSN, name, place and time of birth, and birth name of mother. In theory 1 SSN maps to 1 (name, place and time of birth + mother's name) tuple, unless you have a twin and you are both called John. (Also, identity verification should could also use biometric data.) Banks already issue PINs to users, they should issue one for regula…
Something non-US folks don't always get about the US -- in a lot of ways, the US is more analogous to the EU than it is to any one country of Europe. That is to say, the US Government is the national entity, but quite a lot of power is still held in the states. There is a 200+ year wariness of federal power here. One of the ways this manifests itself is that identity is established and maintained largely by the state…
There's no reason we can't have national IDs. I don't have a drivers' license, but I carry my Passport Card around.