Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: I'll mail Equifax your arbitration opt-out for free

unarbitrate.org

Post reply on HN
Print view View original

81–90 of 92 posts

Re: Show HN: I'll mail Equifax your arbitration opt-out for free

#81

Post by chippy »

wglb wrote: post #43
novia wrote: post #22

It's worth noting that the equifaxsecurity2017 website posted the following update yesterday: "NO WAIVER OF RIGHTS FOR THIS CYBER SECURITY INCIDENT In response to consumer inquiries, we have made it clear that the arbitration clause and class action waiver included in the Equifax and TrustedID Premier terms of use does not apply to this cybersecurity incident."

Note the statement by the New York State Attorney General: https://twitter.com/AGSchneiderman/status/906195350532304896 . Not enforceable.

Was this in response to the update? Or the original terms?

Re: Show HN: I'll mail Equifax your arbitration opt-out for free

#83

Post by runeks »

ComodoHacker wrote: post #78
runeks wrote: post #76

Earlier quoted context omitted.

What we lack, in my opinion, is a form of access control for static websites, such that they are disallowed from making any outgoing requests. The browser is in control of the site code; it should be possible to guarantee that no outgoing requests can take place. As far as I can see, it shouldn’t be difficult, but it’s possible I’m missing something — I assume the difficult part is just reaching agreement. Perhaps it…

Who would be the party who ensures the site is actually static and doesn't send data from backend?

The browser handles requests to the backend, and would thus be the one in charge of not allowing requests in case the site enables this proposed “offline mode”. So all the browser would allow would be the initial, user-initiated fetch of the static site, whereas subsequent requests — initiated by the site itself — would be disallowed.

Re: Show HN: I'll mail Equifax your arbitration opt-out for free

#84

Post by paulddraper »

PrimHelios wrote: post #56
menzoic wrote: post #29

Earlier quoted context omitted.

I don't know if thats legally binding.

NYS attorney general announced it was unenforceable yesterday [0]. Equifax is dead and buried at this point. [0] https://twitter.com/AGSchneiderman/status/906195350532304896

Read later tweets...

Re: Show HN: I'll mail Equifax your arbitration opt-out for free

#85

Post by paulddraper »

simonk wrote: post #65
tome wrote: post #18

> you can opt-out within 30 days of signing up Within 30 days of signing up for what? Surely no one signs up for Equifax.

They have a identity theft protection and credit file monitoring program.

The wolf guardian the sheep.

Re: Show HN: I'll mail Equifax your arbitration opt-out for free

#86

Post by wglb »

chippy wrote: post #81
wglb wrote: post #43

Earlier quoted context omitted.

Note the statement by the New York State Attorney General: https://twitter.com/AGSchneiderman/status/906195350532304896 . Not enforceable.

Was this in response to the update? Or the original terms?

As I understand it, the original terms.

Re: Show HN: I'll mail Equifax your arbitration opt-out for free

#88

Post by didgeoridoo »

runeks wrote: post #76
mdip wrote: post #69

Kind of the guy to offer. I found it interesting thinking about the issue of trust, here. He's claimed to be a certain individual, linked to social media with a long history as a proof of identity, but still had to admit that you're basically hitting up a site to solve identity theft using a tool that might help cause you more privacy problems should the individual not be who he claims to be[0]. I hope the folks at K…

What we lack, in my opinion, is a form of access control for static websites, such that they are disallowed from making any outgoing requests. The browser is in control of the site code; it should be possible to guarantee that no outgoing requests can take place. As far as I can see, it shouldn’t be difficult, but it’s possible I’m missing something — I assume the difficult part is just reaching agreement. Perhaps it…

Isn't that basically CORS?

Re: Show HN: I'll mail Equifax your arbitration opt-out for free

#89

Post by rizky05 »

runeks wrote: post #76
mdip wrote: post #69

Kind of the guy to offer. I found it interesting thinking about the issue of trust, here. He's claimed to be a certain individual, linked to social media with a long history as a proof of identity, but still had to admit that you're basically hitting up a site to solve identity theft using a tool that might help cause you more privacy problems should the individual not be who he claims to be[0]. I hope the folks at K…

What we lack, in my opinion, is a form of access control for static websites, such that they are disallowed from making any outgoing requests. The browser is in control of the site code; it should be possible to guarantee that no outgoing requests can take place. As far as I can see, it shouldn’t be difficult, but it’s possible I’m missing something — I assume the difficult part is just reaching agreement. Perhaps it…

Just turn off your network while using the site

Re: Show HN: I'll mail Equifax your arbitration opt-out for free

#90

Post by kybernetikos »

didgeoridoo wrote: post #88
runeks wrote: post #76

Earlier quoted context omitted.

What we lack, in my opinion, is a form of access control for static websites, such that they are disallowed from making any outgoing requests. The browser is in control of the site code; it should be possible to guarantee that no outgoing requests can take place. As far as I can see, it shouldn’t be difficult, but it’s possible I’m missing something — I assume the difficult part is just reaching agreement. Perhaps it…

Isn't that basically CORS?

CORS stops you from contacting an external service that doesn't opt in. It doesn't solve the problem of having private data in the browser that you don't want it to send out, since it could contact an evil site that opts in to receiving messages from other web pages.

To implement something like the suggestion would require two phases - one where the page was loading/updating its cache from the remote service, but was unable to look at locally stored data, and another phase, where the user is able to log in and allow access to locally stored data. Once transition has been made to the second phase network access would not be allowed. This sounds pretty involved.

Post reply on HN