Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equifax’s Maddening Unaccountability

nytimes.com

Post reply on HN
Print view View original

31–40 of 238 posts

Re: Equifax’s Maddening Unaccountability

#31

Post by empath75 »

cloakandswagger wrote: post #19
bob1029 wrote: post #11

Earlier quoted context omitted.

>but I doubt this leak will have any lasting financial impact. I am going to have to stop you there. As someone who works in the financial sector, I have quite a different view of this situation. Best case scenario (for the organization) is that it is fined directly into bankruptcy and someone like FIS acquires them for pennies on the dollar. I am still waiting for CFPB to drop a nuclear bomb over this issue. There w…

Equifax has an $18B market cap. Can you name one instance of a government imposed fine for improperly stored PII exceeding even $100M? Furthermore, do you have evidence that the PII was improperly stored, or that Equifax's security practices were lacking in any way? The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that.

Having root on a web server shouldn't give you access to 147 million customer records.

Re: Equifax’s Maddening Unaccountability

#32

Post by kahnjw »

g051051 wrote: post #27
kahnjw wrote: post #13

Earlier quoted context omitted.

You're oversimplifying. This has more to do with politics than SE technical competence. Banking software and systems are regulated end to end, because banking systems are literally the backbone of the global economy. Equifax? Not so much. This exposure hurts consumers, but it doesn't even put a dent in the economy as a whole. That is why these firms are allowed to operate with such shitty security. If they get hacked…

> What is the incentive for congress to enact laws regulating corporate handling of consumer data? The already did, it's called the Gramm–Leach–Bliley Act: > In terms of compliance, the key rules under the Act include The Financial Privacy Rule which governs the collection and disclosure of customers' personal financial information by financial institutions. It also applies to companies, regardless of whether they ar…

GLBA was enacted in the 90s and is a vague set of guidelines for financial and related industries to follow. I'm talking about real system regulation, down to the level of protocols.

Re: Equifax’s Maddening Unaccountability

#33

Post by Pxtl »

wil421 wrote: post #28
mbesto wrote: post #20

Earlier quoted context omitted.

The problem is lack of commercial incentives. Apple, Google, Facebook, etc all have serious dollars at stake if they don't get security right. Equifax on the other hand...

Since when is 3 billion dollars in revenue not serious money?

Because they don't lose any of it for the breach. Market value will bounce right back. The company will merrily chug along like nothing happened and collectively the industry will go on working with Equifax because who else will they use?

Re: Equifax’s Maddening Unaccountability

#34

Post by wil421 »

HarryHirsch wrote: post #9
JumpCrisscross wrote: post #4

Earlier quoted context omitted.

I read a consistent argument. Expecting perfection is wrong. Expecting consumers to shoulder the vast majority of the costs of that imperfection is also wrong.

Expecting perfection is wrong. There's 120 millions of lines of code in an A380, and planes don't crash due to software bugs. Why is it wrong to expect perfection in critical infrastructure? Something went wrong somewhere in software engineering. My HP42s calculator has about 6 insignificant bugs that you need to get out of your way to trigger. Your new cellphone on the other hand, when you turn it on it downloads a…

You're comparing a relatively cheap credit report to a $400 million dollar airplane with a 15-25 billion euro program cost. Not to mention aerospace has a 100 years of innovation and has actual lives at stake. The internet, what 30ish years? Not to mention network security is a relatively new concern.

Re: Equifax’s Maddening Unaccountability

#35

Post by kahnjw »

mbesto wrote: post #20
iamleppert wrote: post #7

The problem is incompetence in our industry. Anyone who has worked long enough knows that technical competency is not rewarded (outside a few rare firms) in software engineering.

The problem is lack of commercial incentives. Apple, Google, Facebook, etc all have serious dollars at stake if they don't get security right. Equifax on the other hand...

Exactly. And congress can fix it.

Re: Equifax’s Maddening Unaccountability

#36

Post by kahnjw »

wil421 wrote: post #28
mbesto wrote: post #20

Earlier quoted context omitted.

The problem is lack of commercial incentives. Apple, Google, Facebook, etc all have serious dollars at stake if they don't get security right. Equifax on the other hand...

Since when is 3 billion dollars in revenue not serious money?

Have you heard the term moral hazard?

Re: Equifax’s Maddening Unaccountability

#37

Post by mbesto »

wil421 wrote: post #28
mbesto wrote: post #20

Earlier quoted context omitted.

The problem is lack of commercial incentives. Apple, Google, Facebook, etc all have serious dollars at stake if they don't get security right. Equifax on the other hand...

Since when is 3 billion dollars in revenue not serious money?

Because you and I do NOT pay for or directly use the product that contributes to the $3B. I can buy a phone and still avoid Apple. I can use the web and still avoid Google. I can avoid Facebook altogether (some argument as to wether I can actually avoid this). But if I want to use a credit card, buy a house, etc. I cannot escape Equifax.

Re: Equifax’s Maddening Unaccountability

#38

Post by chiefalchemist »

There's something very disturbing about the fact that they can collect my personal information (without my approval); profit on that info (without compensating me); and then get hacked and I have no reasonable recourse for what they've done??

How can they not be liable? How is this not negligence?

Re: Equifax’s Maddening Unaccountability

#39

Post by SilasX »

cloakandswagger wrote: post #6

Now would be a great time to go long EFX in my opinion. The stock has been slammed while Equifax is being flogged in the court of public opinion, but I doubt this leak will have any lasting financial impact. Look at the result of the Target and Home Depot breaches: whether you like it or not, the companies are still technically the victims here and no court is going to bankrupt them for data breaches that are more an…

Did you use that strategy with United Airlines after they injured that guy when bouncing him from the flight?

Re: Equifax’s Maddening Unaccountability

#40

Post by SilasX »

bob1029 wrote: post #11
cloakandswagger wrote: post #6

Now would be a great time to go long EFX in my opinion. The stock has been slammed while Equifax is being flogged in the court of public opinion, but I doubt this leak will have any lasting financial impact. Look at the result of the Target and Home Depot breaches: whether you like it or not, the companies are still technically the victims here and no court is going to bankrupt them for data breaches that are more an…

>but I doubt this leak will have any lasting financial impact. I am going to have to stop you there. As someone who works in the financial sector, I have quite a different view of this situation. Best case scenario (for the organization) is that it is fined directly into bankruptcy and someone like FIS acquires them for pennies on the dollar. I am still waiting for CFPB to drop a nuclear bomb over this issue. There w…

Seriously? I rarely see these deeply enmeshed financial firms get fined into bankruptcy, since they've effectively reached "too big to fail". Kind of optimistic to call that the "best case" scenario.
Post reply on HN