PII is the nuclear waste of the internet. Incredibly expensive to store safely, and constantly vulnerable to a catastrophe.
Equifax’s Maddening Unaccountability
81–90 of 238 posts
Re: Equifax’s Maddening Unaccountability
#82Earlier quoted context omitted.
If it turns out that their web server has 100% unfettered access to the database then I'll gladly pick up a pitchfork as well. You may want to think twice. Try to design an architecture that doesn't have that. If you think it through, you'll realize the best you can do is not to deny access, but to monitor access so that any statistical deviation in requests-per-hour will trigger an alarm. Yet nobody does that, so wh…
> You may want to think twice. Try to design an architecture that doesn't have that. We have an architecture like that where I work. It's not that hard. Our web applications have very little direct access to databases; most of it is mediated by services downstream of the web app. That's certainly not a silver bullet, but it makes it impossible to exploit a RCE vuln in the web server in such a way that it lets you hav…
Have you had a netpen? Give me access to your web server (aka an RCE) and I can probably find a way to pivot to your downstream databases.
Re: Equifax’s Maddening Unaccountability
#83Earlier quoted context omitted.
So, if I don't want to give them my approval, I must: not sign up for a bank account, never open a credit card, avoid getting a mortgage, buy only in cash, stop renting [0], only apply to some jobs [1], not take out student loans... [0] Some landlords require credit approval [1] Some jobs check credit
You also can only buy cars from individuals (dealerships run credit checks, even if you pay with cash/check/direct draft) and you probably can't get power, water, gas or Internet in your name (you'd need a roommate and have to pay them).
Why would a dealership need to do a credit check if I showed up with a briefcase full of money to buy a car?
Re: Equifax’s Maddening Unaccountability
#84Earlier quoted context omitted.
Equifax has an $18B market cap. Can you name one instance of a government imposed fine for improperly stored PII exceeding even $100M? Furthermore, do you have evidence that the PII was improperly stored, or that Equifax's security practices were lacking in any way? The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that.
> The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that. If the vulnerability used turns out to be the Struts one that was announced at the beginning of the year, then the "magic" here would have been quite muggle-like: update the damn dependency. Not doing so is negligence, plain and simple. (I agree with you, though, that EFX will almost certainly come out of this rel…
The statement released by Apache said that, if the attack did use the REST plugin vulnerability in Struts, then it would have been a zero-day at the time of use.
Re: Equifax’s Maddening Unaccountability
#85There's something very disturbing about the fact that they can collect my personal information (without my approval); profit on that info (without compensating me); and then get hacked and I have no reasonable recourse for what they've done?? How can they not be liable? How is this not negligence?
The credit system sucks. But has anybody created a better alternative yet?
Yes! Germany and I presume other European countries have a much better system.
The main difference is that there is no magic number that any one can use to borrow money in your name. Lenders have to verify a person's identity using ID.
Further more, to get loan you don't have build up a score first. You could get a margage if you have never borrowed money in your life but have a stable income.
Re: Equifax’s Maddening Unaccountability
#86There's something very disturbing about the fact that they can collect my personal information (without my approval); profit on that info (without compensating me); and then get hacked and I have no reasonable recourse for what they've done?? How can they not be liable? How is this not negligence?
Common misconception. They actually do need your approval, it's just that that approval is buried in the mountains of legalese you sign whenever you sign up for a bank account, credit card or loan.
A choice you can't say no to is no choice.
Re: Equifax’s Maddening Unaccountability
#87Earlier quoted context omitted.
There's an important difference: consumers choose to fly with UA just like they choose to walk into Chipotle and buy a burrito. The vast majority of EFX's profits come from services that consumers (effectively) don't choose to participate in.
I get your point but, in this case, the consumers are banks and the likes. You aren't, probably, their customer. I'm not suggesting that's right, but it is how it is.
What impetus do the banks have to change credit rating providers, especially when it would come at massive cost to themselves and probably take months if not years?
The only one I can think of would be consumers refusing to open bank accounts or credit cards with them because they run Equifax checks, which seems improbable.
Re: Equifax’s Maddening Unaccountability
#88There's something very disturbing about the fact that they can collect my personal information (without my approval); profit on that info (without compensating me); and then get hacked and I have no reasonable recourse for what they've done?? How can they not be liable? How is this not negligence?
I still hold that this shouldn't matter to consumers.
My priority of problems is
* When fraud happens, banks can pass the pain and burden of proof onto consumers.
* Banks use insecure SSNs for authorization; some data is used for validating eligibility, authenticating the application, and authorizing the loan.
* There are minimal regulations on storing different classes of personal information (We need sarbanes-oxley for auditing/accountability of aggregated personal information).
If 1. was addressed, banks would have an incentive to fix 2., and force credit reporting agencies to improve 3.
Re: Equifax’s Maddening Unaccountability
#89We have the technology to manage credit in ways that are vastly more private and secure than a giant, poorly run, insecure personal data repository.
Using strong cryptography, we can build pseudonymous trust graphs where nodes in the graph (cryptographic identities) publish cryptographically auditable trust relationships. Using various graph exploration techniques (e.g. unrolling the trust graph into a trust DAG with known creditors as terminal nodes and calculating path properties to those nodes, using proof-of-burn and non-distributive path combination to disincentivize Sybil attacks on the trust graph, etc.) we can estimate trustworthiness (or, more specifically, creditworthiness) of cryptographic identities rather than legal identities. In the end, you're probably still going to want to link at least one cryptographic with your bank account, but you would have vastly more control over the relationship between privacy and public verifiability of trustworthiness.
If course, just because this is possible doesn't mean it's going to happen. The primary obstacles to an open, secure trust system are that A) it's harder to make people manage their own trust network than it is to spy on them B) trust networks rely on the network effect and C) there's no obvious way to make money off it. Any extant system that resembles what I've described is mostly limited to tech nerds. I'm not sure what it would take to trick/convince the general population to use such a system.
Re: Equifax’s Maddening Unaccountability
#90"I’m not unsympathetic to the needs of software developers."
Yes she is. I read this as completely unrealistic expectations from the author. Struts is maintained by one person.
https://github.com/apache/struts/graphs/contributors
"Most software failures and data breaches aren’t inevitable; they are a result of neglect and underinvestment in product reliability and security."
The attack happened in late July. The bug was fixed/reported in early September. It was a zero day. That's not neglect.