Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equifax’s Maddening Unaccountability

nytimes.com

Post reply on HN
Print view View original

111–120 of 238 posts

Re: Equifax’s Maddening Unaccountability

#111

Post by jMyles »

cloakandswagger wrote: post #6

Now would be a great time to go long EFX in my opinion. The stock has been slammed while Equifax is being flogged in the court of public opinion, but I doubt this leak will have any lasting financial impact. Look at the result of the Target and Home Depot breaches: whether you like it or not, the companies are still technically the victims here and no court is going to bankrupt them for data breaches that are more an…

> whether you like it or not, the companies are still technically the victims here

Wait, what?!

What does whether I "like it or not" have to do with Equifax's profound negligence?

Re: Equifax’s Maddening Unaccountability

#112

Post by yborg »

cloakandswagger wrote: post #23
maxxxxx wrote: post #12

Earlier quoted context omitted.

I thought about that too but it could also be possible that they may get bankrupted by lawsuits. I don't see Equifax as victim. I hope they will go down and be warning for the rest of the financial industry.

Target lost tens of millions of credit card numbers and paid just over $18 million to settle every lawsuit against them. People seem to conflate the way they think things should be with the way things actually are .

Exactly. The costs to EFX will likely be Longer term, this is actually quite possibly revenue-positive for Equifax - they will trick a non-inconsiderable number of people into signing up for their credit monitoring service, and everyone who wants a credit freeze gets to pay $10 (in Illinois at least). That's $1.45B in potential revenue right there! Once Transunion and Experian see the success of this ploy, they may have strangely poorly secured border networks of their own set up invitingly for the retail hacker...

Re: Equifax’s Maddening Unaccountability

#113

Post by pishpash »

cloakandswagger wrote: post #50
chiefalchemist wrote: post #38

There's something very disturbing about the fact that they can collect my personal information (without my approval); profit on that info (without compensating me); and then get hacked and I have no reasonable recourse for what they've done?? How can they not be liable? How is this not negligence?

Common misconception. They actually do need your approval, it's just that that approval is buried in the mountains of legalese you sign whenever you sign up for a bank account, credit card or loan.

These fake contracts are the bigger problem.

Re: Equifax’s Maddening Unaccountability

#114

Post by Y7ZCQtNo39 »

cloakandswagger wrote: post #50
chiefalchemist wrote: post #38

There's something very disturbing about the fact that they can collect my personal information (without my approval); profit on that info (without compensating me); and then get hacked and I have no reasonable recourse for what they've done?? How can they not be liable? How is this not negligence?

Common misconception. They actually do need your approval, it's just that that approval is buried in the mountains of legalese you sign whenever you sign up for a bank account, credit card or loan.

Is it really a choice if it's necessary to participate in our economy? No bank or loan will offer terms that don't involve the use of one of these credit reporting agencies.

Re: Equifax’s Maddening Unaccountability

#115

Post by revelation »

ma2rten wrote: post #104
barsonme wrote: post #94

Earlier quoted context omitted.

> You could get a margage if you have never borrowed money in your life but have a stable income. Same in the US, although it's a bit of a pain in the ass. It's my understanding, though, (correct me if I'm wrong!) that Germany is a bit less thrilled about credit than most other countries—even in Europe.

I don't think so? Germans have less credit cards, but they are still borrow money in the form of overdraft loans on their bank accounts.

No, they don't, just as most Americans will always pay their credit cards in full. Overdraft loans have terrible APR, as does credit from credit cards.

Re: Equifax’s Maddening Unaccountability

#116

Post by Y7ZCQtNo39 »

School-Cotton wrote: post #83
djsumdog wrote: post #73

Earlier quoted context omitted.

You also can only buy cars from individuals (dealerships run credit checks, even if you pay with cash/check/direct draft) and you probably can't get power, water, gas or Internet in your name (you'd need a roommate and have to pay them).

Why would a dealership need to do a credit check if I showed up with a briefcase full of money to buy a car?

I bought a car by check in CA and I'm 99% sure I didn't get a credit check. I did have to prove to the seller that the account from which the check was written had sufficient funds, but that was it.

Re: Equifax’s Maddening Unaccountability

#117

Post by pishpash »

bob1029 wrote: post #11
cloakandswagger wrote: post #6

Now would be a great time to go long EFX in my opinion. The stock has been slammed while Equifax is being flogged in the court of public opinion, but I doubt this leak will have any lasting financial impact. Look at the result of the Target and Home Depot breaches: whether you like it or not, the companies are still technically the victims here and no court is going to bankrupt them for data breaches that are more an…

>but I doubt this leak will have any lasting financial impact. I am going to have to stop you there. As someone who works in the financial sector, I have quite a different view of this situation. Best case scenario (for the organization) is that it is fined directly into bankruptcy and someone like FIS acquires them for pennies on the dollar. I am still waiting for CFPB to drop a nuclear bomb over this issue. There w…

Knowledge based authentication is crap and therefore worthless. I look forward to it being marked to market.

Re: Equifax’s Maddening Unaccountability

#118

Post by cramforce »

barsonme wrote: post #94
ma2rten wrote: post #85

Earlier quoted context omitted.

Yes! Germany and I presume other European countries have a much better system. The main difference is that there is no magic number that any one can use to borrow money in your name. Lenders have to verify a person's identity using ID. Further more, to get loan you don't have build up a score first. You could get a margage if you have never borrowed money in your life but have a stable income.

> You could get a margage if you have never borrowed money in your life but have a stable income. Same in the US, although it's a bit of a pain in the ass. It's my understanding, though, (correct me if I'm wrong!) that Germany is a bit less thrilled about credit than most other countries—even in Europe.

Credit management is big in Germany through SCHUFA and other companies and queried much more liberally. E.g. every time you purchase something online the store will likely check your credit and determine available payment instruments (this is pre-purchase) based on the response.

Re: Equifax’s Maddening Unaccountability

#119

Post by redial »

Iknowsecurity wrote: post #68
chiefalchemist wrote: post #38

There's something very disturbing about the fact that they can collect my personal information (without my approval); profit on that info (without compensating me); and then get hacked and I have no reasonable recourse for what they've done?? How can they not be liable? How is this not negligence?

The credit system sucks. But has anybody created a better alternative yet?

Yes, many times. It is not that hard to not base your entire banking system on a single number anyone can use.

Re: Equifax’s Maddening Unaccountability

#120

Post by danjoc »

grzm wrote: post #92
danjoc wrote: post #90

"I’m not unsympathetic to the needs of software developers." Yes she is. I read this as completely unrealistic expectations from the author. Struts is maintained by one person. https://github.com/apache/struts/graphs/contributors "Most software failures and data breaches aren’t inevitable; they are a result of neglect and underinvestment in product reliability and security." The attack happened in late July. The bug…

> Struts is maintained by one person. I see nowhere in the op-ed piece where Tufekci mentions Struts or implies that she holds Struts responsible for this. She is clearly laying this at Equifax's feet, and their responsibility in their choice of software and the industry as a whole for actively pushing against better software practices and responsibility. The section you quoted is followed by: > Some number of unexpe…

She's blaming the software industry and software failure. That's Apache, and Struts.

If she wanted to lay it on Equifax, she might go into the fact that the Chief Information Security Officer at Equifax holds a masters in music,

https://www.hollywoodlanews.com/equifax-chief-security-offic...

The people that actually "do" are Chief Peon of Cube Farms, doing whatever the boss with a music degree tells them is priority.

>You're right in that this seems to be zero-day which are more difficult to defend against

There's no nuance. It is under-reporting the facts to make her hit piece look stronger. It's never the leadership's fault when there's a failure in the US, but they happily take credit when there is success.

>but there are practices

Which don't help at all against a zero-day in a dependency.

Post reply on HN