161–170 of 238 posts
Maybe this will finally be the "Three Mile Island Incident of Data" that Maciej Cegłowski talks about? If not, I don't know what will. http://idlewords.com/talks/haunted_by_data.htm
Earlier quoted context omitted.
Why would a dealership need to do a credit check if I showed up with a briefcase full of money to buy a car?
Because the patriot act. https://www.edmunds.com/car-buying/car-dealership-credit-rep... I was also very surprised to buy a car with cash, only to have a credit check required. It's a real thing. And according to this article, not required, but dealerships are confused by the language of the law and insist on running a credit check, anyway.
Earlier quoted context omitted.
I'm eagerly awaiting the technical details of the attack. If it turns out that their web server has 100% unfettered access to the database then I'll gladly pick up a pitchfork as well. I'm wondering if Equifax is using Struts-provided REST for its entire architecture. If that's the case, gaining access to the web server was only the first step. From there the attacker could perform RCE on sensitive services.
If it turns out that their web server has 100% unfettered access to the database then I'll gladly pick up a pitchfork as well. You may want to think twice. Try to design an architecture that doesn't have that. If you think it through, you'll realize the best you can do is not to deny access, but to monitor access so that any statistical deviation in requests-per-hour will trigger an alarm. Yet nobody does that, so wh…
Earlier quoted context omitted.
I still hold that this shouldn't matter to consumers. My priority of problems is * When fraud happens, banks can pass the pain and burden of proof onto consumers. * Banks use insecure SSNs for authorization; some data is used for validating eligibility, authenticating the application, and authorizing the loan. * There are minimal regulations on storing different classes of personal information (We need sarbanes-oxley…
I heard in US if somebody knows your SSN, he can take a loan accounted to you by phone. It is so strange. What gives banks right to do that?
How do we know that Equifax fell into this category? That this was due to negligence? I see a lot of disdain towards Equifax but yet the breach details have not been out yet.
Equifax played a slightly different version if this commercial during Monday Night Football a few times, it takes no accountability, but also doubles-down, claims your info might* be on the dark-web(*because they just negligently released it), and offers a "dark-web-scan" service to help find it... https://www.youtube.com/watch?v=vjrydnr_pvQ
Earlier quoted context omitted.
I heard in US if somebody knows your SSN, he can take a loan accounted to you by phone. It is so strange. What gives banks right to do that?
There is a huge difference between taking a loan "on someone's behalf" (as their representative, eg by someone with power-of-attorney) versus via impersonating them. The former is rare but legitimate; the latter is fraud.
Equifax played a slightly different version if this commercial during Monday Night Football a few times, it takes no accountability, but also doubles-down, claims your info might* be on the dark-web(*because they just negligently released it), and offers a "dark-web-scan" service to help find it... https://www.youtube.com/watch?v=vjrydnr_pvQ
So how can I stop using Equifax? Or at the very least how can I find banks or other agencies that don't use Equifax? Is there any way to stop them from hoarding all my data without my explicit consent?
"Most software failures and data breaches aren’t inevitable; they are a result of neglect and underinvestment in product reliability and security." How do we know that Equifax fell into this category? That this was due to negligence? I see a lot of disdain towards Equifax but yet the breach details have not been out yet.