Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equihax

krypt3ia.wordpress.com

Post reply on HN
Print view View original

51–60 of 209 posts

Re: Equihax

#51

Post by ocdtrekkie »

princetontiger wrote: post #8

This really pisses me off. It's only a matter of time before some random person opens up a cellphone, utlity, or bank account... or worse. Completely messed up. Everyone American should be scared shitless at this incompetence. It's going to cost everyone thousands of dollars over their lives for credit fraud protection. Just another expense to add.

The thing is, up until now, there was a false sense of security that if someone didn't have your SSN, they couldn't open up financial accounts as you. And there was little being done to protect people whose SSNs are already disclosed in some way.

With such a large percentage of our social security numbers being potentially outright public, financial institutions need to stop assuming that an account holder is legitimate because they provide an SSN. And it is in their best interests to do so, since they end up on the hook in most cases for fraudulent accounts (after putting you through an awful process to prove it isn't yours).

For example, rather than letting someone sign up for an account with the SSN as a verification of identity, new credit accounts could potentially be considered probationary (or just outright not created) until a one-time code is mailed to the credit holder's established home address (based on their existing credits and payment history) as confirmation that the real person with that SSN authorizes that transaction. While such a step would not be completely impossible to defeat, it would mitigate attackers on the other side of the globe opening fraudulent accounts.

Re: Equihax

#53

Post by jerf »

hamburglar1 wrote: post #49

This looks like B.S. to me. - Who would store date of birth as a string? - If we are stringifying dob why is address still seperated? - Why are the credit report reasource Ids in the thousands not 1M +? - Why is the file size null but the file is listed with it's mimeType? I know equifuckingsucks at security but this is a setup that would actually just be difficult to interact with from a data stand point

"Who would store date of birth as a string?"

Enterprise.

"If we are stringifying dob why is address still seperated?"

Enterprise.

"Why are the credit report reasource Ids in the thousands not 1M +?"

Enterprise.

"Why is the file size null but the file is listed with it's mimeType?"

Enterprise.

Be grateful you are in a position to be horrified. I'm currently fighting my way through a system that is not currently "Enterprise" yet, but was certainly headed full bore in that direction.

Re: Equihax

#54

Post by rothbardrand »

jitix wrote: post #34
robertelder wrote: post #28

Cool, this is good news as it means I might actually be able to find out my credit score. I recently sent in an application to Equifax to get my credit score along with all the security documents, proof of address, passport, drivers license, registered mail etc. and they rejected my application because I didn't provide a hydro bill. Unfortunately, I live in an apartment and I don't pay hydro, so I sent in a copy of t…

Same here.. I applied for a loan and they found that Equifax doesn't even have my report (although the other two do). After countless phone calls they agreed to start the investigation and then the hack happened. The whole concept of private credit bureaus (that to multiple ones whose data dont match up) is fucked up. I think the federal govt should step in an put a stop to this.

The federal government is the reason it is this way-- the FCRA "Fair credit reporting act" is what give this bureaus virtual immunity from liability for propagating false information and the like. This is a great example of where regulation is anti-consumer because the regulations that pretend to protect consumers provide very little protection for consumers and a great deal of protection for the CRAs.

Re: Equihax

#55

Post by koolba »

jerf wrote: post #53
hamburglar1 wrote: post #49

This looks like B.S. to me. - Who would store date of birth as a string? - If we are stringifying dob why is address still seperated? - Why are the credit report reasource Ids in the thousands not 1M +? - Why is the file size null but the file is listed with it's mimeType? I know equifuckingsucks at security but this is a setup that would actually just be difficult to interact with from a data stand point

"Who would store date of birth as a string?" Enterprise. "If we are stringifying dob why is address still seperated?" Enterprise. "Why are the credit report reasource Ids in the thousands not 1M +?" Enterprise. "Why is the file size null but the file is listed with it's mimeType?" Enterprise. Be grateful you are in a position to be horrified. I'm currently fighting my way through a system that is not currently "Enter…

Exactly. The data model, and particular data typing, being terrible is more indicative of it being legit. Not less.

Re: Equihax

#57

Post by jnbiche »

weatherlight wrote: post #52

https://trustedidpremier.com/eligibility/enroll.html ^ you can see if you or any of the above mentioned people have been compromised using this tool.

Yeah, at best, that tool from Equifax is unreliable. People have put in fake users and SSN and still it's told them they were affected. At worst, it's just another way to get customers to sign up for a new service.

Re: Equihax

#58

Post by mattmanser »

secstate wrote: post #44
13of40 wrote: post #24

Earlier quoted context omitted.

Not saying it would be great in the short term, but I wonder how it would play out if the entire database was made widely available. It seems like it would be a lot harder to enforce a debt if the borrower was originally identified based on "secrets" that were well known to be public at the time. Maybe then they would come up with a better authentication scheme than "what color was your first car?"

It would be an awful lot like the end of Fight Club. Destroy credit records, or reduce them to meaningless, either way the economy would collapse. People can complain all they want about credit, but the reality is that it exists as a financial service because loaning things with interest is probably older than agriculture in human society. We've just gotten very good at risk assessment, and this going public would ru…

How have we got very good at assessing risk?

So far, I have had three phones signed up in my name (essentially stolen from the suppliers), can't easily get a mortgage because I own my own company, somehow making me riskier than people who earn half my income, and in the past had my credit card limit extended to £10,000 without asking when I was almost broke.

To me that doesn't sound like they're good at assessing risk at all, they're just blindly following extremely simple algos instead of knowing their customers.

The records wouldn't be rendered meaningless any way, the fundamental of a credit report is how much debt you already have and if you ever miss payments or have judgements against you. Then a lender compares that to your income.

Re: Equihax

#59

Post by simik »

Instructions for private buy dosn't make sense. Transaction id is public, so anyone can write them and claim a transaction is theirs.

Re: Equihax

#60

Post by elif »

hamburglar1 wrote: post #49

This looks like B.S. to me. - Who would store date of birth as a string? - If we are stringifying dob why is address still seperated? - Why are the credit report reasource Ids in the thousands not 1M +? - Why is the file size null but the file is listed with it's mimeType? I know equifuckingsucks at security but this is a setup that would actually just be difficult to interact with from a data stand point

This is a JSON representation. Probably not even the storage format. But even if it were, in javascript, new Date("MM/DD/YYYY") parses correctly.

I don't think it's as difficult as you are imagining.

It also doesn't need any formatting in order to be displayed, which is likely it's only real use.

Post reply on HN