Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equihax

krypt3ia.wordpress.com

Post reply on HN
Print view View original

71–80 of 209 posts

Re: Equihax

#71

Post by briankwest »

astura wrote: post #37

EDIT: see philipodonnell's reply to this post for an alternative explanation. I may have jumped the gun. As far as I know credit scores are not part of credit reports as they do not show up when you request your credit report. If they were storing "credit score" as part of your credit report but withholding that information when you request a copy that would seem to violate the Fair Credit Reporting Act. It wouldn't…

while 'pdf' isn't a full mime type, you seem to forget whom we're dealing with here, not the brightest crayon in the box Equifax.

Re: Equihax

#72

Post by philipodonnell »

Maybe the hack occurred on an api reporting server? The examples look like logs of api requests to something that generates PDF versions of credit reports, like an API a bank might use to access credit reports.

When you get your report it goes through a process of "generating" the report which you then download as a PDF. This could be logs from that generation service.

If the hackers got unrestricted access they may have found the API's logs and just copied them along with the PDFs?

Re: Equihax

#73

Post by philipodonnell »

astura wrote: post #37

EDIT: see philipodonnell's reply to this post for an alternative explanation. I may have jumped the gun. As far as I know credit scores are not part of credit reports as they do not show up when you request your credit report. If they were storing "credit score" as part of your credit report but withholding that information when you request a copy that would seem to violate the Fair Credit Reporting Act. It wouldn't…

You're assuming this is a database dump. It looks more like logs from the service that creates PDF versions of reports for download. That would have a more simplistic data structure that might look like this.

Re: Equihax

#74

Post by alunchbox »

koolba wrote: post #55
jerf wrote: post #53

Earlier quoted context omitted.

"Who would store date of birth as a string?" Enterprise. "If we are stringifying dob why is address still seperated?" Enterprise. "Why are the credit report reasource Ids in the thousands not 1M +?" Enterprise. "Why is the file size null but the file is listed with it's mimeType?" Enterprise. Be grateful you are in a position to be horrified. I'm currently fighting my way through a system that is not currently "Enter…

Exactly. The data model, and particular data typing, being terrible is more indicative of it being legit. Not less.

sad truth

Re: Equihax

#75

Post by odammit »

jerf wrote: post #53
hamburglar1 wrote: post #49

This looks like B.S. to me. - Who would store date of birth as a string? - If we are stringifying dob why is address still seperated? - Why are the credit report reasource Ids in the thousands not 1M +? - Why is the file size null but the file is listed with it's mimeType? I know equifuckingsucks at security but this is a setup that would actually just be difficult to interact with from a data stand point

"Who would store date of birth as a string?" Enterprise. "If we are stringifying dob why is address still seperated?" Enterprise. "Why are the credit report reasource Ids in the thousands not 1M +?" Enterprise. "Why is the file size null but the file is listed with it's mimeType?" Enterprise. Be grateful you are in a position to be horrified. I'm currently fighting my way through a system that is not currently "Enter…

That's exactly what I thought.

I consulted on an enterprise project once with EVERY column in EVERY table set to string because the engineers didn't want to think about datatypes.

All the queries used wild cards or just pulled back a ton of data and did the filtering and sorting in the application code.

That job sucked.

Re: Equihax

#76

Post by zwily »

shawabawa3 wrote: post #69
simik wrote: post #59

Instructions for private buy dosn't make sense. Transaction id is public, so anyone can write them and claim a transaction is theirs.

Presumably first person to email gets the private address to buy, so if you're slow you'll have wasted 0.2BTC

They should have had you send a message signed with the source address of the 0.2 to their email.

Re: Equihax

#77

Post by joncrocks »

astura wrote: post #37

EDIT: see philipodonnell's reply to this post for an alternative explanation. I may have jumped the gun. As far as I know credit scores are not part of credit reports as they do not show up when you request your credit report. If they were storing "credit score" as part of your credit report but withholding that information when you request a copy that would seem to violate the Fair Credit Reporting Act. It wouldn't…

Not disagreeing with the rest but:

>And if the credit score algorithm was updated they would have to recalculate the "credit score" field on the entire database! This wouldn't really make sense from a technical perspective.

This obviously depends on your real-time requirements on providing a credit score. If you need to be able to return any credit score in X milliseconds, and you need to be able to do this at certain throughput, and have load that's not distributed across the day, then you might choose to pre-compute data.

There are techniques you could use to ensure you minimise re-computes and you could also pre-compute values into the future and re-calculate them when new/unexpected data came in.

It might not make sense to do this in a general-case, but placing retrieval performance constraints on a system can lead to non-obvious pre-calculation/computation solutions.

Re: Equihax

#78

Post by mrb »

simik wrote: post #59

Instructions for private buy dosn't make sense. Transaction id is public, so anyone can write them and claim a transaction is theirs.

Doing so wouldn't accomplish anything. The second (larger) part of the payment still has to be sent and negotiated over PGP-encrypted email.

Re: Equihax

#79

Post by uniformlyrandom »

paulddraper wrote: post #22

> It claims to be the real EQUIFAX hackers, unlike the last darknet site that was soon taken down by morons. I hadn't heard about this last site. How did morons take it down? Or is that suppose to mean that morons put it up? English...

Both. Morons put it up, got called on it by non-morons, and then took it down.

Re: Equihax

#80

Post by hedora »

ryeguy_24 wrote: post #47
Beltiras wrote: post #30

I wonder if this will introduce instability in credit for consumers. Could this actually have long term ramifications for the US economy?

I wonder as well. I think we all forget how important credit reports are in giving banks comfort to lend (not that this is the only way to do it, but it seems that this is the current way). If people can default on a uncollateralized loan with no ramifications, no bank would lend and the credit engine would shut down.

People also forget about of rule of law. I defaulted on my loan?

Sue me.

Want to give me a loan? Search for me in public court records.

Post reply on HN