Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equihax

krypt3ia.wordpress.com

Post reply on HN
Print view View original

101–110 of 209 posts

Re: Equihax

#101

Post by howard941 »

secstate wrote: post #44
13of40 wrote: post #24

Earlier quoted context omitted.

Not saying it would be great in the short term, but I wonder how it would play out if the entire database was made widely available. It seems like it would be a lot harder to enforce a debt if the borrower was originally identified based on "secrets" that were well known to be public at the time. Maybe then they would come up with a better authentication scheme than "what color was your first car?"

It would be an awful lot like the end of Fight Club. Destroy credit records, or reduce them to meaningless, either way the economy would collapse. People can complain all they want about credit, but the reality is that it exists as a financial service because loaning things with interest is probably older than agriculture in human society. We've just gotten very good at risk assessment, and this going public would ru…

> It would be an awful lot like the end of Fight Club

The film ended that way. The novel had a different, more Palahniuk-ish ending. Spoil it for yourself if you must at https://en.wikipedia.org/wiki/Fight_Club_(novel)

Re: Equihax

#102

Post by ballenf »

kmix27 wrote: post #66
Ajedi32 wrote: post #42

I actually kinda hope all the data is made public, as that would (at least hopefully) force people to stop treating knowledge of someone's SSN as valid proof of identity, and lead to a better situation overall.

I really hope that's the outcome here. I also think this should pave the way for real legal consequences for moronic data security. Individuals are banned from using computers when prosecuted, what about "no internet for companies who've proven they can't use it responsibly"

> real legal consequences for moronic data security

This could go really wrong if we let non-tech savvy regulators dictate tech stacks, specific hashing/encryption tools. Could work well, but just has a lot of potential to go very wrong.

Given that risk, as much as I don't want to live in an overly litigious society, letting the risk of lawsuits drive good security may be preferable to putting security in the hands of a few faceless government officials who themselves face no repercussions for getting the regs wrong.

Re: Equihax

#103

Post by smsm42 »

smsm42 wrote: post #100
philipodonnell wrote: post #73

Earlier quoted context omitted.

You're assuming this is a database dump. It looks more like logs from the service that creates PDF versions of reports for download. That would have a more simplistic data structure that might look like this.

If it's a service request log, why service would have field requestId and then set it to null? Of course, you can expect anything from people that have admin/admin security on their employee portal, but looks weird. Also, street data have no field for apartment number - does nobody live in multi-tenant buildings? Of course, there may be optional field for this, but given how many null fields there are, it doesn't loo…

Also, quick search shows that SSNs of Trump, Kardashian and Gates has been published before. Which means this sample contains only the information that is in the public sources already, or is meaningless (like IDs). Thus, at least the JSON dump thing proves exactly nothing. Of course, if they published a previously unpublished SSN, we'd have hard time verifying it too, so not sure what could be a good proof here...

Re: Equihax

#104

Post by CommieBobDole »

astura wrote: post #37

EDIT: see philipodonnell's reply to this post for an alternative explanation. I may have jumped the gun. As far as I know credit scores are not part of credit reports as they do not show up when you request your credit report. If they were storing "credit score" as part of your credit report but withholding that information when you request a copy that would seem to violate the Fair Credit Reporting Act. It wouldn't…

I can't speak for the other points you raise, but I note that it says "Credit Score" rather than "FICO score" - all of the credit reporting agencies (and some third parties) have their own "Credit Score" product that they sell or otherwise provide - it's almost a scam in itself, in that they strongly suggest they are selling you a FICO score but instead give you their own internally-generated, presumably royalty-free number.

Since there's no cost associated with this, they may well generate one for everyone and store it with their data.

Re: Equihax

#105

Post by sova »

fractal618 wrote: post #38
robertelder wrote: post #28

Cool, this is good news as it means I might actually be able to find out my credit score. I recently sent in an application to Equifax to get my credit score along with all the security documents, proof of address, passport, drivers license, registered mail etc. and they rejected my application because I didn't provide a hydro bill. Unfortunately, I live in an apartment and I don't pay hydro, so I sent in a copy of t…

> Cool, this is good news as it means I might actually be able to find out my credit score. Hahaha

the brighter side is the side of genius

Re: Equihax

#106

Post by sova »

Karunamon wrote: post #64
samstave wrote: post #25

Earlier quoted context omitted.

They are insidious, not silly. The reason is that they mean little for those with tons of money - but they mean everything for the average person with limited money. They literally keep the poor poor.

The concept of credit scores has a reason to exist, it's just our implementation is broke a million times over. There's nothing wrong with a business loaning you money having the knowledge aforehand that you don't pay your obligations on time.

So it is! Yet, the ideal score is not one that reflects ability to repay, but ability to say conveniently under the thumb of a credit card company.

Re: Equihax

#107

Post by sova »

artursapek wrote: post #35

Posting our president's SSN on your blog after obtaining it from a darknet page... priceless.

I applaud your concise cleverness, even if this is not the time nor the place!

Re: Equihax

#108

Post by skookum »

hedora wrote: post #87
msumpter wrote: post #9

Earlier quoted context omitted.

Dunno why, but just surprised that Kim K's credit score with Equifax is 643. Unrelated, sorry.

That makes sense to me. Having zero debt (and no credit cards) can easily knock your score that low, even if you have a perfect payment record. The whole credit score thing is an extortion game: To the consumer: Want a loan? Buy everything on cash back cards. To vendors: Don't like the fact that we're upping transaction fees? What percentage of your customers use credit cards again? If they actually were worried abou…

It's not the pile of debt that increases the score. It's the history of repaying that debt per its agreed terms that does.

While I'm not a fan of the credit bureau system, I understand the reasoning behind it. It's an efficient way for creditors to get access to the needed information. Lacking that, to allow the bank to evaluate your creditworthiness among other things you'd likely have to provide a list of references of past creditors and then your new potential creditor would have to validate those references individually: verify you had credit with them, verify you adhered to the payment terms, etc.

For better or for worse today instead of an on-demand complete graph we've got a centralized cache. This serves the needs of the financial players better (read: cheaper) while putting the PII of consumers at more risk.

Re: Equihax

#109

Post by marksomnian »

creatonez wrote: post #89
kmix27 wrote: post #66

Earlier quoted context omitted.

I really hope that's the outcome here. I also think this should pave the way for real legal consequences for moronic data security. Individuals are banned from using computers when prosecuted, what about "no internet for companies who've proven they can't use it responsibly"

> Individuals are banned from using computers when prosecuted Who is banned from using computers? You mean, in prison?

Samy. He was banned for a while IIRC
Post reply on HN