Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equihax

krypt3ia.wordpress.com

Post reply on HN
Print view View original

111–120 of 209 posts

Re: Equihax

#111

Post by astura »

gipp wrote: post #96
creatonez wrote: post #89

Earlier quoted context omitted.

> Individuals are banned from using computers when prosecuted Who is banned from using computers? You mean, in prison?

Kevin Mitnick, famously, ages ago. Not sure if anyone else has ever had that.

Samy Kamkar too for writing the Samy MySpace worm.

From Wiki:

>Samy Kamkar, the author of the worm, was raided by the United States Secret Service and Electronic Crimes Task Force in 2006 for releasing the worm.[4] He entered a plea agreement on January 31, 2007 to a felony charge.[5] The action resulted in Kamkar being sentenced to three years probation with only one computer and no use of internet,[6] 90 days community service, and $15,000-$20,000 USD in restitution, as directly reported by Samy Kamkar himself on "Greatest Moments in Hacking History" by Vice Media's video website, Motherboard.

Re: Equihax

#112

Post by mkempe »

odammit wrote: post #75
jerf wrote: post #53

Earlier quoted context omitted.

"Who would store date of birth as a string?" Enterprise. "If we are stringifying dob why is address still seperated?" Enterprise. "Why are the credit report reasource Ids in the thousands not 1M +?" Enterprise. "Why is the file size null but the file is listed with it's mimeType?" Enterprise. Be grateful you are in a position to be horrified. I'm currently fighting my way through a system that is not currently "Enter…

That's exactly what I thought. I consulted on an enterprise project once with EVERY column in EVERY table set to string because the engineers didn't want to think about datatypes. All the queries used wild cards or just pulled back a ton of data and did the filtering and sorting in the application code. That job sucked.

I consulted on a large healthcare data project with similar problems. Even "primary" keys were strings. Most tables had no indexes. (The developers routinely argued that they needed new servers with more RAM because they couldn't run multiple database queries at the same time. They already had 64 GB RAM.)

Re: Equihax

#113

Post by SilasX »

CommieBobDole wrote: post #104
astura wrote: post #37

EDIT: see philipodonnell's reply to this post for an alternative explanation. I may have jumped the gun. As far as I know credit scores are not part of credit reports as they do not show up when you request your credit report. If they were storing "credit score" as part of your credit report but withholding that information when you request a copy that would seem to violate the Fair Credit Reporting Act. It wouldn't…

I can't speak for the other points you raise, but I note that it says "Credit Score" rather than "FICO score" - all of the credit reporting agencies (and some third parties) have their own "Credit Score" product that they sell or otherwise provide - it's almost a scam in itself, in that they strongly suggest they are selling you a FICO score but instead give you their own internally-generated, presumably royalty-free…

Yep! The difference between the two was a particular source of frustration for me.

Back when I was relatively new on the (full time) job market, I pulled my reports from annualcreditreport.com and it would tell me that my "credit score" is 720-740, and no negative marks.

However, I also had never taken out a loan before. So whenever I tried to do use that pristine credit (e.g. for a mortgage, credit card, or apartment), I had "no credit history" which appeared to the credit as toxic and subprime.

(Relatedly, when I got my first part time job and tried to buy a PS console with a check, Best Buy said it violated their "risk parameters" and wouldn't take it, though Walmart would.)

Re: Equihax

#114

Post by astura »

jlgaddis wrote: post #81
vadym909 wrote: post #63

Earlier quoted context omitted.

If its only the score you want, cant you get that from creditkarma for free?

You can get a "FAKO" score from CreditKarma.

FYI, "FAKO" is VantageScore 3.0. It's colloquially called FAKO because 90% of lenders use some variation of FICO instead.

Re: Equihax

#115

Post by ringaroundthetx »

hamburglar1 wrote: post #49

This looks like B.S. to me. - Who would store date of birth as a string? - If we are stringifying dob why is address still seperated? - Why are the credit report reasource Ids in the thousands not 1M +? - Why is the file size null but the file is listed with it's mimeType? I know equifuckingsucks at security but this is a setup that would actually just be difficult to interact with from a data stand point

the server password was admin/admin , do you really think your best practices apply here?

Re: Equihax

#116

Post by astura »

hedora wrote: post #80
ryeguy_24 wrote: post #47

Earlier quoted context omitted.

I wonder as well. I think we all forget how important credit reports are in giving banks comfort to lend (not that this is the only way to do it, but it seems that this is the current way). If people can default on a uncollateralized loan with no ramifications, no bank would lend and the credit engine would shut down.

People also forget about of rule of law. I defaulted on my loan? Sue me. Want to give me a loan? Search for me in public court records.

Courts don't report when you are habitually 30+ days late on your loan payments but still pay them off. Courts also don't report how much debt you have. It would also not have any positive information about you, like how many loans you've taken out but paid back successfully and on time.

Re: Equihax

#117

Post by sixothree »

Ajedi32 wrote: post #42

I actually kinda hope all the data is made public, as that would (at least hopefully) force people to stop treating knowledge of someone's SSN as valid proof of identity, and lead to a better situation overall.

What's your SSN and credit score? Just curious.

Re: Equihax

#118

Post by criley2 »

ballenf wrote: post #102
kmix27 wrote: post #66

Earlier quoted context omitted.

I really hope that's the outcome here. I also think this should pave the way for real legal consequences for moronic data security. Individuals are banned from using computers when prosecuted, what about "no internet for companies who've proven they can't use it responsibly"

> real legal consequences for moronic data security This could go really wrong if we let non-tech savvy regulators dictate tech stacks, specific hashing/encryption tools. Could work well, but just has a lot of potential to go very wrong. Given that risk, as much as I don't want to live in an overly litigious society, letting the risk of lawsuits drive good security may be preferable to putting security in the hands o…

"This could go really wrong if we let non-tech savvy regulators dictate tech stacks, specific hashing/encryption tools. Could work well, but just has a lot of potential to go very wrong."

Engineers, capitalism, private business have utterly, completely, fully and in totality failed.

This is not a little failure. Not a medium one. Not a large one.

This is a foundational, cataclysmic failure of the most epic proportion.

I think the time for voluntary private action has passed.

If developers, their managers, their stakeholders, and their shareholders took security and privacy remotely seriously, we would not be here.

We are here.

It is time to admit the full and complete failure of private software companies to protect data and privacy, and time for government to create a criminal schedule for management and developers who perpetuate criminal negligence.

I believe only 2 things will solve this:

1) Massive financial loss for shareholders -- they speak 1 language, US Dollars. If we say a US Citizens data is worth $100,000, then the fines would be large enough to literally destroy any firm who dared play loose with security. If there is no existential risk, there is zero motivation for compliancy. Only existential risk matters to shareholders. The rest is Cost of Doing Business.

2) Criminal liability for management and developers of products which violate security and privacy due to criminal negligence

Without this, you can all but guarantee that your full identity is kept in plain-text and has already been stolen.

Re: Equihax

#119

Post by pbadenski »

smsm42 wrote: post #103
smsm42 wrote: post #100

Earlier quoted context omitted.

If it's a service request log, why service would have field requestId and then set it to null? Of course, you can expect anything from people that have admin/admin security on their employee portal, but looks weird. Also, street data have no field for apartment number - does nobody live in multi-tenant buildings? Of course, there may be optional field for this, but given how many null fields there are, it doesn't loo…

Also, quick search shows that SSNs of Trump, Kardashian and Gates has been published before. Which means this sample contains only the information that is in the public sources already, or is meaningless (like IDs). Thus, at least the JSON dump thing proves exactly nothing. Of course, if they published a previously unpublished SSN, we'd have hard time verifying it too, so not sure what could be a good proof here...

Presumably if someone wanted to sell this data for big bucks they would have found a way to provide a sufficient and satisfying proof.
Post reply on HN