Note the new edit on the blog post: They silently corrected the sample data for Bill Gates, changing his state from WI to WA. Major red flag; if it was wrong in the original data just keep it that way and release a few more samples for verification.
Equihax
151–160 of 209 posts
Re: Equihax
#152This looks like B.S. to me. - Who would store date of birth as a string? - If we are stringifying dob why is address still seperated? - Why are the credit report reasource Ids in the thousands not 1M +? - Why is the file size null but the file is listed with it's mimeType? I know equifuckingsucks at security but this is a setup that would actually just be difficult to interact with from a data stand point
"Who would store date of birth as a string?" Enterprise. "If we are stringifying dob why is address still seperated?" Enterprise. "Why are the credit report reasource Ids in the thousands not 1M +?" Enterprise. "Why is the file size null but the file is listed with it's mimeType?" Enterprise. Be grateful you are in a position to be horrified. I'm currently fighting my way through a system that is not currently "Enter…
So a different question: why would enterprise store it in a JSON? :)
Re: Equihax
#153Earlier quoted context omitted.
"This could go really wrong if we let non-tech savvy regulators dictate tech stacks, specific hashing/encryption tools. Could work well, but just has a lot of potential to go very wrong." Engineers, capitalism, private business have utterly, completely, fully and in totality failed. This is not a little failure. Not a medium one. Not a large one. This is a foundational, cataclysmic failure of the most epic proportion…
I agree that we should work to determine if there was criminal negligence and prosecute to the highest degree possible, but I find it laughable that you talk about how engineers, capitalism, and private business have completely failed. The DNC was hacked. The FBI and CIA have had their web sites hacked. The OPM had >22 million people's personal info stolen by Chinese hackers. The NSA itself has had major incidents wh…
Indeed, I have had my personal data compromised more by government agencies than private (at least, as far as I've been officially/personally notified).
Re: Equihax
#154Earlier quoted context omitted.
FYI, "FAKO" is VantageScore 3.0. It's colloquially called FAKO because 90% of lenders use some variation of FICO instead.
Regardless if it's FAKO or FICO score that you are looking at, they are calculated on the same credit history in your credit report (as far as I know). So, even if the scores are calculated in different ways it's reasonable to expect a high VantageScore 3.0 score will also show as a high FICO score too, even if the numbers aren't exact. Does anyone know the specific differences in how these two scores are calculated?
I believe the FICO algorithm is not public, so there would be no way for us to know exactly how they calculate our scores.
We only know the factors that go in to the algorithm, and the score that comes out. Basically, a black box.
Re: Equihax
#155Earlier quoted context omitted.
"This could go really wrong if we let non-tech savvy regulators dictate tech stacks, specific hashing/encryption tools. Could work well, but just has a lot of potential to go very wrong." Engineers, capitalism, private business have utterly, completely, fully and in totality failed. This is not a little failure. Not a medium one. Not a large one. This is a foundational, cataclysmic failure of the most epic proportion…
Problem is, on what basis is a person's "private data" worth $100,000, or will the exposure thereof cause damages of $100,000? The average person's entire net worth is only a fraction of that. There is such a thing as punitive damages but in most civil cases a company or individual is not going to be held liable for more than actual damages.
> The average person's entire net worth is only a fraction of that
Banks are usually happy to provide you with a credit line many times your net worth if you have a reasonable credit score.
Re: Equihax
#156Earlier quoted context omitted.
I consulted on a large healthcare data project with similar problems. Even "primary" keys were strings. Most tables had no indexes. (The developers routinely argued that they needed new servers with more RAM because they couldn't run multiple database queries at the same time. They already had 64 GB RAM.)
Yes! It had a lot of index-less tables. The you put an index on something and everyone treats you like a magician after you convince them the additional write is worth it.
Or one of the developers deletes the index you've just added... because it uses too much disk space.
Re: Equihax
#157Cool, this is good news as it means I might actually be able to find out my credit score. I recently sent in an application to Equifax to get my credit score along with all the security documents, proof of address, passport, drivers license, registered mail etc. and they rejected my application because I didn't provide a hydro bill. Unfortunately, I live in an apartment and I don't pay hydro, so I sent in a copy of t…
0.2 BTC is currently >600 USD. There's cheaper way to get a credit score.
Well yeah, but you can get your credit score and that of thousands of other people!
Re: Equihax
#158Cool, this is good news as it means I might actually be able to find out my credit score. I recently sent in an application to Equifax to get my credit score along with all the security documents, proof of address, passport, drivers license, registered mail etc. and they rejected my application because I didn't provide a hydro bill. Unfortunately, I live in an apartment and I don't pay hydro, so I sent in a copy of t…
CreditKarma does it for free, if you're in the US (no idea about outside the US). So does mint.com. So do many other credit card companies. I now have 6 or 7 credit scores, all curiously different (though within certain range of each other).
Because there are lots of different scoring algorithms. There are several different ones from FICO themselves (so there is no single one FICO score), and they have several competitors that have different algorithms. Even when using the same algorithm, you will have a different score for each credit report.
Re: Equihax
#159Earlier quoted context omitted.
He would have been around 17. That's reasonable, given that many/most didn't get an SSN back then until they started working.
The SSA sends you one at birth (now?).
If someone applies for it on the baby's behalf. It's still an optional program as far as I know.
If you don't have a SSN, you'll need an ITIN for taxes.
(ITIN - Individual Taxpayer Identification Number)
Re: Equihax
#160Earlier quoted context omitted.
I really hope that's the outcome here. I also think this should pave the way for real legal consequences for moronic data security. Individuals are banned from using computers when prosecuted, what about "no internet for companies who've proven they can't use it responsibly"
> real legal consequences for moronic data security This could go really wrong if we let non-tech savvy regulators dictate tech stacks, specific hashing/encryption tools. Could work well, but just has a lot of potential to go very wrong. Given that risk, as much as I don't want to live in an overly litigious society, letting the risk of lawsuits drive good security may be preferable to putting security in the hands o…
What is "really wrong" in your definition? I would say this breach is about as "really wrong" as you can get.
The threat of lawsuits already existed before this hack. Look at the multi-million payout Target paid after their credit card breach (and they say it cost their company ~200mil). So that was STILL NOT ENOUGH to change Equifax's behavior.
Improved government oversight/regulation of this industry is more than overdue. This is a national security issue and we should not have our data (and the means of protecting it) held hostage by private companies.