Earlier quoted context omitted.
Ok and...? Seems like a valid line of conversation to me.
Except it doesn't address the problem at all. What happens when another negligent credit bureau pops up to replace it?
We shut them down, too.
Myequifax.com Bypasses Credit Freeze Pin
11–20 of 206 posts
Re: Myequifax.com Bypasses Credit Freeze Pin
#12> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…
No one thinks this is actually secure, it's security theater. The thing is, the cost of identity theft of consumers to credit reporting companies is less than the cost to actually adopt secure methods to judge one's credit.
You’re exactly right. It’s the same reason we’re required to sign checks then the bank promptly ignores the signatures. It’s cheaper to handle the fraud than check the signatures, but it makes us feel good to do it anyways.
Re: Myequifax.com Bypasses Credit Freeze Pin
#13Earlier quoted context omitted.
No one thinks this is actually secure, it's security theater. The thing is, the cost of identity theft of consumers to credit reporting companies is less than the cost to actually adopt secure methods to judge one's credit.
You’re exactly right. It’s the same reason we’re required to sign checks then the bank promptly ignores the signatures. It’s cheaper to handle the fraud than check the signatures, but it makes us feel good to do it anyways.
I guess the signatures are there in case someone complains? They can just pull the check and see if the signature is legit. But checking every signature is simply too much work.
Re: Myequifax.com Bypasses Credit Freeze Pin
#14I've literally noticed this myself last month when I went to temporarily lift my freeze to apply for a new credit card. I never got asked for the PIN, which I diligently save and securely store. I remember I was explicitly asked for it just a year ago (last time I had to do the same to open another card). I felt like an idiot.
They don't want to make it hard to use your credit report. The worse job they do with security theater the more money they make, and the easier it is for you to obtain credit products. If they actually applied any reasonable security, the friction of getting new credit would reduce new customer acquisition.
For my view, that's ideal: people should put real, explicit thought into obtaining new credit or debt products. It's too easy right now, especially with products like Credit Karma trivializing getting new credit cards.
Re: Myequifax.com Bypasses Credit Freeze Pin
#15> SSN and DOB data is widely available for sale in the cybercrime underground on almost all U.S. citizens. This has been the reality for years, and was so well before Equifax announced its big 2017 breach.
Again, I find that this only reinforces the fact that SSNs are not a useful identification system because there's nothing secure about them. Can someone explain where attackers obtain SSN/DOB data with such a widespread success rate?
Re: Myequifax.com Bypasses Credit Freeze Pin
#16Earlier quoted context omitted.
No one thinks this is actually secure, it's security theater. The thing is, the cost of identity theft of consumers to credit reporting companies is less than the cost to actually adopt secure methods to judge one's credit.
You’re exactly right. It’s the same reason we’re required to sign checks then the bank promptly ignores the signatures. It’s cheaper to handle the fraud than check the signatures, but it makes us feel good to do it anyways.
> the bank promptly ignores the signatures
You're technically supposed to sign and endorse the back of every check you electronically deposit; I have never done this since my bank offered mobile deposit and have never had a check rejected. It honestly just makes me sad.
Re: Myequifax.com Bypasses Credit Freeze Pin
#17Earlier quoted context omitted.
This is not reddit.
Ok and...? Seems like a valid line of conversation to me.
I agree, but this is not a helpful point form which to start a conversation. It's lazy and below the standards many expect from HN.
A better way to start this conversation (imo) would be to make reference to the many mistakes Equifax has made over the years and ask what is preventing Equifax from facing real consequences, such as being shutdown?
It's the effort that people place into having genuine conversations that keeps me coming back here and not just hanging around Twitter and Reddit. If someone wants to be lazy and still get online validation, there are communities for that and if you want to have a real conversation here, but don't have the time/energy to start it properly then all you have to do is wait a few minutes and someone who does, will.
Re: Myequifax.com Bypasses Credit Freeze Pin
#18Earlier quoted context omitted.
No one thinks this is actually secure, it's security theater. The thing is, the cost of identity theft of consumers to credit reporting companies is less than the cost to actually adopt secure methods to judge one's credit.
You’re exactly right. It’s the same reason we’re required to sign checks then the bank promptly ignores the signatures. It’s cheaper to handle the fraud than check the signatures, but it makes us feel good to do it anyways.
I wish - a few years ago I was trying to pay for rent with a cheque and it bounced. I ended up sending another cheque, having that one get rejected, go into the bank and give them a new signature sample, and then have the next cheque be rejected as well due to the signature.
Apparently my bank checks cheques.
Re: Myequifax.com Bypasses Credit Freeze Pin
#19Earlier quoted context omitted.
You’re exactly right. It’s the same reason we’re required to sign checks then the bank promptly ignores the signatures. It’s cheaper to handle the fraud than check the signatures, but it makes us feel good to do it anyways.
I guess the signatures are there in case someone complains? They can just pull the check and see if the signature is legit. But checking every signature is simply too much work.
It's my understanding (from hearsay) that they use software to look at signatures, and use that data as a fraud signal, among other data.
Re: Myequifax.com Bypasses Credit Freeze Pin
#20> SSN and DOB data is widely available for sale in the cybercrime underground on almost all U.S. citizens. This has been the reality for years, and was so well before Equifax announced its big 2017 breach. Again, I find that this only reinforces the fact that SSNs are not a useful identification system because there's nothing secure about them. Can someone explain where attackers obtain SSN/DOB data with such a wides…
Accurint is a big one. The people selling SSN lookups have big DB collections, but the primary source tends be realtime access to DBs like these.
I'd imagine it's trivial to pretend to be a cop and just purchase access to this stuff, not that it's going to be hard to hack most police departments either.