Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Myequifax.com Bypasses Credit Freeze Pin

krebsonsecurity.com

Post reply on HN
Print view View original

41–50 of 206 posts

Re: Myequifax.com Bypasses Credit Freeze Pin

#41

Post by floatingatoll »

css wrote: post #16
arcticbull wrote: post #12

Earlier quoted context omitted.

You’re exactly right. It’s the same reason we’re required to sign checks then the bank promptly ignores the signatures. It’s cheaper to handle the fraud than check the signatures, but it makes us feel good to do it anyways.

> the bank promptly ignores the signatures You're technically supposed to sign and endorse the back of every check you electronically deposit; I have never done this since my bank offered mobile deposit and have never had a check rejected. It honestly just makes me sad.

They’re upgrading this to require you to write “mobile deposit for XYZ bank” as well, so that you can’t double-deposit without getting caught early on.

Re: Myequifax.com Bypasses Credit Freeze Pin

#42

Post by human »

shawnz wrote: post #8
mumphster wrote: post #7

Earlier quoted context omitted.

Ok and...? Seems like a valid line of conversation to me.

Except it doesn't address the problem at all. What happens when another negligent credit bureau pops up to replace it?

We should really work on making personal data transactions illegal. I can’t think of a single company that I would be happy to hear that they sold my data to third-party. These companies provide no additonal benefits.

Equifax is the worst. You can call them and ask to buy lists of names, addresses and phone numbers of people matching certain financial criterias. Facebook would look dull in comparison if people knew the extent of the Equifax abuse of privacy.

Re: Myequifax.com Bypasses Credit Freeze Pin

#43

Post by athenot »

davchana wrote: post #34
SketchySeaBeast wrote: post #18

Earlier quoted context omitted.

I wish - a few years ago I was trying to pay for rent with a cheque and it bounced. I ended up sending another cheque, having that one get rejected, go into the bank and give them a new signature sample, and then have the next cheque be rejected as well due to the signature. Apparently my bank checks cheques.

Yes, Indian Banks too check Signatures on anything submitted to them. I once had to deposit cash in my own account but in different city in India. It was free if I deposited it, but fees for anybody third party. Cashier told me my signature doesn’t match with whats on file and thus either I need to re-sign or need to pay fees. Here in US I have seen policies in Stores saying we accept check, but we will onetime use t…

> I am so confused if by merely giving someone a cheque they are able to “pull” money from just two numbers, and can do it for any amount & any number of times.

That is exactly how checks work. It's optimized for happy-path, with a big mess of a process to handle fraud. The cash equivalent would be to carry a bucket with all your money and when you pay, you present your bucket so that the shop can pull out the amount you and them agreed on.

Re: Myequifax.com Bypasses Credit Freeze Pin

#44

Post by jdmichal »

Someone1234 wrote: post #28
fhinson wrote: post #15

> SSN and DOB data is widely available for sale in the cybercrime underground on almost all U.S. citizens. This has been the reality for years, and was so well before Equifax announced its big 2017 breach. Again, I find that this only reinforces the fact that SSNs are not a useful identification system because there's nothing secure about them. Can someone explain where attackers obtain SSN/DOB data with such a wides…

The US government should replace SSNs. SSNs were never meant to be used this way. Any good replacement should start with a set of APIs specifically targeting financial institutions/credit. Give the consumer a random, easily rotatable, numeric key (e.g. "14830-29928-8921-29"). The key + API can return a unique ID, but a unique ID cannot return its corresponding key (i.e. single directional flow). The unique ID never c…

Aren't you basically just describing a more complex, weaker form of RSA SecurID hard tokens or Authenticator-app soft tokens? With a centralized API for validating a generated key vs identification details?

EDIT: Thinking about this more, it seems like a much harder problem than this quipped solution gives credit for. The agency wishing to validate a generated key would need to have enough identifying information to isolate a single row in the centralized database to validate the token. Because we don't want every token assigned to John Smith to validate every John Smith. So now this centralized database needs to have something that's unique to every single row... Or, in other words, the same problem as SSNs have to start with.

Re: Myequifax.com Bypasses Credit Freeze Pin

#45

Post by arcticbull »

davchana wrote: post #34
SketchySeaBeast wrote: post #18

Earlier quoted context omitted.

I wish - a few years ago I was trying to pay for rent with a cheque and it bounced. I ended up sending another cheque, having that one get rejected, go into the bank and give them a new signature sample, and then have the next cheque be rejected as well due to the signature. Apparently my bank checks cheques.

Yes, Indian Banks too check Signatures on anything submitted to them. I once had to deposit cash in my own account but in different city in India. It was free if I deposited it, but fees for anybody third party. Cashier told me my signature doesn’t match with whats on file and thus either I need to re-sign or need to pay fees. Here in US I have seen policies in Stores saying we accept check, but we will onetime use t…

The "one-time use the account and routing number on the check to pull money" is utilizing the data from the check to perform an ACH pull. There's a specific process called an EFT [1] where merchants can perform an ACH transaction in lieu of a received paper check.

[1] https://www.occ.gov/topics/consumer-protection/depository-se...

Re: Myequifax.com Bypasses Credit Freeze Pin

#46

Post by vharuck »

css wrote: post #16
arcticbull wrote: post #12

Earlier quoted context omitted.

You’re exactly right. It’s the same reason we’re required to sign checks then the bank promptly ignores the signatures. It’s cheaper to handle the fraud than check the signatures, but it makes us feel good to do it anyways.

> the bank promptly ignores the signatures You're technically supposed to sign and endorse the back of every check you electronically deposit; I have never done this since my bank offered mobile deposit and have never had a check rejected. It honestly just makes me sad.

My bank upgraded their branch ATMs to accept multiple checks at the same time for deposits. What surprised me was the displayed instructions said one did not need to sign the backs.

Re: Myequifax.com Bypasses Credit Freeze Pin

#47

Post by rlucas »

techsupporter wrote: post #37
css wrote: post #36

Earlier quoted context omitted.

It's Discover, not Ally.

Oh, they use the exact same font. Fair enough; I'll add a disclaimer at the top but Ally did the same thing to me (same zodiac question).

The bank itself is probably not doing the KBA; they're buying and integrating a KBA dialogue solution from one of the vendors. So might be the same software / font / question bank at work.

Re: Myequifax.com Bypasses Credit Freeze Pin

#48

Post by Someone1234 »

jdmichal wrote: post #44
Someone1234 wrote: post #28

Earlier quoted context omitted.

The US government should replace SSNs. SSNs were never meant to be used this way. Any good replacement should start with a set of APIs specifically targeting financial institutions/credit. Give the consumer a random, easily rotatable, numeric key (e.g. "14830-29928-8921-29"). The key + API can return a unique ID, but a unique ID cannot return its corresponding key (i.e. single directional flow). The unique ID never c…

Aren't you basically just describing a more complex, weaker form of RSA SecurID hard tokens or Authenticator-app soft tokens? With a centralized API for validating a generated key vs identification details? EDIT: Thinking about this more, it seems like a much harder problem than this quipped solution gives credit for. The agency wishing to validate a generated key would need to have enough identifying information to…

No, and the fact you think it is anything like SecureID means I did a poor job explaining it.

It replaces cardboard cards with a SSN on them, with a cardboard card with a longer randomly generated key on it. There's no electronics involved from the consumer's perspective at all.

The key is provided on your e.g. loan application. The financial institution sends that key to the government via API, and receives back a Unique ID assigned to you as an individual that never changes. The financial institution should then dispose of the key you provided them.

The Unique ID is essentially used like an SSN; but the major differences are:

- The consumer never provides it directly

- The consumer's version of it (key) can be rotated freely

- If the Unique ID itself leaks it has no value, since the API Cycle (i.e. Key -> Unique ID) is part of the system that financial institutions would use, supplying the Unique ID would just throw an error (since it isn't a valid key).

So it completely different from SecurID, and is more akin to SSNs with most of the core issues resolved. Issuing cardboard cards with numbers on them isn't inherently complex, and is what we're already doing.

The most challenging part is getting financial institutions to implement the API calls and update application forms. You'd also have to remain vigilant that they aren't storing the Keys themselves longer than absolutely necessary.

Re: Myequifax.com Bypasses Credit Freeze Pin

#49

Post by suresk »

arcticbull wrote: post #12
hsk0823 wrote: post #9

Earlier quoted context omitted.

No one thinks this is actually secure, it's security theater. The thing is, the cost of identity theft of consumers to credit reporting companies is less than the cost to actually adopt secure methods to judge one's credit.

You’re exactly right. It’s the same reason we’re required to sign checks then the bank promptly ignores the signatures. It’s cheaper to handle the fraud than check the signatures, but it makes us feel good to do it anyways.

I know some banks actually do check them. Last year, my wife paid a contractor with a check from Ally, and the check bounced because the signatures were not close enough.

Re: Myequifax.com Bypasses Credit Freeze Pin

#50

Post by pwg »

sevensor wrote: post #22
fhinson wrote: post #15

> SSN and DOB data is widely available for sale in the cybercrime underground on almost all U.S. citizens. This has been the reality for years, and was so well before Equifax announced its big 2017 breach. Again, I find that this only reinforces the fact that SSNs are not a useful identification system because there's nothing secure about them. Can someone explain where attackers obtain SSN/DOB data with such a wides…

So if everybody knows your SSN/DOB, I'd say that makes a very good identity system in the sense that we can all unambiguously refer to the same person. It's just not any use as a means of authenticating that you are the person who has that identity.

> So if everybody knows your SSN/DOB, I'd say that makes a very good identity system in the sense that we can all unambiguously refer to the same person.

If that was all it (SSN) was used for, a "unique-id", it would work ok for that usage.

The problem is that far too many companies also make use of SSN as a "secret only you know" to authenticate that you are in fact the individual identified by the SSN. I.e, your "login name" is identical to your "password". It is this miss-use that leads to the problems around SSNs.

Post reply on HN