Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Myequifax.com Bypasses Credit Freeze Pin

krebsonsecurity.com

Post reply on HN
Print view View original

81–90 of 206 posts

Re: Myequifax.com Bypasses Credit Freeze Pin

#81

Post by r00fus »

erichurkman wrote: post #14
deanmoriarty wrote: post #2

I've literally noticed this myself last month when I went to temporarily lift my freeze to apply for a new credit card. I never got asked for the PIN, which I diligently save and securely store. I remember I was explicitly asked for it just a year ago (last time I had to do the same to open another card). I felt like an idiot.

They don't want to make it hard to use your credit report. The worse job they do with security theater the more money they make, and the easier it is for you to obtain credit products. If they actually applied any reasonable security, the friction of getting new credit would reduce new customer acquisition. For my view, that's ideal: people should put real, explicit thought into obtaining new credit or debt products.…

> They don't want to make it hard to use your credit report. The worse job they do with security theater the more money they make, and the easier it is for you to obtain credit products.

This is why we need to legislate these companies now, and re-incentivize them to do the right thing.

Re: Myequifax.com Bypasses Credit Freeze Pin

#82

Post by SketchySeaBeast »

rlucas wrote: post #52
athenot wrote: post #43

Earlier quoted context omitted.

> I am so confused if by merely giving someone a cheque they are able to “pull” money from just two numbers, and can do it for any amount & any number of times. That is exactly how checks work. It's optimized for happy-path, with a big mess of a process to handle fraud. The cash equivalent would be to carry a bucket with all your money and when you pay, you present your bucket so that the shop can pull out the amount…

"Optimized for happy-path" is true, but it also reveals something pretty neat about the American financial / business climate. "Default trust" actually works in our economy. And because of that, friction can be low and things Just Work. Default trust / happy-path optimization in turn works because of the backstop of a strong legal system, fairly clear precedent, and reasonably well defined property rights. Think: UCC…

> "Default trust" actually works in our economy. And because of that, friction can be low and things Just Work.

Does it though? I think there's a reason we've stopped accepting cheques - cheques were the best "easy" way to transfer relatively large sums of money at once, now that we're past that and have more secure credit and debit cards cheques are becoming banned. I don't think it was optimized for "happy path" per say, but just for convenience and was the only technology we could manage at the time.

Re: Myequifax.com Bypasses Credit Freeze Pin

#83

Post by BartBoch »

nkrisc wrote: post #61
css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

Zodiac sign? Seriously? I don't know what mine is because that is not a belief system/religion I subscribe to so I had to Google it. Turns out my birthdate must be on the border because different sources have it as a different sign. They might as well ask what color my aura is.

Sounds... not right. What is the date?

Re: Myequifax.com Bypasses Credit Freeze Pin

#84

Post by zelon88 »

css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

They're not competent. That is the problem.

Re: Myequifax.com Bypasses Credit Freeze Pin

#85

Post by jdmichal »

Someone1234 wrote: post #48
jdmichal wrote: post #44

Earlier quoted context omitted.

Aren't you basically just describing a more complex, weaker form of RSA SecurID hard tokens or Authenticator-app soft tokens? With a centralized API for validating a generated key vs identification details? EDIT: Thinking about this more, it seems like a much harder problem than this quipped solution gives credit for. The agency wishing to validate a generated key would need to have enough identifying information to…

No, and the fact you think it is anything like SecureID means I did a poor job explaining it. It replaces cardboard cards with a SSN on them, with a cardboard card with a longer randomly generated key on it. There's no electronics involved from the consumer's perspective at all. The key is provided on your e.g. loan application. The financial institution sends that key to the government via API, and receives back a U…

I'm with you, except for the part where we trust the middle man to please-pretty-please-pinky-swear delete the key. That, to me, makes it weaker than a token approach. With the token approach, the intermediate value has such a short useful lifetime that it's practically not a secret. The real secret -- the value required to duplicate the token -- remains with only the client and the centralized store.

Re: Myequifax.com Bypasses Credit Freeze Pin

#86

Post by wyldfire »

tasty_freeze wrote: post #74
nkrisc wrote: post #61

Earlier quoted context omitted.

Zodiac sign? Seriously? I don't know what mine is because that is not a belief system/religion I subscribe to so I had to Google it. Turns out my birthdate must be on the border because different sources have it as a different sign. They might as well ask what color my aura is.

Lie about which is your sign. If the bad guy knows your birthday, they will guess the wrong sign.

This is one of those questionnaires that is generated based on your credit report and other items related to you identity. So it's extrapolated from your birthdate and probably makes it ever-so-mildly more difficult for robots to get it right than it would if it just asked for your birthdate.

Re: Myequifax.com Bypasses Credit Freeze Pin

#87

Post by reaperducer »

css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

United Airlines asked me to fill in a bunch of crazy password questions a few weeks ago.

Things like "What's your favorite flavor of ice cream?" Well, I dunno. It depends on my mood.

Or "What if your favorite vacation destination?" Another bad question because my favorite today may not be my favorite when I get back from the next place.

Unfortunately they were all mandatory — there wasn't an option to pick only the sane ones; all ten had to be answered.

Most of them felt more like marketing trying to build a profile on me rather than IT trying to keep my data secure.

Re: Myequifax.com Bypasses Credit Freeze Pin

#88

Post by nothrabannosir »

thetrumanshow wrote: post #77
tasty_freeze wrote: post #74

Earlier quoted context omitted.

Lie about which is your sign. If the bad guy knows your birthday, they will guess the wrong sign.

And now you have to keep all of your lies straight.

Absolutely; use a password manager. This is the least bad way to go for these types of "security questions": give a plausible, but wrong, answer.

Correct is too easy to guess.

Obviously wrong will be recognised by the customer service representative, who is a kind person, and will help you out by just disabling the question (anecdotes galore for this, to the point we can call it data).

Lie, in a believable way. Put the answer in a password manager. Open your password manager up before calling any CS rep. Be a star in the security theatre. :)

Re: Myequifax.com Bypasses Credit Freeze Pin

#89

Post by astura »

tasty_freeze wrote: post #74
nkrisc wrote: post #61

Earlier quoted context omitted.

Zodiac sign? Seriously? I don't know what mine is because that is not a belief system/religion I subscribe to so I had to Google it. Turns out my birthdate must be on the border because different sources have it as a different sign. They might as well ask what color my aura is.

Lie about which is your sign. If the bad guy knows your birthday, they will guess the wrong sign.

They already know the answer from your credit report and other databases... If you answer incorrectly then you get denied opening a bank account online and you'd have to jump through extra hoops, either going to a branch or mailing documents.

Re: Myequifax.com Bypasses Credit Freeze Pin

#90

Post by craftyguy »

ratling wrote: post #70
dev1n wrote: post #4

Can we just shut down equifax already?

I will never unfreeze Equifax, regardless of what I do with the other credit agencies. I can't prevent them from collecting my information but I can prevent them from profiting off it.

Why can't they profit from the troves of info they have about you, and will continue to collect about you, if your 'account' is 'frozen'?
Post reply on HN