Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Myequifax.com Bypasses Credit Freeze Pin

krebsonsecurity.com

Post reply on HN
Print view View original

91–100 of 206 posts

Re: Myequifax.com Bypasses Credit Freeze Pin

#91

Post by css »

reaperducer wrote: post #87
css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

United Airlines asked me to fill in a bunch of crazy password questions a few weeks ago. Things like "What's your favorite flavor of ice cream?" Well, I dunno. It depends on my mood. Or "What if your favorite vacation destination?" Another bad question because my favorite today may not be my favorite when I get back from the next place. Unfortunately they were all mandatory — there wasn't an option to pick only the s…

These are KBA questions, which are generated by a third party based on information on your credit report. For the types of questions you describe, I just use my password manager to generate random strings for each of those answers and make a note of what question each string matches with. To make sure the strings are not rejected for special characters I use passwords a la https://xkcd.com/936/

Re: Myequifax.com Bypasses Credit Freeze Pin

#92

Post by zelon88 »

Equifax has the unique ability to collect the most private information available, even when they have never or will never interact with that person.

I think the entire credit system needs to be changed. If credit bureau's can't be responsible then citizens should get a choice in the matter. These companies have us by the balls and we have no recourse. It's a monopoly complete with price fixing and everything, except the price is privacy and you don't get any options.

It reminds me of an episode of Hotel Hell I saw where the front desk stored all guest credit card numbers, expiration date, and security code in a white lined notebook unlocked behind the counter. Gordon Ramsay walks up to an unstaffed counter, grabs the book, and walks off with it.

Now imagine that the hotel blatantly admits to not giving a shit about your credit card details, and you don't have the option of checking out and taking your business elsewhere.

Re: Myequifax.com Bypasses Credit Freeze Pin

#93

Post by [deleted] »

css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

[deleted]

Re: Myequifax.com Bypasses Credit Freeze Pin

#94

Post by TeMPOraL »

thetrumanshow wrote: post #77
tasty_freeze wrote: post #74

Earlier quoted context omitted.

Lie about which is your sign. If the bad guy knows your birthday, they will guess the wrong sign.

And now you have to keep all of your lies straight.

Someday someone will write a password manager equivalent for keeping track of one's lies.

Re: Myequifax.com Bypasses Credit Freeze Pin

#95

Post by craftyguy »

orky56 wrote: post #63
sevensor wrote: post #22

Earlier quoted context omitted.

So if everybody knows your SSN/DOB, I'd say that makes a very good identity system in the sense that we can all unambiguously refer to the same person. It's just not any use as a means of authenticating that you are the person who has that identity.

SSN on its own is sufficient for verifying identity. SSN coupled with a phone verification step is more secure for authenticating than DOB.

> SSN on its own is sufficient for verifying identity.

No. It's sufficient for identifying someone, but not at all sufficient (not even close) for verifying someone is who they say they are.

Re: Myequifax.com Bypasses Credit Freeze Pin

#96

Post by astura »

SketchySeaBeast wrote: post #18
arcticbull wrote: post #12

Earlier quoted context omitted.

You’re exactly right. It’s the same reason we’re required to sign checks then the bank promptly ignores the signatures. It’s cheaper to handle the fraud than check the signatures, but it makes us feel good to do it anyways.

I wish - a few years ago I was trying to pay for rent with a cheque and it bounced. I ended up sending another cheque, having that one get rejected, go into the bank and give them a new signature sample, and then have the next cheque be rejected as well due to the signature. Apparently my bank checks cheques.

I once forgot to sign a check completely, like totally blank signature line. It was cashed just fine.

Re: Myequifax.com Bypasses Credit Freeze Pin

#97

Post by MR4D »

css wrote: post #91
reaperducer wrote: post #87

Earlier quoted context omitted.

United Airlines asked me to fill in a bunch of crazy password questions a few weeks ago. Things like "What's your favorite flavor of ice cream?" Well, I dunno. It depends on my mood. Or "What if your favorite vacation destination?" Another bad question because my favorite today may not be my favorite when I get back from the next place. Unfortunately they were all mandatory — there wasn't an option to pick only the s…

These are KBA questions, which are generated by a third party based on information on your credit report. For the types of questions you describe, I just use my password manager to generate random strings for each of those answers and make a note of what question each string matches with. To make sure the strings are not rejected for special characters I use passwords a la https://xkcd.com/936/

I wonder if anyone has gone through the password lists to see if "correct horse battery staple" shows up, and if so, how many times.

Re: Myequifax.com Bypasses Credit Freeze Pin

#98

Post by SketchySeaBeast »

astura wrote: post #96
SketchySeaBeast wrote: post #18

Earlier quoted context omitted.

I wish - a few years ago I was trying to pay for rent with a cheque and it bounced. I ended up sending another cheque, having that one get rejected, go into the bank and give them a new signature sample, and then have the next cheque be rejected as well due to the signature. Apparently my bank checks cheques.

I once forgot to sign a check completely, like totally blank signature line. It was cashed just fine.

I wonder if you could argue that that wasn't a valid cheque to the bank then. But then you'd be saying you were claiming fraud against yourself, so somehow you'd still end up the one in trouble.

Re: Myequifax.com Bypasses Credit Freeze Pin

#99

Post by shawnz »

inetknght wrote: post #79
shawnz wrote: post #53

Earlier quoted context omitted.

> These companies provide no additonal benefits. They provide safety for lenders, which allows those lenders to offer you cheaper prices. Is that worth it? Not sure personally, but I don't think it's fair to say that they are totally without benefit.

Safety for lenders... by allowing fraud to be cheaper than lending to real people? I'm afraid I don't understand your logic.

I didn't say that Equifax was the ideal realization of what a credit bureau is supposed to be.

Re: Myequifax.com Bypasses Credit Freeze Pin

#100

Post by Someone1234 »

jdmichal wrote: post #85
Someone1234 wrote: post #48

Earlier quoted context omitted.

No, and the fact you think it is anything like SecureID means I did a poor job explaining it. It replaces cardboard cards with a SSN on them, with a cardboard card with a longer randomly generated key on it. There's no electronics involved from the consumer's perspective at all. The key is provided on your e.g. loan application. The financial institution sends that key to the government via API, and receives back a U…

I'm with you, except for the part where we trust the middle man to please-pretty-please-pinky-swear delete the key. That, to me, makes it weaker than a token approach. With the token approach, the intermediate value has such a short useful lifetime that it's practically not a secret. The real secret -- the value required to duplicate the token -- remains with only the client and the centralized store.

> please-pretty-please-pinky-swear delete the key.

In the first post I said quite the opposite:

> Make it illegal to store the numeric key itself in a database for long periods.

Using actual electronic tokens is impractical due to the costs. Even assuming just $1/each we're talking conservatively almost half a billion dollars (inc. shipping), and the upkeep would be similarly high.

The proposal above 1:1 replaces the system we have and are already paying for while solving most of the major weaknesses.

Multiple smartcard-like systems have failed spectacularly in other countries, a SecurID-like token would suffer from many of the same issues.

Post reply on HN