Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Myequifax.com Bypasses Credit Freeze Pin

krebsonsecurity.com

Post reply on HN
Print view View original

101–110 of 206 posts

Re: Myequifax.com Bypasses Credit Freeze Pin

#101

Post by criddell »

jiveturkey wrote: post #78

password policy for my.equifax.com is ... not best practice. at least they allow up to 20 characters. must include one special character from a set of ... FIVE. and those are the only allowed special characters.

Whenever they limit the number of characters to something small, it makes me wonder if they are storing the password in their database rather than some hash of the password.

I complained about this to my old bank (Wells Fargo) and they told me not to worry about it because I'm protected from fraud.

Re: Myequifax.com Bypasses Credit Freeze Pin

#102

Post by baobrain »

MR4D wrote: post #97
css wrote: post #91

Earlier quoted context omitted.

These are KBA questions, which are generated by a third party based on information on your credit report. For the types of questions you describe, I just use my password manager to generate random strings for each of those answers and make a note of what question each string matches with. To make sure the strings are not rejected for special characters I use passwords a la https://xkcd.com/936/

I wonder if anyone has gone through the password lists to see if "correct horse battery staple" shows up, and if so, how many times.

According to haveibeenpwned.com, they've seen "correcthorsebatterystaple" 114 times

Re: Myequifax.com Bypasses Credit Freeze Pin

#104

Post by jjeaff »

zelon88 wrote: post #92

Equifax has the unique ability to collect the most private information available, even when they have never or will never interact with that person. I think the entire credit system needs to be changed. If credit bureau's can't be responsible then citizens should get a choice in the matter. These companies have us by the balls and we have no recourse. It's a monopoly complete with price fixing and everything, except…

I'm normally not a fan of congressional hearings where everyone is trying to grandstand, but this one was particularly good.

The congresswoman asked the Equifax CEO to provide his birthday and social security number publicly for the record. He of course refused and when asked why, he said because that is sensitive information.

All the while, Equifax attorneys are arguing in court that there is no harm in leaking private data like SSNs and thus they shouldn't be held liable for any damages.

https://www.fastcompany.com/90312551/watch-a-congresswoman-d...

Re: Myequifax.com Bypasses Credit Freeze Pin

#105

Post by jdmichal »

Someone1234 wrote: post #100
jdmichal wrote: post #85

Earlier quoted context omitted.

I'm with you, except for the part where we trust the middle man to please-pretty-please-pinky-swear delete the key. That, to me, makes it weaker than a token approach. With the token approach, the intermediate value has such a short useful lifetime that it's practically not a secret. The real secret -- the value required to duplicate the token -- remains with only the client and the centralized store.

> please-pretty-please-pinky-swear delete the key. In the first post I said quite the opposite: > Make it illegal to store the numeric key itself in a database for long periods. Using actual electronic tokens is impractical due to the costs. Even assuming just $1/each we're talking conservatively almost half a billion dollars (inc. shipping), and the upkeep would be similarly high. The proposal above 1:1 replaces the…

In the end, you're really stuck between two places. Either you have something static, in which case it's got all the negatives of a static secret. Or, you have something dynamic, in which case you have to manage the infrastructure.

The only thing that makes SSNs bad static secrets is that you should basically assume yours has been leaked at this point. Like others have said in this thread, they're not bad identifiers, but they're a terrible choice for confirming identity.

Your system is just another static piece of data to keep secret. Which is where SSNs started when this crazy train kicked off. And no, "rotation" is not the secret sauce, because SSNs can already be rotated under certain circumstances.

I also don't understand how the "unique ID" doesn't have value. OK, you can't confirm an identity with it on the centralized system. But as far as I can tell, it basically serves as proof that you did confirm the identity. There's no way to distinguish between "obtained unique ID via the key and thereby proved identity" and "obtained unique ID via any other method and thereby did not prove identity".

Re: Myequifax.com Bypasses Credit Freeze Pin

#106

Post by astura »

mherdeg wrote: post #33

A real-life attack based on this kind of hole was discussed at https://www.reddit.com/r/personalfinance/comments/ay7aoy/ide... : someone says that an identity thief who knows all their knowledge-based question answers (because they have a copy of a credit report, no doubt) keeps somehow removing the freeze and committing more fraud.

Some KBA questions don't show up on your credit report, that being said, they can still be guessed with some certainty if you know the person.

Some examples either me or my husband have gotten:

-What month was [person] born? [person] was my mom and one option was "I don't know [person]." Luckily they didn't ask the date, because I don't know that, but I do know the month.

-Which of the following people are/were you associated with?, my ex-roommate as one of the answers. Makes sense to connect us if we had the same address at the same time.

-Which of the following people are/were you associated with?, my ex as one of the answers. This one baffled me because we never lived together and never had a bank account or loan together.

Which town did/does [person] live in? Where [person] was my husband's brother. Of course, useless if everyone still lives in their hometown.

I've also been asked about the previous cars I've owned, which are from DMV and insurance databases, not credit reports.

The entire concept of KBA is flawed and pretty shitty all around.

Re: Myequifax.com Bypasses Credit Freeze Pin

#107

Post by patch_cable »

jdmichal wrote: post #85
Someone1234 wrote: post #48

Earlier quoted context omitted.

No, and the fact you think it is anything like SecureID means I did a poor job explaining it. It replaces cardboard cards with a SSN on them, with a cardboard card with a longer randomly generated key on it. There's no electronics involved from the consumer's perspective at all. The key is provided on your e.g. loan application. The financial institution sends that key to the government via API, and receives back a U…

I'm with you, except for the part where we trust the middle man to please-pretty-please-pinky-swear delete the key. That, to me, makes it weaker than a token approach. With the token approach, the intermediate value has such a short useful lifetime that it's practically not a secret. The real secret -- the value required to duplicate the token -- remains with only the client and the centralized store.

I think that is mitigated by allowing the key to be rotated freely. The shortcomings over the token based approach are outweighed by being more practical to implement. If the issuing of a new key was an annual process, or even tied to something like drivers license/state id renewal, it would still be worlds better than what we have today.

Re: Myequifax.com Bypasses Credit Freeze Pin

#108

Post by basch »

thetrumanshow wrote: post #77
tasty_freeze wrote: post #74

Earlier quoted context omitted.

Lie about which is your sign. If the bad guy knows your birthday, they will guess the wrong sign.

And now you have to keep all of your lies straight.

They arent asking you questions they dont know. They will ask you questions about the color of your car or streets you lived on, and they know the answers.

Re: Myequifax.com Bypasses Credit Freeze Pin

#109

Post by [deleted] »

Robelius wrote: post #51
techsupporter wrote: post #30

Earlier quoted context omitted.

Oh, and one more thing: This is the same bank that called me the other day to inquire about our application and--even though they called me--their representative got mad when I wouldn't give him the last four digits of both of our Social Security numbers and our dates of birth and Mother's Maiden Name / Security Answers from the application. When I pointed out that a) he called me and b) this is, quite literally, exa…

I had a similar issue with Chase calling me, as a follow up to fraudulent charges on my card. They were asking for basic identifying information, but I didn’t feel comfortable so I hung up. I then called Chase and asked if it really was them that called, and they confirmed it was actually them. But then they also apoligized and resumed the previous call from where I hung up. It was just nice to not be judged for bein…

[deleted]

Re: Myequifax.com Bypasses Credit Freeze Pin

#110

Post by monochromatic »

RandomCitizen wrote: post #103

I just made upper management aware at Equifax. Let's see how long this takes until they require the FUCKING PIN number to unfreeze your credit on their website. What a joke.

We’ll see.

>Equifax spokesperson Nancy Bistritz-Balkan said not requiring a PIN for people with existing freezes was by design.

>“With myEquifax, we created an online experience that enables consumers to securely and conveniently manage security freezes and fraud alerts,” Bistritz-Balkan said..

Post reply on HN