Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Myequifax.com Bypasses Credit Freeze Pin

krebsonsecurity.com

Post reply on HN
Print view View original

111–120 of 206 posts

Re: Myequifax.com Bypasses Credit Freeze Pin

#111

Post by cedaratlas »

nkrisc wrote: post #61
css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

Zodiac sign? Seriously? I don't know what mine is because that is not a belief system/religion I subscribe to so I had to Google it. Turns out my birthdate must be on the border because different sources have it as a different sign. They might as well ask what color my aura is.

Better than the SS administration who ask "Where were you when 9/11 happened" or "Where were you when JFK was assassinated"...Took a screenshot of these but cant find it now. My method is picking the common questions like "what street did you grow up on" and assigning it a random/not true/or another question such as "I don't know what my favorite street is"

Re: Myequifax.com Bypasses Credit Freeze Pin

#113

Post by yorwba »

nothrabannosir wrote: post #88
thetrumanshow wrote: post #77

Earlier quoted context omitted.

And now you have to keep all of your lies straight.

Absolutely; use a password manager. This is the least bad way to go for these types of "security questions": give a plausible, but wrong, answer. Correct is too easy to guess. Obviously wrong will be recognised by the customer service representative, who is a kind person, and will help you out by just disabling the question (anecdotes galore for this, to the point we can call it data). Lie, in a believable way. Put t…

Password managers solve the storage part of making security questions secure, but there's still the question of generating sufficiently random answers in the correct format.

I look forward to password managers including generators for your birth date, family tree, childhood friends, favorite color and maybe also social security number, name and address if those aren't actually required for anything. Then you can have a value for your mother's maiden name that isn't incredibly common, but nonetheless looks like an actual person's name.

Re: Myequifax.com Bypasses Credit Freeze Pin

#114

Post by mikestew »

ams6110 wrote: post #31
gooseus wrote: post #17

Earlier quoted context omitted.

I agree, but this is not a helpful point form which to start a conversation. It's lazy and below the standards many expect from HN. A better way to start this conversation (imo) would be to make reference to the many mistakes Equifax has made over the years and ask what is preventing Equifax from facing real consequences, such as being shutdown? It's the effort that people place into having genuine conversations that…

So you want someone to write three paragraphs for what can be said in six words? I prefer the brevity.

Yes, I'd like to see someone demonstrate that they put some thought into the idea of what happens when, say, credit reporting agencies are eliminated or curtailed. What would be the negative repercussions, etc.

In contrast to a low-effort farting of "break 'em up!" for karma. That doesn't bring anything new to the conversation.

Re: Myequifax.com Bypasses Credit Freeze Pin

#115

Post by reaperducer »

cedaratlas wrote: post #111
nkrisc wrote: post #61

Earlier quoted context omitted.

Zodiac sign? Seriously? I don't know what mine is because that is not a belief system/religion I subscribe to so I had to Google it. Turns out my birthdate must be on the border because different sources have it as a different sign. They might as well ask what color my aura is.

Better than the SS administration who ask "Where were you when 9/11 happened" or "Where were you when JFK was assassinated"...Took a screenshot of these but cant find it now. My method is picking the common questions like "what street did you grow up on" and assigning it a random/not true/or another question such as "I don't know what my favorite street is"

I often use "None Of Your Business Street." Works every time.

Re: Myequifax.com Bypasses Credit Freeze Pin

#116

Post by jdmichal »

patch_cable wrote: post #107
jdmichal wrote: post #85

Earlier quoted context omitted.

I'm with you, except for the part where we trust the middle man to please-pretty-please-pinky-swear delete the key. That, to me, makes it weaker than a token approach. With the token approach, the intermediate value has such a short useful lifetime that it's practically not a secret. The real secret -- the value required to duplicate the token -- remains with only the client and the centralized store.

I think that is mitigated by allowing the key to be rotated freely. The shortcomings over the token based approach are outweighed by being more practical to implement. If the issuing of a new key was an annual process, or even tied to something like drivers license/state id renewal, it would still be worlds better than what we have today.

If rotation is the secret sauce, then the best strategy is to rotate after every use. In which case, why not just build that into the system:

1. Client holds key.

2. Client exchanges key with central agency for token. Token expires after a short time period, making long-term storage and leaks useless.

3. Client gives token to company.

4. Company validates token with central agency.

And now we've reinvented OpenID. And SecurID is nothing but a piece of hardware that can perform (2) in a decentralized manner. We could maybe modify (4) to potentially be more useful for this specific use-case:

4. Company exchanges client identity token with central agency for a validation token that can be stored long-term. Validation token signifies that an identity token was received and exchanged, for legal purposes.

What I don't know is how to protect this validation token from becoming valuable beyond the above use-case. If it's proof of something, then it becomes valuable for that proof... So it would would have to be scope-limited in ways that make it useless for proving anything other than that exact exchange. Off the top of my head, obvious scope limitations are: client, company, and timestamp.

Re: Myequifax.com Bypasses Credit Freeze Pin

#117

Post by mfoy_ »

astura wrote: post #106
mherdeg wrote: post #33

A real-life attack based on this kind of hole was discussed at https://www.reddit.com/r/personalfinance/comments/ay7aoy/ide... : someone says that an identity thief who knows all their knowledge-based question answers (because they have a copy of a credit report, no doubt) keeps somehow removing the freeze and committing more fraud.

Some KBA questions don't show up on your credit report, that being said, they can still be guessed with some certainty if you know the person. Some examples either me or my husband have gotten: -What month was [person] born? [person] was my mom and one option was "I don't know [person]." Luckily they didn't ask the date, because I don't know that, but I do know the month. -Which of the following people are/were you a…

> my ex as one of the answers. This one baffled me because we never lived together and never had a bank account or loan together

Yikes. Where did they get that from? I wonder if they also collected tons of info from FaceBook like it seems everyone else has.

Re: Myequifax.com Bypasses Credit Freeze Pin

#118

Post by mehrdadn »

SketchySeaBeast wrote: post #82
rlucas wrote: post #52

Earlier quoted context omitted.

"Optimized for happy-path" is true, but it also reveals something pretty neat about the American financial / business climate. "Default trust" actually works in our economy. And because of that, friction can be low and things Just Work. Default trust / happy-path optimization in turn works because of the backstop of a strong legal system, fairly clear precedent, and reasonably well defined property rights. Think: UCC…

> "Default trust" actually works in our economy. And because of that, friction can be low and things Just Work. Does it though? I think there's a reason we've stopped accepting cheques - cheques were the best "easy" way to transfer relatively large sums of money at once, now that we're past that and have more secure credit and debit cards cheques are becoming banned. I don't think it was optimized for "happy path" pe…

>> "Default trust" actually works in our economy. And because of that, friction can be low and things Just Work.

> Does it though? I think there's a reason we've stopped accepting cheques

That's a very specific issue but this is a pretty general fact. With respect to checks, people still write and accept checks, we just have more convenient payment methods. Also checks are still the easy way to transfer large sums of money at many banks. More generally though, just look at how much can be done with a signature under penalty of perjury, and how relatively rarely these are forged. The trust-based system really works decently well in the US.

Re: Myequifax.com Bypasses Credit Freeze Pin

#119

Post by ModernMech »

jjeaff wrote: post #104
zelon88 wrote: post #92

Equifax has the unique ability to collect the most private information available, even when they have never or will never interact with that person. I think the entire credit system needs to be changed. If credit bureau's can't be responsible then citizens should get a choice in the matter. These companies have us by the balls and we have no recourse. It's a monopoly complete with price fixing and everything, except…

I'm normally not a fan of congressional hearings where everyone is trying to grandstand, but this one was particularly good. The congresswoman asked the Equifax CEO to provide his birthday and social security number publicly for the record. He of course refused and when asked why, he said because that is sensitive information. All the while, Equifax attorneys are arguing in court that there is no harm in leaking priv…

That's all well and good, but what was the concrete result of the hearing? Nothing actually happened and Equifax continues merrily along doing what it's always done.

Re: Myequifax.com Bypasses Credit Freeze Pin

#120

Post by godelski »

css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

IIRC there was a post here awhile ago about how you could refresh the pages and the options would change. Except, of course, the correct answer. Maybe someone else remembers and has the link.
Post reply on HN