Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Myequifax.com Bypasses Credit Freeze Pin

krebsonsecurity.com

Post reply on HN
Print view View original

131–140 of 206 posts

Re: Myequifax.com Bypasses Credit Freeze Pin

#131

Post by noirbot »

astura wrote: post #106
mherdeg wrote: post #33

A real-life attack based on this kind of hole was discussed at https://www.reddit.com/r/personalfinance/comments/ay7aoy/ide... : someone says that an identity thief who knows all their knowledge-based question answers (because they have a copy of a credit report, no doubt) keeps somehow removing the freeze and committing more fraud.

Some KBA questions don't show up on your credit report, that being said, they can still be guessed with some certainty if you know the person. Some examples either me or my husband have gotten: -What month was [person] born? [person] was my mom and one option was "I don't know [person]." Luckily they didn't ask the date, because I don't know that, but I do know the month. -Which of the following people are/were you a…

I once had a nightmare set of one where I was setting things up over the phone and had to do KBAs, and asked me who held my Auto Loan. A. Who has my loan has changed since I got it originally. B. The options they gave were (Names changed) Wachovia, Ally Bank, Ally Bank Inc, Ally Bank of New York, where the original lender was Wachovia, and I know it got sold to Ally at some point.

I literally have no way to know which one of these they think is correct. At least 2 of them were correct at some point, depending on how up-to-date the data was, and the last three were indistinguishable, even when looking at my actual statements for my loan... So I failed out of my KBAs 4 straight times because they kept giving different variants of the same question, just with different sets of answers, until I could venn diagram out which one must be right because it was the only one that came up in all 4.

Re: Myequifax.com Bypasses Credit Freeze Pin

#132

Post by philwelch »

fhinson wrote: post #15

> SSN and DOB data is widely available for sale in the cybercrime underground on almost all U.S. citizens. This has been the reality for years, and was so well before Equifax announced its big 2017 breach. Again, I find that this only reinforces the fact that SSNs are not a useful identification system because there's nothing secure about them. Can someone explain where attackers obtain SSN/DOB data with such a wides…

SSNs are used widely enough that they can leak from anywhere. For example, my wife made an appointment with the eye doctor the other day and they needed to look up her vision care insurance. Since she's on my insurance, that means they needed my SSN. I asked my HR department what's up with that and where I can just get a plan number for the vision plan instead of having them look it up by SSN, and they said, "oh yeah, your plan number is just the last four digits of your SSN."

So, yeah. I bet you could obtain tons of SSNs from fucking Lenscrafters if you wanted to.

Re: Myequifax.com Bypasses Credit Freeze Pin

#133

Post by Someone1234 »

jdmichal wrote: post #105
Someone1234 wrote: post #100

Earlier quoted context omitted.

> please-pretty-please-pinky-swear delete the key. In the first post I said quite the opposite: > Make it illegal to store the numeric key itself in a database for long periods. Using actual electronic tokens is impractical due to the costs. Even assuming just $1/each we're talking conservatively almost half a billion dollars (inc. shipping), and the upkeep would be similarly high. The proposal above 1:1 replaces the…

In the end, you're really stuck between two places. Either you have something static, in which case it's got all the negatives of a static secret. Or, you have something dynamic, in which case you have to manage the infrastructure. The only thing that makes SSNs bad static secrets is that you should basically assume yours has been leaked at this point. Like others have said in this thread, they're not bad identifiers…

> Either you have something static, in which case it's got all the negatives of a static secret. Or, you have something dynamic, in which case you have to manage the infrastructure.

I just described a system that is neither fully static nor fully dynamic. It has a static part (Unique ID) and a semi-dynamic part (numerical key) that can rotate as needed.

> Your system is just another static piece of data to keep secret.

Keys can be rotated as needed. For example with drivers license renews. The Unique ID is static but it isn't security sensitive.

> I also don't understand how the "unique ID" doesn't have value.

Because having it doesn't give you the ability to open a bank account, take out a loan, or receive a benefit. It is used by the financial institutions to tie actions to an identity, nothing more.

The actual validation of identity occurs with the key and API, the Unique ID is simply the result.

> There's no way to distinguish between "obtained unique ID via the key and thereby proved identity" and "obtained unique ID via any other method and thereby did not prove identity".

The action of retrieving the Unique ID is more important for verifying identity than the actual Unique ID itself. You could steal a Unique ID but that isn't useful, and there wouldn't be another way of obtaining one.

Re: Myequifax.com Bypasses Credit Freeze Pin

#134

Post by jdsully »

ModernMech wrote: post #119
jjeaff wrote: post #104

Earlier quoted context omitted.

I'm normally not a fan of congressional hearings where everyone is trying to grandstand, but this one was particularly good. The congresswoman asked the Equifax CEO to provide his birthday and social security number publicly for the record. He of course refused and when asked why, he said because that is sensitive information. All the while, Equifax attorneys are arguing in court that there is no harm in leaking priv…

That's all well and good, but what was the concrete result of the hearing? Nothing actually happened and Equifax continues merrily along doing what it's always done.

Congressional hearings are about informing law makers (and also for grandstanding). They are not intended to provide immediate results in the way a trial would. The results if any will be in the form of legislation at a later date.

Re: Myequifax.com Bypasses Credit Freeze Pin

#135

Post by trjordan »

If you require the PIN to lift a credit freeze, some people will lose their PIN and never be able to lift the credit freeze.

So there must be a workaround that relies on verifying identity, based on non-random information (e.g. no PINs, no passwords).

They've made it too easy, but until we can request that a credit agency blacklist an SSN and forget all associated information, this will keep happening.

Re: Myequifax.com Bypasses Credit Freeze Pin

#136

Post by philwelch »

sevensor wrote: post #22
fhinson wrote: post #15

> SSN and DOB data is widely available for sale in the cybercrime underground on almost all U.S. citizens. This has been the reality for years, and was so well before Equifax announced its big 2017 breach. Again, I find that this only reinforces the fact that SSNs are not a useful identification system because there's nothing secure about them. Can someone explain where attackers obtain SSN/DOB data with such a wides…

So if everybody knows your SSN/DOB, I'd say that makes a very good identity system in the sense that we can all unambiguously refer to the same person. It's just not any use as a means of authenticating that you are the person who has that identity.

It could be worse. At the pharmacy, they ask you for your date of birth whenever you go pick up a prescription. That's how they verify that you can pick it up. You can send a spouse or family member or friend or personal assistant to pick up your prescriptions, too: you just tell them your date of birth and the pharmacy will just give them your prescription drugs, no questions asked. And if they have your insurance on file, they'll run it through, too.

OK, fine, whatever, except this is the same even for controlled substances. Which is quite weird considering all the other regulations around controlled substances. One time I had to get rid of some excess oxycodone after a surgery, I ended up having to go into a little booth at the sheriff's department where they had a drop box and a sheriff's deputy sitting at a desk behind a window watching me. But all my wife needed to pick it up in the first place was my name and DOB.

Re: Myequifax.com Bypasses Credit Freeze Pin

#137

Post by astura »

noirbot wrote: post #131
astura wrote: post #106

Earlier quoted context omitted.

Some KBA questions don't show up on your credit report, that being said, they can still be guessed with some certainty if you know the person. Some examples either me or my husband have gotten: -What month was [person] born? [person] was my mom and one option was "I don't know [person]." Luckily they didn't ask the date, because I don't know that, but I do know the month. -Which of the following people are/were you a…

I once had a nightmare set of one where I was setting things up over the phone and had to do KBAs, and asked me who held my Auto Loan. A. Who has my loan has changed since I got it originally. B. The options they gave were (Names changed) Wachovia, Ally Bank, Ally Bank Inc, Ally Bank of New York, where the original lender was Wachovia, and I know it got sold to Ally at some point. I literally have no way to know whic…

They really are piss poor low hanging fruit level of effort. I once I got a question asking which car I owned with four answers and I had owned two cars listed...

Then, of course, what if you get a question about your sister when she's toxic and you've cut her out of your life. Or even just naturally lost touch with her over the years.

Re: Myequifax.com Bypasses Credit Freeze Pin

#138

Post by voxic11 »

astura wrote: post #123
cedaratlas wrote: post #111

Earlier quoted context omitted.

Better than the SS administration who ask "Where were you when 9/11 happened" or "Where were you when JFK was assassinated"...Took a screenshot of these but cant find it now. My method is picking the common questions like "what street did you grow up on" and assigning it a random/not true/or another question such as "I don't know what my favorite street is"

These are so called "security questions" for that account; the great grandparent is talking about "knowledge-based authentication," which is a different thing entirely. The "security questions" you choose your answers, in "knowledge-based authentication" the questions and answers are generated based on the information on your credit reports and other databases, such as insurance databases. You don't make up answers,…

> Static KBA, also referred to as "shared secrets" or "shared secret questions", is commonly used by banks, financial services companies and e-mail providers to prove the identity of the customer before allowing account access or, as a fall-back, if the user forgets their password.

Wikipedia refers to "security questions" as "Static KBA".

Re: Myequifax.com Bypasses Credit Freeze Pin

#139

Post by simantel »

astura wrote: post #127
mfoy_ wrote: post #117

Earlier quoted context omitted.

> my ex as one of the answers. This one baffled me because we never lived together and never had a bank account or loan together Yikes. Where did they get that from? I wonder if they also collected tons of info from FaceBook like it seems everyone else has.

This was around... Oh... 8-9 years ago and I'm still trying to figure it out. It's honestly bothered me since then. I just really want to know how they connected us. I'm not mad they did, I just want to know how. We never had an insurance policy together or anything else like that either.

Did you list them as the beneficiary of any retirement accounts or insurance policies, or maybe as an emergency contact somewhere that reports to credit bureaus?

Re: Myequifax.com Bypasses Credit Freeze Pin

#140

Post by ModernMech »

jdsully wrote: post #134
ModernMech wrote: post #119

Earlier quoted context omitted.

That's all well and good, but what was the concrete result of the hearing? Nothing actually happened and Equifax continues merrily along doing what it's always done.

Congressional hearings are about informing law makers (and also for grandstanding). They are not intended to provide immediate results in the way a trial would. The results if any will be in the form of legislation at a later date.

Results can come a lot sooner and more incrementally than that. For example, there were congressional hearings very recently involving Michael Cohen and merely days later, document requests were issued as a result of the statements he made during he hearing.

So where are the inquiries? Where are the task forces? Where are the subpoenas? Where are the subcommittees? It's been over a year. Are you confident with "changes will come at a later date"? Seems to me like changes will happen never.

http://fortune.com/2018/09/07/equifax-data-breach-one-year-a...

Post reply on HN