Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Myequifax.com Bypasses Credit Freeze Pin

krebsonsecurity.com

Post reply on HN
Print view View original

161–170 of 206 posts

Re: Myequifax.com Bypasses Credit Freeze Pin

#161

Post by Gpetrium »

css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

This is probably the way the business found to ask the same question as a date of birth while requiring an extra step from the user, which then:

* Decreases the number of bots able to get into your account

* Make it harder for a foreign agent with limited knowledge of English to do the same.

No, I did not write that question for you to answer.

Re: Myequifax.com Bypasses Credit Freeze Pin

#162

Post by mikestew »

wtallis wrote: post #144
mikestew wrote: post #114

Earlier quoted context omitted.

Yes, I'd like to see someone demonstrate that they put some thought into the idea of what happens when, say, credit reporting agencies are eliminated or curtailed. What would be the negative repercussions, etc. In contrast to a low-effort farting of "break 'em up!" for karma. That doesn't bring anything new to the conversation.

It seems like you're arguing against a pithy call to shut down credit reporting agencies in general, when the comment at issue was specifically directed at the credit reporting agency that has the worst public track record for security and privacy. It's like if you had asked "but how will the economy function without accountants?" in response to the dismantling of Arthur Andersen, or asked how online banking could su…

It seems like you're arguing...

My argument was in my last sentence, in response to the defense of pithy comments that millions already beat to death six months ago. I'm arguing neither for nor against the shutdown of Equifax.

Re: Myequifax.com Bypasses Credit Freeze Pin

#163

Post by spaceribs »

zelon88 wrote: post #92

Equifax has the unique ability to collect the most private information available, even when they have never or will never interact with that person. I think the entire credit system needs to be changed. If credit bureau's can't be responsible then citizens should get a choice in the matter. These companies have us by the balls and we have no recourse. It's a monopoly complete with price fixing and everything, except…

I've heard about artists being told to destroy their artwork for obscenity or copyright reasons, but how many companies have been court ordered to purge their databases in the US?

Re: Myequifax.com Bypasses Credit Freeze Pin

#164

Post by sib »

css wrote: post #91
reaperducer wrote: post #87

Earlier quoted context omitted.

United Airlines asked me to fill in a bunch of crazy password questions a few weeks ago. Things like "What's your favorite flavor of ice cream?" Well, I dunno. It depends on my mood. Or "What if your favorite vacation destination?" Another bad question because my favorite today may not be my favorite when I get back from the next place. Unfortunately they were all mandatory — there wasn't an option to pick only the s…

These are KBA questions, which are generated by a third party based on information on your credit report. For the types of questions you describe, I just use my password manager to generate random strings for each of those answers and make a note of what question each string matches with. To make sure the strings are not rejected for special characters I use passwords a la https://xkcd.com/936/

I have a hard time believing that a KBA database would have GP's favorite flavor of ice cream.

Re: Myequifax.com Bypasses Credit Freeze Pin

#165

Post by davchana »

athenot wrote: post #43
davchana wrote: post #34

Earlier quoted context omitted.

Yes, Indian Banks too check Signatures on anything submitted to them. I once had to deposit cash in my own account but in different city in India. It was free if I deposited it, but fees for anybody third party. Cashier told me my signature doesn’t match with whats on file and thus either I need to re-sign or need to pay fees. Here in US I have seen policies in Stores saying we accept check, but we will onetime use t…

> I am so confused if by merely giving someone a cheque they are able to “pull” money from just two numbers, and can do it for any amount & any number of times. That is exactly how checks work. It's optimized for happy-path, with a big mess of a process to handle fraud. The cash equivalent would be to carry a bucket with all your money and when you pay, you present your bucket so that the shop can pull out the amount…

Well yes, but in India it does not work like this. If I give you a cheque for X amount, you cannot use those numbers mentioned on cheque leaf for any more txns. You can get only that X amount with only that cheque leaf.

Re: Myequifax.com Bypasses Credit Freeze Pin

#166

Post by Someone1234 »

jdmichal wrote: post #160
Someone1234 wrote: post #156

Earlier quoted context omitted.

Please see my response here: https://news.ycombinator.com/item?id=19341434 How are you paying for giving out half a billion SecurID-like tokens? I'm talking about a code that can be printed on your driver's license, you're talking about a piece of electronics that has to be shipped to every person in the US, the logical differences are stark.

So every OpenID provider has issued millions of dollars in tokens? No, of course not. All the tokens allow is offline generation of secrets. But if you don't need offline generation, then you don't need expensive tokens. I specifically call this out in my linked response; I don't know why you're still stuck on it. Also, soft tokens are a thing and are basically free to generate. I've got several loaded on my phone ri…

> All the tokens allow is offline generation of secrets.

Which negates the whole benefit of having short lived secrets, which was the whole crux of why you were suggesting it.

> Also, soft tokens are a thing and are basically free to generate.

So now instead of buying every citizen in the US a token we're buying every citizen a smartphone or legally requiring them to have one? Seems problematic.

> Also also, printing secret codes on drivers licenses seems like an amazingly bad idea...

Then print them on a separate sheet of cardboard. Still a massive order of magnitude cheaper than what you're suggesting which could range from $0.5-20B+ depending on implementation.

I'm suggesting a more flexible SSN that solves the major issues we already facing. You're suggesting a token based system without actual tokens, smartphone apps without actual smartphones, and printed list of codes.

Re: Myequifax.com Bypasses Credit Freeze Pin

#167

Post by spookthesunset »

rlucas wrote: post #52
athenot wrote: post #43

Earlier quoted context omitted.

> I am so confused if by merely giving someone a cheque they are able to “pull” money from just two numbers, and can do it for any amount & any number of times. That is exactly how checks work. It's optimized for happy-path, with a big mess of a process to handle fraud. The cash equivalent would be to carry a bucket with all your money and when you pay, you present your bucket so that the shop can pull out the amount…

"Optimized for happy-path" is true, but it also reveals something pretty neat about the American financial / business climate. "Default trust" actually works in our economy. And because of that, friction can be low and things Just Work. Default trust / happy-path optimization in turn works because of the backstop of a strong legal system, fairly clear precedent, and reasonably well defined property rights. Think: UCC…

You can expand that to other systems. For example you can walk onto a city bus in many cities without proof of payment. It is assumed the vast majority of people will have paid by tapping their transit card somewhere, or purchasing and activating some mobile-based e-ticket. Same with many commuter trains. The result is faster more streamlined service for everybody.

I find the cryptocurrency "space" fascinating for reasons like this. Because cryptocurrency gets rid of so many of societies long-evolved backstops, it is a perfect demonstration of why our society is structured the way it is and shows exactly what happens when we remove many of its features (eg: removing "trust" is very expensive).

Re: Myequifax.com Bypasses Credit Freeze Pin

#168

Post by spookthesunset »

css wrote: post #16
arcticbull wrote: post #12

Earlier quoted context omitted.

You’re exactly right. It’s the same reason we’re required to sign checks then the bank promptly ignores the signatures. It’s cheaper to handle the fraud than check the signatures, but it makes us feel good to do it anyways.

> the bank promptly ignores the signatures You're technically supposed to sign and endorse the back of every check you electronically deposit; I have never done this since my bank offered mobile deposit and have never had a check rejected. It honestly just makes me sad.

I mean, whats the point of signing the back of a check? Most businesses don't sign the backs of their checks. They use a stamp that has their business name printed in some ordinary font. At that point you might as well let the mobile app superimpose its own signature or have the ATM apply its own stamp.

Re: Myequifax.com Bypasses Credit Freeze Pin

#169

Post by thaumasiotes »

Trisell wrote: post #121
techsupporter wrote: post #26

Earlier quoted context omitted.

That looks like Ally Bank. --BUT, it isn't, per the reply below. It's Discover, though Ally asked me the same zodiac question in what looked like the same font.-- They won't open a joint savings account for my wife and I because my wife doesn't have a phone bill in her own name "for verification." (We've been on the same Southwestern Bell/Cingular/AT&T, recently T-Mobile, family plan for the past, oh, fifteen years,…

TBH it’s not the banks fault. Our governments stance on taxes, terrorism and drugs has caused this. Due to the need to verify citizenship, verify that you aren’t a terrorist and verify that you are a drug lord laundering money the banks are forced to jump through all of these hoops to give you an account.

> the need to verify citizenship, verify that you aren’t a terrorist and verify that you are a drug lord laundering money

One day these requirements are going to get out of hand. :D

Re: Myequifax.com Bypasses Credit Freeze Pin

#170

Post by beart »

My guess is the pin is largely pointless anyway. This new system was put in place because a large number of people forget or lose their pin. This would require a support ticket every time. The new system is intended to reduce support costs.
Post reply on HN