Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Myequifax.com Bypasses Credit Freeze Pin

krebsonsecurity.com

Post reply on HN
Print view View original

191–200 of 206 posts

Re: Myequifax.com Bypasses Credit Freeze Pin

#191

Post by joering2 »

ModernMech wrote: post #140
jdsully wrote: post #134

Earlier quoted context omitted.

Congressional hearings are about informing law makers (and also for grandstanding). They are not intended to provide immediate results in the way a trial would. The results if any will be in the form of legislation at a later date.

Results can come a lot sooner and more incrementally than that. For example, there were congressional hearings very recently involving Michael Cohen and merely days later, document requests were issued as a result of the statements he made during he hearing. So where are the inquiries? Where are the task forces? Where are the subpoenas? Where are the subcommittees? It's been over a year. Are you confident with "chang…

Equifax CEO did not commit crimes. Can’t say the same about Cohen and inquiries spawned off of his testimonies.

Re: Myequifax.com Bypasses Credit Freeze Pin

#192

Post by sfifs »

ModernMech wrote: post #140
jdsully wrote: post #134

Earlier quoted context omitted.

Congressional hearings are about informing law makers (and also for grandstanding). They are not intended to provide immediate results in the way a trial would. The results if any will be in the form of legislation at a later date.

Results can come a lot sooner and more incrementally than that. For example, there were congressional hearings very recently involving Michael Cohen and merely days later, document requests were issued as a result of the statements he made during he hearing. So where are the inquiries? Where are the task forces? Where are the subpoenas? Where are the subcommittees? It's been over a year. Are you confident with "chang…

To a non-american, the promptness and lack of even thinking or hesitation with which Michael Cohen answered and the swift "results" it produced make it seem almost certain that the questions from AOC and others were were pre-coordinated "set pieces" designed to provide some kind of "parallel construction" justification for the requests. I wouldn't put much store by these things.

Re: Myequifax.com Bypasses Credit Freeze Pin

#193

Post by enraged_camel »

sfifs wrote: post #192
ModernMech wrote: post #140

Earlier quoted context omitted.

Results can come a lot sooner and more incrementally than that. For example, there were congressional hearings very recently involving Michael Cohen and merely days later, document requests were issued as a result of the statements he made during he hearing. So where are the inquiries? Where are the task forces? Where are the subpoenas? Where are the subcommittees? It's been over a year. Are you confident with "chang…

To a non-american, the promptness and lack of even thinking or hesitation with which Michael Cohen answered and the swift "results" it produced make it seem almost certain that the questions from AOC and others were were pre-coordinated "set pieces" designed to provide some kind of "parallel construction" justification for the requests. I wouldn't put much store by these things.

Wow, that’s one hell of a conspiracy theory.

Re: Myequifax.com Bypasses Credit Freeze Pin

#194

Post by gibolt »

joering2 wrote: post #191
ModernMech wrote: post #140

Earlier quoted context omitted.

Results can come a lot sooner and more incrementally than that. For example, there were congressional hearings very recently involving Michael Cohen and merely days later, document requests were issued as a result of the statements he made during he hearing. So where are the inquiries? Where are the task forces? Where are the subpoenas? Where are the subcommittees? It's been over a year. Are you confident with "chang…

Equifax CEO did not commit crimes. Can’t say the same about Cohen and inquiries spawned off of his testimonies.

If I recall, they sold tons of stock before the leaks leaked.

Re: Myequifax.com Bypasses Credit Freeze Pin

#195

Post by bscphil »

astura wrote: post #106
mherdeg wrote: post #33

A real-life attack based on this kind of hole was discussed at https://www.reddit.com/r/personalfinance/comments/ay7aoy/ide... : someone says that an identity thief who knows all their knowledge-based question answers (because they have a copy of a credit report, no doubt) keeps somehow removing the freeze and committing more fraud.

Some KBA questions don't show up on your credit report, that being said, they can still be guessed with some certainty if you know the person. Some examples either me or my husband have gotten: -What month was [person] born? [person] was my mom and one option was "I don't know [person]." Luckily they didn't ask the date, because I don't know that, but I do know the month. -Which of the following people are/were you a…

I've never taken out a loan of any kind, so 90% of the time the answer to all KBA questions is "none of the above".

That's aside from the fact that Equifax's site has never worked right for me anyway, and doesn't accept my information. Never been able to pull my report online from them. The other two major agencies work fine.

Re: Myequifax.com Bypasses Credit Freeze Pin

#196

Post by mjevans »

orky56 wrote: post #63
sevensor wrote: post #22

Earlier quoted context omitted.

So if everybody knows your SSN/DOB, I'd say that makes a very good identity system in the sense that we can all unambiguously refer to the same person. It's just not any use as a means of authenticating that you are the person who has that identity.

SSN on its own is sufficient for verifying identity. SSN coupled with a phone verification step is more secure for authenticating than DOB.

It's the difference between a user ID (be it a small integer or a long string) and actually authenticating to perform actions AS said user.

SSN as a user identifier - to uniquely describe an entity

Actual PKI including a secure public/private key with a signature from a trusted agent (like a government ID authority), and maybe also web-of-trust signatures? THAT is what is required to securely sign things.

Re: Myequifax.com Bypasses Credit Freeze Pin

#197

Post by mjevans »

criddell wrote: post #101
jiveturkey wrote: post #78

password policy for my.equifax.com is ... not best practice. at least they allow up to 20 characters. must include one special character from a set of ... FIVE. and those are the only allowed special characters.

Whenever they limit the number of characters to something small, it makes me wonder if they are storing the password in their database rather than some hash of the password. I complained about this to my old bank (Wells Fargo) and they told me not to worry about it because I'm protected from fraud.

It generally means they're not handling it in a secure way. Worst case scenario is that if the checks you see client side aren't also server side someone might be able to inject things that run as... whatever the server side processes are.

Usually anyplace that has a limit less than 512 characters (often 1024, but some string buffers are small) or on the characters you can use, at all, isn't doing it right.

Re: Myequifax.com Bypasses Credit Freeze Pin

#199

Post by smtihwilson0907 »

at first i don't believe it when my brother told me about a credit score fixer , i have unwanted collections ,late payments , tax liens and of course charged off accounts , i have tried many means to get my profile back and have my score up excellently ,it happened just like magic when dejatech007 AT Gmail . com fixed my credit profile in few days , he removed all unwanted collections, late payments ,tax lien and increased my credit score from 416 to 786 .i don't believe at first until it all happened . ever since then i have been having a perfect credit profile , all thanks to him.he's my savior . don't miss the good opportunity my good people.

Re: Myequifax.com Bypasses Credit Freeze Pin

#200

Post by smaps »

zachberger wrote: post #159
cannonedhamster wrote: post #155

Earlier quoted context omitted.

If only there were some kind of oversight by a government agency made to protect consumers from these types of things when the market based approach fails. This type of agency or bureau would be there to protect people when there was no legal recourse otherwise and establish rules so that corporate entities and businesses were beholden to someone. Meh, I'm sure the market will sort it out since you can just take your…

You seem to be describing the CFPB?

I think he missed the sarcasm tag...
Post reply on HN