Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's still easy for anyone to become you at Experian

krebsonsecurity.com

Post reply on HN
Print view View original

51–60 of 347 posts

Re: It's still easy for anyone to become you at Experian

#51

Post by jen729w »

cirrus3 wrote: post #48
NikolaNovak wrote: post #37

I am still livid on a weekly basis when some strangers create an account for a service using my email address (non-maliciously, usually); I get a "verification" email; and I can only choose "YES, Please verify", or ignore at my peril. From tiny little mom-and-pop shops, to FAANG giants, nobody is giving me the opportunity to say "NO that's NOT me!". And though it's a "verification" email, typically account is usable…

Do you have an example of what your email address is? Is it like "john@gmail.com" or "mike@hotmail.com" or something? Seems pretty crazy that someone chooses it randomly every week. Have you considered getting your own domain for your email to make this probably go away? Obviously changing addresses is painful, but living your life with a common email seems worse.

I’ll chip in as john.@icloud.com.

I still get email from AT&T for John Notreallyme who I believe is in his 80s and lives in Montana. He signed up in-store and I got emailed all of his details.

I got the first email that asked me to confirm my email address. Obviously I did not do that.

It makes no difference. I don’t know why they bothered.

Re: It's still easy for anyone to become you at Experian

#52

Post by csharpminor »

I’ve received two data breach notices in the past week, one from my healthcare provider and the other from the bank that holds my mortgage.

In both instances they said to lock my credit, and provide free credit monitoring for a year.

I find this egregiously insufficient to the point where I think we need more regulation in this space. They should provide lifelong credit monitoring and full insurance on any financial fraud that now occurs on my behalf, as well as immediate presumptive financial compensation.

That aside, the root cause here is that identity in the U.S. is a dumpster fire. We have no distinction between unique identifier (SSN) and secret (also SSN). Every other security question is just another version of the same factor type (something you know) which is easily accessible to scammers.

There is quite literally no agreed upon way to prove you are who you say you are.

We need DMVs to begin issuing IDs that are physical with digital capabilities, like credit cards. We need the equivalent of Apple/Android Pay for identity online. We need to mandate that banks support digital IDs. And we need strict enforcement for people who misuse a digital ID.

I believe that the consequence of ignoring this problem is at least tens of billions of dollars in GDP annually lost to fraud. And perhaps more importantly, it’s an insidious erosion of our status as a country of laws.

Re: It's still easy for anyone to become you at Experian

#53

Post by arbuge »

surfpel wrote: post #43
NikolaNovak wrote: post #37

I am still livid on a weekly basis when some strangers create an account for a service using my email address (non-maliciously, usually); I get a "verification" email; and I can only choose "YES, Please verify", or ignore at my peril. From tiny little mom-and-pop shops, to FAANG giants, nobody is giving me the opportunity to say "NO that's NOT me!". And though it's a "verification" email, typically account is usable…

Have you tried to reset the password and delete the account?

Or just leave it open to (presumably) prevent its future use.

Re: It's still easy for anyone to become you at Experian

#54

Post by temp111123 »

cirrus3 wrote: post #48
NikolaNovak wrote: post #37

I am still livid on a weekly basis when some strangers create an account for a service using my email address (non-maliciously, usually); I get a "verification" email; and I can only choose "YES, Please verify", or ignore at my peril. From tiny little mom-and-pop shops, to FAANG giants, nobody is giving me the opportunity to say "NO that's NOT me!". And though it's a "verification" email, typically account is usable…

Do you have an example of what your email address is? Is it like "john@gmail.com" or "mike@hotmail.com" or something? Seems pretty crazy that someone chooses it randomly every week. Have you considered getting your own domain for your email to make this probably go away? Obviously changing addresses is painful, but living your life with a common email seems worse.

Mine is first.last@gmail.com.

I get tons of email intended for the other "first last"s in this world.

Most memorable are an employment offer as an environmental engineer in New Zealand, the results of an environmental survey for some commercial real estate development in Houston, TX, and bankruptcy papers from an attorney in British Columbia, CA.

Re: It's still easy for anyone to become you at Experian

#55

Post by colejohnson66 »

nick222226 wrote: post #42
jdsully wrote: post #26

Earlier quoted context omitted.

Credit reporting agencies have immunity from slander claims unless you can prove malice.

Would them ignoring a few certified letters asking them to contact you to correct slanderous significant errors in your information be enough to show malice?

That’s what a dispute is. It’s required by the FCRA.

Re: It's still easy for anyone to become you at Experian

#56

Post by flatline »

cirrus3 wrote: post #48
NikolaNovak wrote: post #37

I am still livid on a weekly basis when some strangers create an account for a service using my email address (non-maliciously, usually); I get a "verification" email; and I can only choose "YES, Please verify", or ignore at my peril. From tiny little mom-and-pop shops, to FAANG giants, nobody is giving me the opportunity to say "NO that's NOT me!". And though it's a "verification" email, typically account is usable…

Do you have an example of what your email address is? Is it like "john@gmail.com" or "mike@hotmail.com" or something? Seems pretty crazy that someone chooses it randomly every week. Have you considered getting your own domain for your email to make this probably go away? Obviously changing addresses is painful, but living your life with a common email seems worse.

Mine is first initial, somewhat-uncommon last name at gmail.com. Address acquired during the public beta back in 2004.

I regularly get reminders for dental visits in Oklahoma, purchase orders for machinery in Germany, and course registrations for some person who works in my industry and was easily searchable online.

It is not so intrusive to be problematic, and is mildly interesting.

Re: It's still easy for anyone to become you at Experian

#57

Post by cortesoft »

bee_rider wrote: post #6

Of course, we aren’t the customers for these spying companies. But it is surprising that the total lack of security isn’t a deal-breaker for their actual customers. I mean if you can basically impersonate anybody using this service, what is the point of using it?

These accounts aren’t for the people who pay Experian money. Companies pay Experian money to access information about individuals; the only reason Experian even allows accounts for individuals is because they are mandated by law to allow things like credit freezes and the annual credit report. If they weren’t required, they wouldn’t do it at all. They have zero incentive to improve the experience or the security of it.

Re: It's still easy for anyone to become you at Experian

#58

Post by cantSpellSober »

NikolaNovak wrote: post #37

I am still livid on a weekly basis when some strangers create an account for a service using my email address (non-maliciously, usually); I get a "verification" email; and I can only choose "YES, Please verify", or ignore at my peril. From tiny little mom-and-pop shops, to FAANG giants, nobody is giving me the opportunity to say "NO that's NOT me!". And though it's a "verification" email, typically account is usable…

> non-maliciously, usually

Don't be too quick to assume this. Likely the email account is one of many spammers gathered from a data breach.

Reset the password. I even change the username to "spam" or something too, poison as much of the associated data as I can. PITA I know, it happens to me regularly.

Re: It's still easy for anyone to become you at Experian

#59

Post by throwaway914 »

throwaway54_56 wrote: post #45
NikolaNovak wrote: post #37

I am still livid on a weekly basis when some strangers create an account for a service using my email address (non-maliciously, usually); I get a "verification" email; and I can only choose "YES, Please verify", or ignore at my peril. From tiny little mom-and-pop shops, to FAANG giants, nobody is giving me the opportunity to say "NO that's NOT me!". And though it's a "verification" email, typically account is usable…

I get these every so often and I'm curious what you mean my ignore at your own peril. My approach has been to ignore it and assume they will realize their mistake and reregister.

OP said so: The functionality of the account is usually partially or mostly available to an unverified email.

Re: It's still easy for anyone to become you at Experian

#60

Post by callalex »

barkerja wrote: post #46
NikolaNovak wrote: post #37

I am still livid on a weekly basis when some strangers create an account for a service using my email address (non-maliciously, usually); I get a "verification" email; and I can only choose "YES, Please verify", or ignore at my peril. From tiny little mom-and-pop shops, to FAANG giants, nobody is giving me the opportunity to say "NO that's NOT me!". And though it's a "verification" email, typically account is usable…

Given it is your email that is being used, that should allow for you to take over the account(s)? I'd submit a password reset, change the password, then just allow the account to live a dormant life. That of course doesn't make it any less annoying, but it would at least stop an actor from using an account that is associated to your email.

Be careful, in the USA that is still a violation of the CFAA and US courts have proven themselves to be technically incompetent time and time again. People have been sent to prison under CFAA for using the “view source” button that’s available in every web browser.
Post reply on HN