Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's still easy for anyone to become you at Experian

krebsonsecurity.com

Post reply on HN
Print view View original

141–150 of 347 posts

Re: It's still easy for anyone to become you at Experian

#141

Post by pdonis »

csharpminor wrote: post #52

I’ve received two data breach notices in the past week, one from my healthcare provider and the other from the bank that holds my mortgage. In both instances they said to lock my credit, and provide free credit monitoring for a year. I find this egregiously insufficient to the point where I think we need more regulation in this space. They should provide lifelong credit monitoring and full insurance on any financial…

> We need DMVs to begin issuing IDs that are physical with digital capabilities, like credit cards. We need the equivalent of Apple/Android Pay for identity online. We need to mandate that banks support digital IDs. And we need strict enforcement for people who misuse a digital ID.

And how will all this magically work online? Answer: you'll have to provide whatever digital secret gives you access, just the way you provide your SSN now. Which means your digital secret will be in all the same online places where your SSN is now, vulnerable to the same kind of hacking. How does this fix anything?

Re: It's still easy for anyone to become you at Experian

#142

Post by moneywoes »

caminante wrote: post #134
cortesoft wrote: post #57

Earlier quoted context omitted.

These accounts aren’t for the people who pay Experian money. Companies pay Experian money to access information about individuals; the only reason Experian even allows accounts for individuals is because they are mandated by law to allow things like credit freezes and the annual credit report. If they weren’t required, they wouldn’t do it at all. They have zero incentive to improve the experience or the security of i…

> Companies pay Experian money to access information about individuals And your firm pays Experian/Equifax/etc. to GIVE information about you, e.g., automated employment verification.

someone shoudl be able to freeze their work number to preven this correct? or am I thinking of something else

Re: It's still easy for anyone to become you at Experian

#143

Post by notahacker »

wildrhythms wrote: post #70
NikolaNovak wrote: post #37

I am still livid on a weekly basis when some strangers create an account for a service using my email address (non-maliciously, usually); I get a "verification" email; and I can only choose "YES, Please verify", or ignore at my peril. From tiny little mom-and-pop shops, to FAANG giants, nobody is giving me the opportunity to say "NO that's NOT me!". And though it's a "verification" email, typically account is usable…

I was receiving somebody's water bill in my email addressed to someone in the Netherlands (apparently with a similar name). It contained their address, full name, details of their water bill... The email was in Dutch and I used Google Translate to make sense of it. It came from a no-reply so I couldn't just reply and say 'wrong customer', and there was no customer support email address to be found. I had to go to the…

Vietnam Airlines once sent me someone's airline ticket, about 48 hours before they were due to fly (and about 10 years after the only time I ever flew with them). Their name wasn't even remotely similar to mine and their email can't have been either. At least that one appeared to be human error so there's a chance that my email pointing out the mistake was read by a human that was actually able to sort it out.

Re: It's still easy for anyone to become you at Experian

#144

Post by fordholes »

albroland wrote: post #136
benlivengood wrote: post #129

The best outcome is to have minor fraud (someone tried and failed to open an account in your name, or your name+address appears in a data dump somewhere) occur because then you can register a fraud alert and credit freeze in all the agencies which stops a lot of nonsense (random junk mail, risk of actual fraudulent accounts getting established) for a year or so by enforcing extra authentication steps. I wish I could…

Correct me if I’m wrong, but I’ve signed up for all 3 bureaus and enabled the credit freeze. My understanding, and experience years later, is that it is still frozen. I had to unfreeze a specific one last year for an auto loan. Is there something else I’m missing that’s only temporary?

If someone hijacks your account they can unfreeze your credit. It’s easy to hijack accounts.

Re: It's still easy for anyone to become you at Experian

#145

Post by albroland »

fordholes wrote: post #144
albroland wrote: post #136

Earlier quoted context omitted.

Correct me if I’m wrong, but I’ve signed up for all 3 bureaus and enabled the credit freeze. My understanding, and experience years later, is that it is still frozen. I had to unfreeze a specific one last year for an auto loan. Is there something else I’m missing that’s only temporary?

If someone hijacks your account they can unfreeze your credit. It’s easy to hijack accounts.

I understand that, I’m curious if reporting fraud activity helps prevent that in some way like the parent comment seems to suggest, if only for a year.

Re: It's still easy for anyone to become you at Experian

#146

Post by notahacker »

supertofu wrote: post #124
vultour wrote: post #80

Earlier quoted context omitted.

Was there a period where you could register those separately? My old google account receives emails for both domains.

There must have been, else I wouldn't be in this situation.

Or they could just have a similar gmail address they frequently get wrong (or that looks like yours when written in the terrible handwriting they fill in forms with)

There's probably a single digit number of people with my initial and surname in the world, and I still get order confirmations for one of them, car promotions for another and am on some sort of targeted B2B spam list for a third to my Gmail address in that format. I quite like the order confirmations tbf, most of them are for a fish and chip shop I actually used to get food at when I was a kid and my grandparents lived nearby so they're oddly nostalgic

Re: It's still easy for anyone to become you at Experian

#147

Post by hakfoo »

narrator wrote: post #69

This all goes back to the social security not being changeable and morphing from some thing to claim benefits with to it being your universal password. In contrast, I lost my drivers license and in order to get a new one I had to go the DMV in person and put my thumb print on a biometric scanner which pulls up my picture for the DMV person to look at before they authorize the request. I can also file an affidavit of…

I was somewhat surprised to find that when I got my driver's licence at 39, it was the same number as the non-driving ID card I got issued at 18. So at least Arizona doesn't seem to be eager to hand out new numbers.

Re: It's still easy for anyone to become you at Experian

#149

Post by golem14 »

toomuchtodo wrote: post #19
breadwinner wrote: post #14

The fundamental issue here is that maintaining security is expensive, and it is cheaper to just deal with occasional hacks. The only solution is to make hacks extremely expensive to the companies that get hacked — through fines as well as lawsuits by victims of identity theft.

It is not that expensive. It is a couple pennies per pull (of a credit report/file) for somebody seeking identity proofing to use knowledge based authentication (the usual “where did you live, are these trade lines you?”). It is $1.50-$2.00 per proofing attempt with the government credential using ID.me or stripe identity. The problem is that no one is incentivized to slightly increases costs to reduce fraud because…

I would imagine that most of the data for the ID checks based on public records (where did a person live; own a car/house/boat; ...) are trivially handleable.

Just takes one person to leak the database, which is probably only a few TB compressed) for all of the US and fits on a single HDD/SDD.

I would be surprised if these DBs aren't already sold on the darknet. And this DB doesn't have to be super up to date b/c security questions often go back years.

Interpreting the DB should be easy to hardcode but even easier handled with an LLM.

So the protection afforded by these checks is IMO at best nominal.

Re: It's still easy for anyone to become you at Experian

#150

Post by EGreg »

It's not just Experian. We publish an article every couple years or so with the same content and just the names changed:

https://qbix.com/blog/2021/01/25/no-way-to-prevent-this-says...

https://qbix.com/blog/2023/06/12/no-way-to-prevent-this-says...

And then of course there is this:

SIM swapping - someone can just steal your SIM and then get into a lot of accounts

https://www.bloomberg.com/news/features/2023-08-04/teen-game...

Amazon - someone can just take over your account

https://www.reddit.com/r/cybersecurity/comments/hsj4x8/my_am...

Apple and Amazon together, they can take over ALL YOUR ACCOUNTS (the most terrifying read):

https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking...

I recommend to everyone to use a email alias at gmail or a similar service, different once for every site, instead of your actual email, as the login to Amazon and other services. That way the attackers can't guess your actual login, let alone your password.

Post reply on HN