Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's still easy for anyone to become you at Experian

krebsonsecurity.com

Post reply on HN
Print view View original

281–290 of 347 posts

Re: It's still easy for anyone to become you at Experian

#281

Post by alistairSH »

michpoch wrote: post #275
alistairSH wrote: post #263

Earlier quoted context omitted.

The same way they do for people who aren’t from the US? Some combination of name, address, birthdate, etc. But the problem isn’t using the SSN as a semi-unique ID. It’s using it for that and also assuming it’s secret. SSN shouldn’t be any more secret than name or address (and shouldn’t be used to unlock or access accounts).

> The same way they do for people who aren’t from the US? Some combination of name, address, birthdate, etc. Plenty of countries have SSN-like numbers: https://en.wikipedia.org/wiki/National_identification_number It's really not that special. > But the problem isn’t using the SSN as a semi-unique ID. It’s using it for that and also assuming it’s secret. SSN shouldn’t be any more secret than name or address (and shoul…

Shouldn't it be trivial to sue any institution that uses SSN as a way to confirm your identity?

You’d think, yet here we are, with one of the big three credit agencies letting people steal/resteal accounts with nothing more than some public info.

Re: It's still easy for anyone to become you at Experian

#282

Post by notatoad »

robertlagrant wrote: post #249
ajmurmann wrote: post #97

Earlier quoted context omitted.

Even the term "identity theft" needs to go. My identity wasn't stolen! I'm still the same person. The bank got tricked by a scammers and somehow the bank tries to make that my fault. Edit: Imagine this the other way around! Grandma gets scammed by someone pretending to be her bank. So the bank's identity got stolen. So now the real bank needs to fix it, provide more proof of identity to all customers and jump through…

Why do you think that calling something theft blames the victim of the theft?

it's not about blame, it's about responsibility. "identity theft" implies that your identity is a thing that can be stolen from you, and you need to be responsible for preventing it from being stolen.

instutions should be respomsible for protecting themselves from fraud, they shouldn't need me to protect them from my identity being used in an unauthorized way.

Re: It's still easy for anyone to become you at Experian

#283

Post by reb »

Aeolun wrote: post #264
saagarjha wrote: post #245

Earlier quoted context omitted.

Excuse me, you're calling me a scammer? I suggest you click on my username and see that it is a very legitimate account, with twice the karma as you to boot. I think you're more likely to be the one scamming! Don't listen to 'Aeolun, everyone!

Look, you are literally posting on the internet, on an anonymous account, that if someone sends you their personal details and credit card info everything will be taken care of. Your first reaction should absolutely be that it’s a scam, and only then further evaluate if it might possibly be true because this is HN. I could have potentially used the word ‘looks like’, but it’s just a matter of degree.

I think the individual you’re replying to may be lying about their identity to make a point (re: the first individual asking a stranger to send them financial info) :)

Re: It's still easy for anyone to become you at Experian

#284

Post by Aaargh20318 »

xienze wrote: post #252
Aaargh20318 wrote: post #235

Earlier quoted context omitted.

The whole credit rating system as it is in the US seems complete ass-backwards to me. It basically encourages people to go into debt to build a history of paying it back in time. Here in the Netherlands it works exactly the opposite: the best 'rating' is to not be in the system at all. When you get a loan, the amount and monthly payments are registered. This registration is removed once you have paid back the loan. W…

> It basically encourages people to go into debt to build a history of paying it back in time. How do you propose a third party can establish your ability AND desire to pay back a loan, i.e., determine how much risk there is in lending to you? > As such there is no such thing as a good or bad rating, only what you can and cannot afford. This is a completely naive line of thinking. Maybe you CAN afford a loan, but WIL…

> How do you propose a third party can establish your ability AND desire to pay back a loan

Ability is simply by asking for a recent payslip. For things like mortgages they usually ask for a signed statement from the employer as well (they declare that if employee continues to function as (s)he has been they have no intention to end their employment).

Desire doesn’t really factor into it. If you don’t pay your debt they will get their money one way or the other. Personal bankruptcy is not a thing over here, you cannot walk away from debt.

> Maybe you CAN afford a loan, but WILL you pay it back?

Of course you will, you have little choice. Worst case they get a judge to simply take it out of your paycheck.

Re: It's still easy for anyone to become you at Experian

#285

Post by supertofu »

notahacker wrote: post #146
supertofu wrote: post #124

Earlier quoted context omitted.

There must have been, else I wouldn't be in this situation.

Or they could just have a similar gmail address they frequently get wrong (or that looks like yours when written in the terrible handwriting they fill in forms with) There's probably a single digit number of people with my initial and surname in the world, and I still get order confirmations for one of them, car promotions for another and am on some sort of targeted B2B spam list for a third to my Gmail address in th…

it's the exact same email, only with "googlemail.com" as the extension.

Re: It's still easy for anyone to become you at Experian

#286

Post by Thorrez »

xvector wrote: post #180
Thorrez wrote: post #177

Earlier quoted context omitted.

Fines for what? For getting hacked?

This isn't a "hack," this is pure almost malicious incompetence by everyone in the Experian security chain, straight up to the CISO herself. They should absolutely be fined and punished harshly even beyond that. If SBF can go to prison, so can the CISO of Experian.

>malicious incompetence by everyone in the Experian security chain

How do we know it's malicious and not just regular incompetence? Hanlon's razor and all.

My question was related to this quote:

>the GDPR has fines of up to 4% of global turnover.

I was asking what GDPR has fines on. Does it have fines for incompetence? snthd claimed that "this issue (verification by SSN) doesn't affect GDPR-land" saying GDPR-land somehow prevents this with a specific fine. I'm wondering what the specific fine is that GDPR-land has that prevents this issue.

Re: It's still easy for anyone to become you at Experian

#287

Post by ledgerific »

I think a tit for tat system could help. Anyone which views your info should also allow you to view theirs. Regardless if you work for some legitimized cause or not. This should be codified into law and should be punishable via a fine/debt which could not be canceled(gov loans, taxes).

Re: It's still easy for anyone to become you at Experian

#288

Post by michpoch »

alistairSH wrote: post #281
michpoch wrote: post #275

Earlier quoted context omitted.

> The same way they do for people who aren’t from the US? Some combination of name, address, birthdate, etc. Plenty of countries have SSN-like numbers: https://en.wikipedia.org/wiki/National_identification_number It's really not that special. > But the problem isn’t using the SSN as a semi-unique ID. It’s using it for that and also assuming it’s secret. SSN shouldn’t be any more secret than name or address (and shoul…

Shouldn't it be trivial to sue any institution that uses SSN as a way to confirm your identity? You’d think, yet here we are, with one of the big three credit agencies letting people steal/resteal accounts with nothing more than some public info.

Isn't that like a classic American moment when you sue them and become a millionaire?

Re: It's still easy for anyone to become you at Experian

#289

Post by ryandrake »

judge2020 wrote: post #201
ryandrake wrote: post #199

Earlier quoted context omitted.

Absolutely. We should be able to successfully sue credit rating agencies for monetary damages if they tell a lender false information about us and it causes us to not get a loan or have a higher rate than is warranted. It should not matter whether they know it’s false. The harm happens regardless of whether they were negligent or malicious.

This sets a dangerous precedent. If you won, it would apply to all defamation/libel/slander cases, not just credit reporting agencies. News agencies could be sued for saying anything about someone if it later turned out to be false. Defamation laws are already on the brink of unconstitutionality.

This doesn't seem like a bad thing. If I say something untrue about you, and that causes you to suffer damages, you should be able to come after you for those damages, regardless of whether I am a credit rating agency, a journalist, or a regular joe.

If I said to your employer, "I'm pretty sure judge2020 is a wanted criminal," and they actually fired you over it, you should be able to successfully sue me for lost wages (or if you sued your company, they should in turn be able to go after me).

Re: It's still easy for anyone to become you at Experian

#290

Post by alistairSH »

michpoch wrote: post #288
alistairSH wrote: post #281

Earlier quoted context omitted.

Shouldn't it be trivial to sue any institution that uses SSN as a way to confirm your identity? You’d think, yet here we are, with one of the big three credit agencies letting people steal/resteal accounts with nothing more than some public info.

Isn't that like a classic American moment when you sue them and become a millionaire?

If only real life was like the movies. ;)
Post reply on HN