Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's still easy for anyone to become you at Experian

krebsonsecurity.com

Post reply on HN
Print view View original

301–310 of 347 posts

Re: It's still easy for anyone to become you at Experian

#301

Post by seanmcdirmid »

cmutel wrote: post #237
namdnay wrote: post #209

Earlier quoted context omitted.

“Everything works just fine” It definitely worked great for a lot of dictators, tax cheats and the sort… I think Switzerland is a great example of why complete privacy isn’t fair on ordinary taxpayers - it allows the ultra-rich to hide what they owe

I'm an American living in Switzerland for over 10 years, and this was definitely my impression as well. But that isn't really the case anymore here - you can no longer have anonymous (i.e. only numbered) accounts, and Switzerland is no longer a preferred locations for dirty money. The ironic thing is that one of those new hot spots, in addition to the usual suspects like Cyprus, the Caribbean, etc., is the USA. See h…

FACTA would only apply to Americans and permanent residents right? It isn’t hard to imagine that America is a good place for non-Americans to stash money, but that trick really wouldn’t work for Americans themselves. For example, the Canadian and American housing markets have been a good place to launder dirty or gray Chinese money into real estate.

Re: It's still easy for anyone to become you at Experian

#302

Post by seanmcdirmid »

nulbyte wrote: post #253
michpoch wrote: post #247

Earlier quoted context omitted.

What's the issue with SSN being an ID?

It was creating for the purpose of tracking an individual's account by the Social Security Administration. It later became a de facto identifier and, even worse, is many times abused as a form of authentication, but it was never designed to be either. As a result, we have processes that ask for or require a social security number that aren't even related to the purpose for which it was created: Health care, loans, de…

My first driver license from Mississippi in 1990 used my SSN as my driver license number…so anyone who saw my ID knew my SSN.

Re: It's still easy for anyone to become you at Experian

#303

Post by maxerickson »

noSyncCloud wrote: post #271
michpoch wrote: post #256

Earlier quoted context omitted.

It still sounds like a good way to uniquely identify a person? How else would an institution confirm that it's talking about the same person?

It's a terrible way to uniquely identify a person; it was never designed as such. For instance, there aren't nearly enough of them – they get re-issued all the time.

They don't get reused. See Q20:

https://www.ssa.gov/history/hfaq.html

Re: It's still easy for anyone to become you at Experian

#304

Post by kccqzy »

Aaargh20318 wrote: post #284
xienze wrote: post #252

Earlier quoted context omitted.

> It basically encourages people to go into debt to build a history of paying it back in time. How do you propose a third party can establish your ability AND desire to pay back a loan, i.e., determine how much risk there is in lending to you? > As such there is no such thing as a good or bad rating, only what you can and cannot afford. This is a completely naive line of thinking. Maybe you CAN afford a loan, but WIL…

> How do you propose a third party can establish your ability AND desire to pay back a loan Ability is simply by asking for a recent payslip. For things like mortgages they usually ask for a signed statement from the employer as well (they declare that if employee continues to function as (s)he has been they have no intention to end their employment). Desire doesn’t really factor into it. If you don’t pay your debt t…

I still don't understand. Of course getting a judge to take it out of your paycheck is possible in America too. But preferably before a bank loans you money, they want to determine whether they can rely on you paying back on your own or whether there's a high likelihood they will get a judge involved? What if the bank doesn't want the hassle of involving a judge? How do you even measure the probability of needing to get a judge involved? Then it's back to credit scores.

Re: It's still easy for anyone to become you at Experian

#305

Post by everforward »

nulbyte wrote: post #255
9991 wrote: post #154

Earlier quoted context omitted.

> The person has had their credit rating damaged This is called libel. This person is a victim of a crime the credit reporting agency committed.

Libel is an intentional act. Agencies are not intentionally reporting false information. Banks may be reporting false information, but even they are unaware until the fraud has been discovered, by which time information they thought was true has already been reported.

Libel can be intentional or a reckless disregard for the truth. I don't know what the courts would interpret that standard to be here.

Re: It's still easy for anyone to become you at Experian

#306

Post by Aaargh20318 »

kccqzy wrote: post #304
Aaargh20318 wrote: post #284

Earlier quoted context omitted.

> How do you propose a third party can establish your ability AND desire to pay back a loan Ability is simply by asking for a recent payslip. For things like mortgages they usually ask for a signed statement from the employer as well (they declare that if employee continues to function as (s)he has been they have no intention to end their employment). Desire doesn’t really factor into it. If you don’t pay your debt t…

I still don't understand. Of course getting a judge to take it out of your paycheck is possible in America too. But preferably before a bank loans you money, they want to determine whether they can rely on you paying back on your own or whether there's a high likelihood they will get a judge involved? What if the bank doesn't want the hassle of involving a judge? How do you even measure the probability of needing to…

Obviously it’s a last resort. The point is that someone who can afford to pay and doesn’t is very uncommon as this would cause a lot of trouble for the person in question.

Re: It's still easy for anyone to become you at Experian

#307

Post by vharuck »

CWuestefeld wrote: post #296
nulbyte wrote: post #253

Earlier quoted context omitted.

It was creating for the purpose of tracking an individual's account by the Social Security Administration. It later became a de facto identifier and, even worse, is many times abused as a form of authentication, but it was never designed to be either. As a result, we have processes that ask for or require a social security number that aren't even related to the purpose for which it was created: Health care, loans, de…

> some citizens of certain religious sects, like the Amish, do not have social security numbers. Fun story: many years ago, I worked on some consumer tax prep software. Specifically because of the Amish, the SSN field was optional. Imagine that - an Amish person using tax prep software.

Some Amish/Mennonite sects have exceptions for business, so I'll sometimes see them with cell phones. Tax software would probably fall under that exception. Honestly, I'm more amazed any company spent time catering to such a small portion of the market.

Re: It's still easy for anyone to become you at Experian

#308

Post by vharuck »

michpoch wrote: post #256
nulbyte wrote: post #253

Earlier quoted context omitted.

It was creating for the purpose of tracking an individual's account by the Social Security Administration. It later became a de facto identifier and, even worse, is many times abused as a form of authentication, but it was never designed to be either. As a result, we have processes that ask for or require a social security number that aren't even related to the purpose for which it was created: Health care, loans, de…

It still sounds like a good way to uniquely identify a person? How else would an institution confirm that it's talking about the same person?

Some people (especially older women) don't know their own SSN, just their husbands'. If they never had a job, there wasn't much use for an SSN. And if their spouse passed away, they always had to use the deceased's SSN to collect survivor's benefits (or whatever it's called).

I've seen it more than once when working with health records: two people have the exact same SSN, but different sex. If I need to match records, I'll use SSN and birthdate, knowing even that's not immune to errors.

Re: It's still easy for anyone to become you at Experian

#309

Post by evilduck »

CWuestefeld wrote: post #296
nulbyte wrote: post #253

Earlier quoted context omitted.

It was creating for the purpose of tracking an individual's account by the Social Security Administration. It later became a de facto identifier and, even worse, is many times abused as a form of authentication, but it was never designed to be either. As a result, we have processes that ask for or require a social security number that aren't even related to the purpose for which it was created: Health care, loans, de…

> some citizens of certain religious sects, like the Amish, do not have social security numbers. Fun story: many years ago, I worked on some consumer tax prep software. Specifically because of the Amish, the SSN field was optional. Imagine that - an Amish person using tax prep software.

I’m no Amish expert but I lived near them for a while and it seems to be more about how they choose to lead their lives and there’s a (fuzzy) line between ownership and usage of technology. I’d bet many would be quite fine with using tax software on someone else’s computer. They’ll also use a contractor’s power tools, ride in someone else’s car, own flashlights, etc.

Re: It's still easy for anyone to become you at Experian

#310

Post by meowtimemania »

Aaargh20318 wrote: post #235
munk-a wrote: post #220

The fact that we haven't nationalized credit reporting absolutely baffles me. These companies have so much power over our lives, are completely unaccountable, and are so incredibly incompetent.

The whole credit rating system as it is in the US seems complete ass-backwards to me. It basically encourages people to go into debt to build a history of paying it back in time. Here in the Netherlands it works exactly the opposite: the best 'rating' is to not be in the system at all. When you get a loan, the amount and monthly payments are registered. This registration is removed once you have paid back the loan. W…

Makes a lot of sense to me. Are people penalized in some way for a history of mis-spending their money? For example, an individual who could afford a loan in theory, but gambles away all their money at a casino and misses loan payments.
Post reply on HN