Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Experian Sold Consumer Data to ID Theft Service

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 82 posts

Re: Experian Sold Consumer Data to ID Theft Service

#61

Post by usefulcat »

cptskippy wrote: post #52

I did a double take when I saw this because I've been in contact with Equifax recently because I started receiving SPAM form a non-existent email address that I shared with them. I have a Catch-all address setup on my Domain so that I can give every site I interact with their own custom email address. In this case it was equifax.com@mydomain.com. Since the email address doesn't exist, and they're the only company I'v…

I do the same thing (using unique email addresses) and over the years several such addresses have been aquired by spammers one way or another. Until recently, it was mainly smaller sites and businesses that this happened with. But I was quite surprised when I started getting spam at the unique address I gave to Dropbox.

Re: Experian Sold Consumer Data to ID Theft Service

#63

Post by breischl »

GFischer wrote: post #53
kd0amg wrote: post #50

Earlier quoted context omitted.

Hold on, do you mean an ID number or an ID card? As far as I can tell, the Cédula de Identidad you mention is a card, not just a number. Numbers are pretty much always trivial to duplicate. Checking a physical document kind of requires a face-to-face transaction.

Sorry, I meant ID card, you are correct. And I agree that numbers are easy to duplicate. I'm not from the U.S., but I've read a lot of criticism about the SSN, for example: http://www.theverge.com/2012/9/26/3384416/social-security-nu... "In 2009, researchers developed an algorithm that could guess an individual’s SSN with up to ten percent accuracy" "SSNs have become available through data resellers, security breache…

Certainly SSN could be improved by making them harder to guess and adding check digits. Other than that, I don't see how any other number scheme is any better. Ultimately there is some number that is associated with you, and is therefore useful for identity theft. Since it has to be used by people and not just computers it'll have to be relatively short and thus easy to steal.

Multiple identifiers per person is a feature, not a bug. People get new SSNs when they want to change their identity (eg, witness protection programs), or because someone stole their old one. That need doesn't go away just because you have a new numbering system.

Re: Experian Sold Consumer Data to ID Theft Service

#64

Post by klipt »

johntb86 wrote: post #13
carbocation wrote: post #5

Earlier quoted context omitted.

Going back a step, why should Experian have data on you?

How else would credit history (and credit in general) work?

Well for a start they could stop using your immutable SSN as both your username and password.

That's like your gmail password being your address, oh and by the way you can never change it.

Re: Experian Sold Consumer Data to ID Theft Service

#65

Post by morrad »

bullseye wrote: post #42
callmeed wrote: post #28

Earlier quoted context omitted.

I don't disagree with you–but it can be frustrating to know you've improved both your responsibility and your earning power yet only be judged by the past. For example, I've paid cash for the last 5 cars our family has purchased over the last 6 years. Why doesn't my ability to do that apply to my credit-worthiness? Small things like that annoy me about the agencies/system. Also, the median home price where we live is…

> For example, I've paid cash for the last 5 cars our family has purchased over the last 6 years. Why doesn't my ability to do that apply to my credit-worthiness? Because paying cash once for something is the opposite of proving credit-worthiness. You haven't proven an ability to uphold your end of a long-term agreement. If you want to improve your credit, finance those cars. Make payments for about 6 months and then…

There are better (less expensive) ways to build credit than car loans.

While I don't remember the name, my wife and I built credit getting some sort of secured loan from our local credit union. The process was something along the lines of making an account with them, putting $X into the account, and then getting a 6 or 12 month loan from them for the same $X dollars at a really low interest rate. Overall I think we paid $30 to $50 dollars over that period in interest.

Re: Experian Sold Consumer Data to ID Theft Service

#66

Post by bstpierre »

useful wrote: post #57
johnchristopher wrote: post #30

Earlier quoted context omitted.

Why is the house "depreciated in value at all" ? I don't understand that part.

all structures depreciate, eventually it will fall down. It requires maintenance to keep the same value. This is one reason most people will tell you to never buy a condo. Land is finite and does not depreciate.

> Land is finite and does not depreciate.

The value of land can definitely depreciate. Perhaps not in [sub]urban areas so much, but in rural areas the value of land can be tied to things like timber, water, or mining. If I buy some acreage and extract timber/sand/gravel/etc, that land is going to have a lower resale value.

Or maybe I buy prime farmland and then crop the soil until it is dead.

Or instead of extracting stuff, I leave bad stuff behind (persistent pollution -- lead, mercury, etc).

For something more [sub]urban, consider the case where a new highway is built to route traffic around a city instead of through it, and a previously viable commercial location becomes worthless because the traffic count drops to near-zero.

Re: Experian Sold Consumer Data to ID Theft Service

#67

Post by unclebucknasty »

bullseye wrote: post #42
callmeed wrote: post #28

Earlier quoted context omitted.

I don't disagree with you–but it can be frustrating to know you've improved both your responsibility and your earning power yet only be judged by the past. For example, I've paid cash for the last 5 cars our family has purchased over the last 6 years. Why doesn't my ability to do that apply to my credit-worthiness? Small things like that annoy me about the agencies/system. Also, the median home price where we live is…

> For example, I've paid cash for the last 5 cars our family has purchased over the last 6 years. Why doesn't my ability to do that apply to my credit-worthiness? Because paying cash once for something is the opposite of proving credit-worthiness. You haven't proven an ability to uphold your end of a long-term agreement. If you want to improve your credit, finance those cars. Make payments for about 6 months and then…

>Because paying cash once for something is the opposite of proving credit-worthiness. You haven't proven an ability to uphold your end of a long-term agreement.

This is absolutely true under the current system. But, I think the parent is actually questioning the rationale behind the current system.

I agree to some extent. Accruing, then using significant cash-on-hand to make multiple large purchases should speak more than it currently does to the customer's financial responsibility and/or wherewithal. It's also potentially evidence of his/her earning ability. All of these should contribute more to the determination of a person's "credit-worthiness".

The current system is punitive for those who generally don't like debt, but recognize its necessity for large purchases (i.e. especially for homes). Debt elimination/avoidance is a sound and oft-recommended personal financial practice, which should show sound financial judgement. Why is there a penalty for subscribing to it?

Of course the credit-reporting bureaus profit tremendously by upholding the current system as it is. Their biggest customers as well as their source of information/power are the creditors themselves.

Re: Experian Sold Consumer Data to ID Theft Service

#68

Post by AsymetricCom »

dan1234 wrote: post #34
mindslight wrote: post #18

Except there's actually no such thing as "identity theft" - it's a mere figment of the credit industry's (tracking industry's) fantasy in which they're omniscient, and an attempt to slowly push the responsibility for bank fraud onto uninvolved third parties. In reality, some would-be bank fraudsters got ahold of some non-secret information.

The UK police[0] define identity theft as when personal details are stolen and identity fraud as when those details are used to commit fraud. http://www.actionfraud.police.uk/fraud_protection/identity_f...

Comanies that facilitate identity-based services should be charged as accomplices then, as well as receiving stolen goods.

Re: Experian Sold Consumer Data to ID Theft Service

#69

Post by eropple »

hnriot wrote: post #59
cptskippy wrote: post #52

I did a double take when I saw this because I've been in contact with Equifax recently because I started receiving SPAM form a non-existent email address that I shared with them. I have a Catch-all address setup on my Domain so that I can give every site I interact with their own custom email address. In this case it was equifax.com@mydomain.com. Since the email address doesn't exist, and they're the only company I'v…

that's not exactly a difficult email address to guess, I would think that in this case (specifically this case) equifax would have a very good claim that it wasn't them that leaked it. If instead you had used a hash or something unguessable then you might have a case, but I could easily go and sign up to my favorite nigerian viagra supplier with all the usual suspects facebook@yourdomain.com, airbnb@yourdomain.com...…

Agreed--this is why I append a few random characters to the end of my catchalls when I set them up. Not a hash or anything, but the likelihood of someone guessing a few characters blindly hit on the keyboard is low.

Re: Experian Sold Consumer Data to ID Theft Service

#70

Post by cptskippy »

hnriot wrote: post #59
cptskippy wrote: post #52

I did a double take when I saw this because I've been in contact with Equifax recently because I started receiving SPAM form a non-existent email address that I shared with them. I have a Catch-all address setup on my Domain so that I can give every site I interact with their own custom email address. In this case it was equifax.com@mydomain.com. Since the email address doesn't exist, and they're the only company I'v…

that's not exactly a difficult email address to guess, I would think that in this case (specifically this case) equifax would have a very good claim that it wasn't them that leaked it. If instead you had used a hash or something unguessable then you might have a case, but I could easily go and sign up to my favorite nigerian viagra supplier with all the usual suspects facebook@yourdomain.com, airbnb@yourdomain.com...…

This is a classic case of engineering a solution to a problem that doesn't exist.

The first question you have to ask your self is for what reason would anyone choose to do that? Shits-and-giggles and malice against me personally are about the only legitimate reasons someone would do that.

Spammers wouldn't want my dummy addresses in their list, and harvesters who sell emails to spammers wouldn't either because I could easily invalidate swaths of their lists by disabling my catch-all giving them a bad reputation.

I mainly do this to see how my email address gets around. If and when I contact a company about my email address receiving SPAM, I don't name and shame in any public capacity. Its of little consequence how they respond because the damage is done, its not like they can undo the SPAM.

Post reply on HN