Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equifax’s Maddening Unaccountability

nytimes.com

Post reply on HN
Print view View original

131–140 of 238 posts

Re: Equifax’s Maddening Unaccountability

#131

Post by kevan »

duskwuff wrote: post #63
cloakandswagger wrote: post #30

Earlier quoted context omitted.

Fair enough. I more meant that after an attacker has achieved RCE, no amount of encryption or other practices can protect sensitive info in your database.

Encryption can't save you, but other practices can. Specifically: if you're working with a lot of very sensitive information, you structure your application such that there are multiple layers separating that data from the outside world. In the case of Equifax, that might mean implementing the "credit score check" as an internal service exposed through the public web servers (or whatever).

Exactly. While nothing can completely stop attackers, there are multiple techniques you can layer to slow them down. E.g:

* Credential vaults that allow only-once retrieval on application startup and only keep credentials in memory

* anomaly detectors for request patterns (suspicious payload formats, processing time, CPU/memory usage, etc),

* Honeypot records in sensitive data stores (records you know should never be accessed, if they are you've been breached)

If you're storing information this sensitive you need to be paranoid, because an attacker has a $4B incentive ($30/identity on the black market * 143 million records) to crack your systems.

Re: Equifax’s Maddening Unaccountability

#132

Post by Zagitta »

cprayingmantis wrote: post #124

So how can I stop using Equifax? Or at the very least how can I find banks or other agencies that don't use Equifax? Is there any way to stop them from hoarding all my data without my explicit consent?

You can't, you're the product not the user unfortunately.

Re: Equifax’s Maddening Unaccountability

#133

Post by ganoushoreilly »

danjoc wrote: post #120
grzm wrote: post #92

Earlier quoted context omitted.

> Struts is maintained by one person. I see nowhere in the op-ed piece where Tufekci mentions Struts or implies that she holds Struts responsible for this. She is clearly laying this at Equifax's feet, and their responsibility in their choice of software and the industry as a whole for actively pushing against better software practices and responsibility. The section you quoted is followed by: > Some number of unexpe…

She's blaming the software industry and software failure. That's Apache, and Struts. If she wanted to lay it on Equifax, she might go into the fact that the Chief Information Security Officer at Equifax holds a masters in music, https://www.hollywoodlanews.com/equifax-chief-security-offic... The people that actually "do" are Chief Peon of Cube Farms, doing whatever the boss with a music degree tells them is priority.…

"she might go into the fact that the Chief Information Security Officer at Equifax holds a masters in music,"

To be fair, I would say a third of the Infosec professionals I know have backgrounds in the ARTS (myself included). While the CISO is definitely suspect, having an arts degree doesn't make one less of an effective INFOSEC practitioner. In fact, the creative nature of those drawn to the arts has proven valuable finding creative solutions to problems within our organization.

Re: Equifax’s Maddening Unaccountability

#134

Post by ovao »

cprayingmantis wrote: post #124

So how can I stop using Equifax? Or at the very least how can I find banks or other agencies that don't use Equifax? Is there any way to stop them from hoarding all my data without my explicit consent?

To my knowledge you can't stop, per se. If you're savvy you can avoid seeking credit from any institution that pulls Equifax, by asking from what CRA(s) your report will be pulled and simply walking out if they tell you they pull Equifax. This doesn't guarantee that they won't report to Equifax, however, and it certainly doesn't guarantee that Equifax won't come up with the information by other means.

Unfortunately, also, it's safe to assume that Experian and TransUnion operate just as badly as Equifax, so attempting to live an Equifax-free existence probably isn't particularly useful. If Equifax does suffer for this leak, actually, it's a relatively safe bet that they will take security more seriously so as to better protect their interests.

Re: Equifax’s Maddening Unaccountability

#135

Post by lawpoop »

zmmmmm wrote: post #105
losteric wrote: post #88

Earlier quoted context omitted.

I still hold that this shouldn't matter to consumers. My priority of problems is * When fraud happens, banks can pass the pain and burden of proof onto consumers. * Banks use insecure SSNs for authorization; some data is used for validating eligibility, authenticating the application, and authorizing the loan. * There are minimal regulations on storing different classes of personal information (We need sarbanes-oxley…

At some level I think the banks are stuck in a conflict of interest with regard to risk. The reason we need banks and credit agencies is precisely because there is risk . If transacting parties could trust each other without an intermediary we could all just trade directly and all would be fine. So banks are actually disincentivised to create a world where risk is very low. They also don't want it to be very high. Th…

I suppose at a very high level your thesis might be true, but at a practical level, I don't think it is. The banks have simply seen it's cheaper to eat the cost of fraud (and ensure the victim has the burden of proof wherever possible) than implement stricter security measures.

This goes from the transaction terminal to the bank's server room.

Europe has had chip cards for over 20 years. In the US, it was very recently implemented; only in the past year.

It wasn't that the US banks were occupying some "sweet spot" of retail transaction risk/reward; they simply didn't want to shell out the extra bucks to send people cards with chips in them. Neither merchant nor bank wanted to pay for chip-reading terminals. So, nobody budged until just the past year.

I don't know whether it was legislation, or perhaps the growing cost of credit card fraud (i.e. card skimmers, etc), but for whatever reason, it certainly wasn't a "sweet spot". We've had chip technology for 20+ years, they just didn't want to pay for it.

Re: Equifax’s Maddening Unaccountability

#136

Post by KGIII »

cloakandswagger wrote: post #87
KGIII wrote: post #80

Earlier quoted context omitted.

I get your point but, in this case, the consumers are banks and the likes. You aren't, probably, their customer. I'm not suggesting that's right, but it is how it is.

What impetus do the banks have to change credit rating providers, especially when it would come at massive cost to themselves and probably take months if not years? The only one I can think of would be consumers refusing to open bank accounts or credit cards with them because they run Equifax checks, which seems improbable.

Right? I don't think they will change. I am biased and jaded, however.

Re: Equifax’s Maddening Unaccountability

#137

Post by jjeaff »

bparsons wrote: post #65
cloakandswagger wrote: post #50

Earlier quoted context omitted.

Common misconception. They actually do need your approval, it's just that that approval is buried in the mountains of legalese you sign whenever you sign up for a bank account, credit card or loan.

Yes, but you really have zero choice. Unless you decide that you can live without a cell phone, rental car, credit card, mortgage or bank account the rest of your life.

You can get a rental car, prepaid credit cards, and prepaid cell plans without providing your SSN. Although I'm sure a mortgage and bank account wouldn't be possible.

Re: Equifax’s Maddening Unaccountability

#139

Post by jjeaff »

jquast wrote: post #91
School-Cotton wrote: post #83

Earlier quoted context omitted.

Why would a dealership need to do a credit check if I showed up with a briefcase full of money to buy a car?

Because the patriot act. https://www.edmunds.com/car-buying/car-dealership-credit-rep... I was also very surprised to buy a car with cash, only to have a credit check required. It's a real thing. And according to this article, not required, but dealerships are confused by the language of the law and insist on running a credit check, anyway.

I think they know better, but they use it as an excuse to run your credit thus giving them more information about you as a buyer and an opportunity to sell you on their credit products (which is what they make their money on anyway).

Re: Equifax’s Maddening Unaccountability

#140

Post by jlarocco »

School-Cotton wrote: post #83
djsumdog wrote: post #73

Earlier quoted context omitted.

You also can only buy cars from individuals (dealerships run credit checks, even if you pay with cash/check/direct draft) and you probably can't get power, water, gas or Internet in your name (you'd need a roommate and have to pay them).

Why would a dealership need to do a credit check if I showed up with a briefcase full of money to buy a car?

I'm pretty sure the credit check is done automatically by the dealership software, as part of entering a person into the system to get their paperwork filled out. It's probably done to save time because 99.9% of the time it's necessary. The credit check won't stop the sale if you're paying with a briefcase full of cash or writing a check.

That said, going in with a briefcase full of cash is going to cause a lot of other problems.

Post reply on HN