Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Myequifax.com Bypasses Credit Freeze Pin

krebsonsecurity.com

Post reply on HN
Print view View original

141–150 of 206 posts

Re: Myequifax.com Bypasses Credit Freeze Pin

#141

Post by jdsully »

ModernMech wrote: post #140
jdsully wrote: post #134

Earlier quoted context omitted.

Congressional hearings are about informing law makers (and also for grandstanding). They are not intended to provide immediate results in the way a trial would. The results if any will be in the form of legislation at a later date.

Results can come a lot sooner and more incrementally than that. For example, there were congressional hearings very recently involving Michael Cohen and merely days later, document requests were issued as a result of the statements he made during he hearing. So where are the inquiries? Where are the task forces? Where are the subpoenas? Where are the subcommittees? It's been over a year. Are you confident with "chang…

Oh I'm not at all confident changes will come. If the hearings aren't convincing enough to members of congress then nothing at all will happen. It seems like that was the case with congress as it existed at the time of the hearings. Perhaps things are different now that we are post-election and the makeup is different.

My point is one shouldn't expect immediate effects from a congressional hearing. They are merely the start of a long process that can get derailed at many points along the way.

Re: Myequifax.com Bypasses Credit Freeze Pin

#142

Post by astura »

fhinson wrote: post #15

> SSN and DOB data is widely available for sale in the cybercrime underground on almost all U.S. citizens. This has been the reality for years, and was so well before Equifax announced its big 2017 breach. Again, I find that this only reinforces the fact that SSNs are not a useful identification system because there's nothing secure about them. Can someone explain where attackers obtain SSN/DOB data with such a wides…

ID-Theft as a service with the source being stolen and otherwise illegitimately obtained data

https://krebsonsecurity.com/2013/10/experian-sold-consumer-d...

>An identity theft service that sold Social Security and drivers license numbers — as well as bank account and credit card data on millions of Americans — purchased much of its data from Experian, one of the three major credit bureaus, according to a lengthy investigation by KrebsOnSecurity.

>An individual who read a story about the operators of a similar ID theft service online having broken into the networks of LexisNexis and other major data brokers wrote to say that he’d gone back and reviewed my previous stories on this topic, and that he’d identified the source of the data being resold by Superget.info. The reader said the abbreviations matched data sets produced by Columbus, Ohio-based USInfoSearch.com.

>Contacted about the reader’s claim, U.S. Info Search CEO Marc Martin said the data sold by the ID theft service was not obtained directly through his company, but rather via Court Ventures, a third-party company with which US Info Search had previously struck an information sharing agreement. Martin said that several years ago US Info Search and CourtVentures each agreed to grant the other company complete access to its stores of information on US consumers.

>Founded in 2001, Court Ventures described itself as a firm that “aggregates, repackages and distributes public record data, obtained from over 1,400 state and county sources.” Cached, historic copies of courtventures.com are available through archive.org.

>In March 2012, Court Ventures was purchased by Costa Mesa, Calif.-based Experian, one of the three major consumer credit bureaus. According to Martin, the proprietors of Superget.info had gained access to Experian’s databases by posing as a U.S.-based private investigator. In reality, Martin said, the individuals apparently responsible for running Superget.info were based in Vietnam.

Re: Myequifax.com Bypasses Credit Freeze Pin

#143

Post by refurb »

ModernMech wrote: post #119
jjeaff wrote: post #104

Earlier quoted context omitted.

I'm normally not a fan of congressional hearings where everyone is trying to grandstand, but this one was particularly good. The congresswoman asked the Equifax CEO to provide his birthday and social security number publicly for the record. He of course refused and when asked why, he said because that is sensitive information. All the while, Equifax attorneys are arguing in court that there is no harm in leaking priv…

That's all well and good, but what was the concrete result of the hearing? Nothing actually happened and Equifax continues merrily along doing what it's always done.

That's all well and good, but what was the concrete result of the hearing?

Some politicians got an opportunity to issue strong statements that they can later leverage during reelection?

Re: Myequifax.com Bypasses Credit Freeze Pin

#144

Post by wtallis »

mikestew wrote: post #114
ams6110 wrote: post #31

Earlier quoted context omitted.

So you want someone to write three paragraphs for what can be said in six words? I prefer the brevity.

Yes, I'd like to see someone demonstrate that they put some thought into the idea of what happens when, say, credit reporting agencies are eliminated or curtailed. What would be the negative repercussions, etc. In contrast to a low-effort farting of "break 'em up!" for karma. That doesn't bring anything new to the conversation.

It seems like you're arguing against a pithy call to shut down credit reporting agencies in general, when the comment at issue was specifically directed at the credit reporting agency that has the worst public track record for security and privacy. It's like if you had asked "but how will the economy function without accountants?" in response to the dismantling of Arthur Andersen, or asked how online banking could survive without Symantec SSL/TLS certificates.

The consequences of shutting down just Equifax are relatively mundane: lenders and other customers of Equifax take their business elsewhere, and Equifax's competitors have some motivation to be a bit better lest they suffer the same fate. The industry as a whole would get along just fine. The less realistic and more extreme hypothetical that you want to debate is irrelevant here.

Re: Myequifax.com Bypasses Credit Freeze Pin

#145

Post by Klathmon »

astura wrote: post #106
mherdeg wrote: post #33

A real-life attack based on this kind of hole was discussed at https://www.reddit.com/r/personalfinance/comments/ay7aoy/ide... : someone says that an identity thief who knows all their knowledge-based question answers (because they have a copy of a credit report, no doubt) keeps somehow removing the freeze and committing more fraud.

Some KBA questions don't show up on your credit report, that being said, they can still be guessed with some certainty if you know the person. Some examples either me or my husband have gotten: -What month was [person] born? [person] was my mom and one option was "I don't know [person]." Luckily they didn't ask the date, because I don't know that, but I do know the month. -Which of the following people are/were you a…

Here's a fun one for you!

When I was a kid I was briefly a ward of the court. During that time, I had an official address that was not where I actually lived, and somehow the credit bureaus got ahold of that information.

So whenever I need to answer the suite of questions for identity verification, if I get the "which of these places have you lived", there's a good chance I won't know the answer, because I was a kid and never actually lived there.

So when that happens, I guess at one of the addresses, inevitably get it wrong, fail my own identity verification process, and need to jump through a ton of hoops to either re-try the process and hope I don't get that question, or verify my identity another way.

Re: Myequifax.com Bypasses Credit Freeze Pin

#146

Post by macNchz »

astura wrote: post #106
mherdeg wrote: post #33

A real-life attack based on this kind of hole was discussed at https://www.reddit.com/r/personalfinance/comments/ay7aoy/ide... : someone says that an identity thief who knows all their knowledge-based question answers (because they have a copy of a credit report, no doubt) keeps somehow removing the freeze and committing more fraud.

Some KBA questions don't show up on your credit report, that being said, they can still be guessed with some certainty if you know the person. Some examples either me or my husband have gotten: -What month was [person] born? [person] was my mom and one option was "I don't know [person]." Luckily they didn't ask the date, because I don't know that, but I do know the month. -Which of the following people are/were you a…

>I've also been asked about the previous cars I've owned, which are from DMV and insurance databases, not credit reports.

I've had online car insurance instant-quote systems show me a list including both my current and previously owned cars with just a name and address, so that's encouraging that it's being used as a critical authentication measure.

Re: Myequifax.com Bypasses Credit Freeze Pin

#147

Post by benatkin »

I lost my PIN since I moved twice after freezing my credit and apparently didn't store it in my computer. I was able to temporarily lift my security freeze without it, and I found it convenient but a bit unsettling. Glad I'm not the only one.

Re: Myequifax.com Bypasses Credit Freeze Pin

#148

Post by astura »

simantel wrote: post #139
astura wrote: post #127

Earlier quoted context omitted.

This was around... Oh... 8-9 years ago and I'm still trying to figure it out. It's honestly bothered me since then. I just really want to know how they connected us. I'm not mad they did, I just want to know how. We never had an insurance policy together or anything else like that either.

Did you list them as the beneficiary of any retirement accounts or insurance policies, or maybe as an emergency contact somewhere that reports to credit bureaus?

Emergency contact, that's possible...

Beneficiary, certainly not, I was in college, broke as fuck, and living on student loans, didn't have any sort of assets to speak of (besides a $900 car), no retirement accounts or insurance policies (besides the minimum liability insurance required by the state).

Re: Myequifax.com Bypasses Credit Freeze Pin

#149

Post by mynameisvlad »

css wrote: post #60
rlucas wrote: post #47

Earlier quoted context omitted.

The bank itself is probably not doing the KBA; they're buying and integrating a KBA dialogue solution from one of the vendors. So might be the same software / font / question bank at work.

Correct about the software most likely, but Discover uses FF-Meta [0] and Ally uses Lato [1]. They are admittedly quite similar. [0] https://fonts.adobe.com/fonts/ff-meta [1] https://fonts.google.com/specimen/Lato

I think what rlucas is saying is that the reason the font might be the same is that the bank implemented the solution straight up; without any of the styling that would usually be applied. I've definitely seen this and worse before, so it's not exactly out of the realm of possibility.

Re: Myequifax.com Bypasses Credit Freeze Pin

#150

Post by russh »

css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

It has nothing to do with security only plausible deniability.
Post reply on HN