171–180 of 347 posts
What even is the CISO doing? Sitting on her thumbs for a year?
It's not just Experian. We publish an article every couple years or so with the same content and just the names changed: https://qbix.com/blog/2021/01/25/no-way-to-prevent-this-says... https://qbix.com/blog/2023/06/12/no-way-to-prevent-this-says... And then of course there is this: SIM swapping - someone can just steal your SIM and then get into a lot of accounts https://www.bloomberg.com/news/features/2023-08-04/tee…
How is Experian not sued out of existence for their total failure to protect their customers? I just don’t understand what law allows organizations that compromise large portions of entire societies to continue.
Earlier quoted context omitted.
“The credit agencies however offer you a real and valuable service. Without credit history it’s impossible to get credit.” I think I generally agree that this is a reasonable service, however the main reason you can’t get credit without a credit history is these services exist that can provide credit history to lenders. It is bizarre to think that loans would not exist without these services.
Loans did exist before credit, but it was almost always loans from friends/family or by providing a large down payment to the bank you wanted a loan from. You needed to be a known and upstanding member of the community to get a loan for anything substantial. And technically, you can get many loans today without a credit score. For example, there are bank statement mortgage loans, but they have caveats like: - you wil…
https://news.ycombinator.com/item?id=29834753 I was shocked to learn that last year about the level of detail they had. 1. All your mortgage, credit inquiries and bank account names 2. All your previous addesses and perevious employers 3. Your MONTHLY salary and combined comp per yer going back to 20XX when I came to the US. 4. Dates of employment per employer, bonus, overtime, RSU comp Does Experian and Transunion h…
You work at a big company. Your employer is choosing to sell this information to credit bureaus.
I first learned about this practice in the mid-2000s. Like you, I was quite surprised, but they didn't have any data on my own income or assets yet, and I resolved never to work for an employer that would engage in this type of business practice.
I think employers should be legally required to disclose and obtain written consent to sell your income data, but beyond that point, it's really on you to decide what employment arrangements you are willing or unwilling to accept. It's sad that you had to find out this way given how easy it would be for these employers to just disclose it upfront. I'd recommend looking for a different employer.
I’m guessing this will continue to happen until, I dunno, some the execs at Experian continually have their accounts compromised in the same way again and again.
The execs may be incompetent, they're probably not stupid, though- they don't use that shit.
The fundamental issue here is that maintaining security is expensive, and it is cheaper to just deal with occasional hacks. The only solution is to make hacks extremely expensive to the companies that get hacked — through fines as well as lawsuits by victims of identity theft.
>The only solution is to make hacks extremely expensive to the companies that get hacked — through fines as well as lawsuits by victims of identity theft. It's notable this issue (verification by SSN) doesn't affect GDPR-land - the GDPR has fines of up to 4% of global turnover.
FWIW 1. Freeze all your credit with experian, equifax and transunion 2. Opt out of them selling your info: https://consumerprivacy.experian.com/ https://myprivacy.equifax.com/opt-in-opt-out/personal-info https://service.transunion.com/dss/ccpa_optout.page
Earlier quoted context omitted.
It is not that expensive. It is a couple pennies per pull (of a credit report/file) for somebody seeking identity proofing to use knowledge based authentication (the usual “where did you live, are these trade lines you?”). It is $1.50-$2.00 per proofing attempt with the government credential using ID.me or stripe identity. The problem is that no one is incentivized to slightly increases costs to reduce fraud because…
ID.me supports hardware 2FA, including Yubikey.
Earlier quoted context omitted.
>The only solution is to make hacks extremely expensive to the companies that get hacked — through fines as well as lawsuits by victims of identity theft. It's notable this issue (verification by SSN) doesn't affect GDPR-land - the GDPR has fines of up to 4% of global turnover.
Fines for what? For getting hacked?
They should absolutely be fined and punished harshly even beyond that. If SBF can go to prison, so can the CISO of Experian.