Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Myequifax.com Bypasses Credit Freeze Pin

krebsonsecurity.com

Post reply on HN
Print view View original

181–190 of 206 posts

Re: Myequifax.com Bypasses Credit Freeze Pin

#181

Post by ceejayoz »

css wrote: post #91
reaperducer wrote: post #87

Earlier quoted context omitted.

United Airlines asked me to fill in a bunch of crazy password questions a few weeks ago. Things like "What's your favorite flavor of ice cream?" Well, I dunno. It depends on my mood. Or "What if your favorite vacation destination?" Another bad question because my favorite today may not be my favorite when I get back from the next place. Unfortunately they were all mandatory — there wasn't an option to pick only the s…

These are KBA questions, which are generated by a third party based on information on your credit report. For the types of questions you describe, I just use my password manager to generate random strings for each of those answers and make a note of what question each string matches with. To make sure the strings are not rejected for special characters I use passwords a la https://xkcd.com/936/

> For the types of questions you describe, I just use my password manager to generate random strings for each of those answers and make a note of what question each string matches with.

Can't do that with United.

The answers are drop-downs.

https://krebsonsecurity.com/2016/08/united-airlines-sets-min...

Re: Myequifax.com Bypasses Credit Freeze Pin

#182

Post by athenot »

spookthesunset wrote: post #167
rlucas wrote: post #52

Earlier quoted context omitted.

"Optimized for happy-path" is true, but it also reveals something pretty neat about the American financial / business climate. "Default trust" actually works in our economy. And because of that, friction can be low and things Just Work. Default trust / happy-path optimization in turn works because of the backstop of a strong legal system, fairly clear precedent, and reasonably well defined property rights. Think: UCC…

You can expand that to other systems. For example you can walk onto a city bus in many cities without proof of payment. It is assumed the vast majority of people will have paid by tapping their transit card somewhere, or purchasing and activating some mobile-based e-ticket. Same with many commuter trains. The result is faster more streamlined service for everybody. I find the cryptocurrency "space" fascinating for re…

I was initially taken aback by Moscow's gates for the subway but in restrospect they make sense and fit that model. They are (were?) gates that default to open, and stay open if you insert the token/pass. Otherwise they slam shut right in front of you. During rush hour, it's brilliantly simple as the gates just stay open as people pass through. (As a tourist, it was more "interesting" to get the occasional misfire and have it slam right in front of my legs, but that's a different story.)

Re: Myequifax.com Bypasses Credit Freeze Pin

#183

Post by tzs »

cedaratlas wrote: post #111
nkrisc wrote: post #61

Earlier quoted context omitted.

Zodiac sign? Seriously? I don't know what mine is because that is not a belief system/religion I subscribe to so I had to Google it. Turns out my birthdate must be on the border because different sources have it as a different sign. They might as well ask what color my aura is.

Better than the SS administration who ask "Where were you when 9/11 happened" or "Where were you when JFK was assassinated"...Took a screenshot of these but cant find it now. My method is picking the common questions like "what street did you grow up on" and assigning it a random/not true/or another question such as "I don't know what my favorite street is"

Speaking of the SS Administration, I ran into an annoyance with them when trying to get a replacement SS card. They would not accept any ID for which the name did not exactly match the name in the records.

So, for example, if you always went by "Ron Weasley", having your driver's license , your utility bills, your apartment lease, your animagus registration, and so on all under that name, but your name in their records was "Ronald Weasley", you would be out of luck.

Re: Myequifax.com Bypasses Credit Freeze Pin

#184

Post by Someone1234 »

jdmichal wrote: post #177
Someone1234 wrote: post #173

Earlier quoted context omitted.

> And I honestly think you're just being stubborn for some reason, because I'm pretty sure you understand the idea I'm conveying. Indeed I do, it is logistically absurd. I'm talking about replacing one piece of cardboard with a different, more secure, piece of cardboard that resolves actual problems we have today. You're talking about smartphones, tokens, calling in, and a million other complex workarounds all in the…

> Indeed I do, it is logistically absurd. I'm talking about replacing one piece of cardboard with a different, more secure, piece of cardboard that resolves actual problems we have today. You're talking about smartphones, tokens, calling in, and a million other complex workarounds all in the name of hypothetical security. And you're talking about zero improvement in security stance. You could literally implement your…

> And you're talking about zero improvement in security stance.

Rotatable consumer keys. Mitigating the danger of vendor hacks/leaks. Both at the main problems with SSNs today.

> You could literally implement your idea by just making it illegal to store SSNs, because that's the only salient point where you've improved over current state.

SSNs cannot be rotated. SSNs have already leaked. Stealing an SSN allows you to open accounts/credit/etc neither of which my proposal allows.

I'm wondering if you've even read my proposal. Either you haven't or you're pretending you haven't, in either case it seems bad faith.

> It asks for what's on the card. Also print on the card to not give the card or the number on it to anyone.

So this card of yours is identical to existing SSNs. SSN cards even contain that exact text. You need to go back to the drawing board (or just read my proposal and think about it a little).

> Physical tokens are a "something you have".

So now we're back to spending billions on physical tokens? How are you funding it.

> My proposal is literally the same mechanism by which OpenID and web tokens work...

OpenID won't scale to half a billion people, it isn't affordable or practical. Something you've already conceded, that's why you're talking about calling a phone number using your SSN-v2 secret.

> And I'm done because I don't know how to work with someone who's idea of a good security posture is give away secrets to people who ask for them.

We're on the tenth post and you still haven't even read my proposal, that isn't something in it, and you'd know that if you had taken the time to read it.

You really aren't discussing in good faith here.

Re: Myequifax.com Bypasses Credit Freeze Pin

#185

Post by exegete »

Someone1234 wrote: post #28
fhinson wrote: post #15

> SSN and DOB data is widely available for sale in the cybercrime underground on almost all U.S. citizens. This has been the reality for years, and was so well before Equifax announced its big 2017 breach. Again, I find that this only reinforces the fact that SSNs are not a useful identification system because there's nothing secure about them. Can someone explain where attackers obtain SSN/DOB data with such a wides…

The US government should replace SSNs. SSNs were never meant to be used this way. Any good replacement should start with a set of APIs specifically targeting financial institutions/credit. Give the consumer a random, easily rotatable, numeric key (e.g. "14830-29928-8921-29"). The key + API can return a unique ID, but a unique ID cannot return its corresponding key (i.e. single directional flow). The unique ID never c…

There was a good Planet Money episode on how it got to be this way. [1] The SSN maybe originally was not meant to be used this way, but starting around 1943, government agencies were required to use it when possible. [2] That's less than a decade after the first SSN's were issued.

1. https://www.npr.org/sections/money/2018/03/14/593620579/epis...

2. https://www.ssa.gov/foia/html/EO9397.htm

Re: Myequifax.com Bypasses Credit Freeze Pin

#187

Post by welder »

ratling wrote: post #70
dev1n wrote: post #4

Can we just shut down equifax already?

I will never unfreeze Equifax, regardless of what I do with the other credit agencies. I can't prevent them from collecting my information but I can prevent them from profiting off it.

You're mistaken, they still profit by selling your data. It's just banks can't retrieve your credit report to open a new account when it's locked.

Re: Myequifax.com Bypasses Credit Freeze Pin

#189

Post by mindslight »

css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

This is not a problem - it's a feature!

Whenever I'm confronted with surveillance-based "identification" and I'm unable to just choose a better option like receiving a letter in the mail, I make sure to only answer questions that can be directly deduced from the basic information I've already entered, or otherwise researched online (like the ones about what street is in what city). When confronted with questions about past addresses and whatnot, I make sure to answer "don't know" lest I confirm something they actually aren't so sure of.

I haven't had any problems as a result of doing this. I wouldn't be surprised if there is some "confidence" score based on how much the surveillance databases have actually recorded about you, and even if they aren't super confident will still supply a pass result to keep the client from losing customers.

Re: Myequifax.com Bypasses Credit Freeze Pin

#190

Post by thaumasiotes »

Trisell wrote: post #174
thaumasiotes wrote: post #169

Earlier quoted context omitted.

> the need to verify citizenship, verify that you aren’t a terrorist and verify that you are a drug lord laundering money One day these requirements are going to get out of hand. :D

Heh. I’m not saying they are or aren’t out of control. My point is that when the government creates all of the requirements, and the onus is on the banks to verify it all. At risk of penalties from the government. Then you get these kind of stories. People see it as overkill. The banks see it as CYA.

I basically agree with you on the issue; I was just making a cheap joke about the supposed requirement for the bank to verify that you are [as opposed to aren't] a drug lord.
Post reply on HN