Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Myequifax.com Bypasses Credit Freeze Pin

krebsonsecurity.com

Post reply on HN
Print view View original

21–30 of 206 posts

Re: Myequifax.com Bypasses Credit Freeze Pin

#21

Post by pocketstar »

SketchySeaBeast wrote: post #18
arcticbull wrote: post #12

Earlier quoted context omitted.

You’re exactly right. It’s the same reason we’re required to sign checks then the bank promptly ignores the signatures. It’s cheaper to handle the fraud than check the signatures, but it makes us feel good to do it anyways.

I wish - a few years ago I was trying to pay for rent with a cheque and it bounced. I ended up sending another cheque, having that one get rejected, go into the bank and give them a new signature sample, and then have the next cheque be rejected as well due to the signature. Apparently my bank checks cheques.

Canada? Or Common Wealth? Judging from how you spell “cheque”. Signatures still mean something in some countires, just not the US.

Re: Myequifax.com Bypasses Credit Freeze Pin

#22

Post by sevensor »

fhinson wrote: post #15

> SSN and DOB data is widely available for sale in the cybercrime underground on almost all U.S. citizens. This has been the reality for years, and was so well before Equifax announced its big 2017 breach. Again, I find that this only reinforces the fact that SSNs are not a useful identification system because there's nothing secure about them. Can someone explain where attackers obtain SSN/DOB data with such a wides…

So if everybody knows your SSN/DOB, I'd say that makes a very good identity system in the sense that we can all unambiguously refer to the same person. It's just not any use as a means of authenticating that you are the person who has that identity.

Re: Myequifax.com Bypasses Credit Freeze Pin

#23

Post by Cactus2018 »

fhinson wrote: post #15

> SSN and DOB data is widely available for sale in the cybercrime underground on almost all U.S. citizens. This has been the reality for years, and was so well before Equifax announced its big 2017 breach. Again, I find that this only reinforces the fact that SSNs are not a useful identification system because there's nothing secure about them. Can someone explain where attackers obtain SSN/DOB data with such a wides…

College and University databases.

Re: Myequifax.com Bypasses Credit Freeze Pin

#24

Post by SketchySeaBeast »

pocketstar wrote: post #21
SketchySeaBeast wrote: post #18

Earlier quoted context omitted.

I wish - a few years ago I was trying to pay for rent with a cheque and it bounced. I ended up sending another cheque, having that one get rejected, go into the bank and give them a new signature sample, and then have the next cheque be rejected as well due to the signature. Apparently my bank checks cheques.

Canada? Or Common Wealth? Judging from how you spell “cheque”. Signatures still mean something in some countires, just not the US.

Canada. I've never heard of anyone but myself experiencing this issue though.

Re: Myequifax.com Bypasses Credit Freeze Pin

#25

Post by acranox »

css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

I was also asked about my Zodiac sign. I was shocked. A credit reporting company using that is just appalling.

Re: Myequifax.com Bypasses Credit Freeze Pin

#26

Post by techsupporter »

css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

That looks like Ally Bank. --BUT, it isn't, per the reply below. It's Discover, though Ally asked me the same zodiac question in what looked like the same font.--

They won't open a joint savings account for my wife and I because my wife doesn't have a phone bill in her own name "for verification." (We've been on the same Southwestern Bell/Cingular/AT&T, recently T-Mobile, family plan for the past, oh, fifteen years, and it's under solely my name because of employer discounts.)

When I mentioned this to the rep, she told both of us--we were all on speakerphone--that my wife could send in a copy of her driver license. Except Washington doesn't require us to get new licenses when moving and the address on both of our licenses is both the same...and four years out of date.

I get the need for ID verification but funny how we never run into this problem when my wife wants to borrow money in her own name. No one has ever cared about her license or a phone bill when she's taken out credit cards.

Re: Myequifax.com Bypasses Credit Freeze Pin

#27

Post by stenioaraujo »

sevensor wrote: post #22
fhinson wrote: post #15

> SSN and DOB data is widely available for sale in the cybercrime underground on almost all U.S. citizens. This has been the reality for years, and was so well before Equifax announced its big 2017 breach. Again, I find that this only reinforces the fact that SSNs are not a useful identification system because there's nothing secure about them. Can someone explain where attackers obtain SSN/DOB data with such a wides…

So if everybody knows your SSN/DOB, I'd say that makes a very good identity system in the sense that we can all unambiguously refer to the same person. It's just not any use as a means of authenticating that you are the person who has that identity.

I do agree with you, even though SSN/DOB can be used to identify a person, it should not be used to identify a unique person [1]. As you said, Identity should not be confused with proof of identity. Hopefully it will get better with time.

[1] - https://www.pcworld.com/article/3004654/a-tale-of-two-women-...

Re: Myequifax.com Bypasses Credit Freeze Pin

#28

Post by Someone1234 »

fhinson wrote: post #15

> SSN and DOB data is widely available for sale in the cybercrime underground on almost all U.S. citizens. This has been the reality for years, and was so well before Equifax announced its big 2017 breach. Again, I find that this only reinforces the fact that SSNs are not a useful identification system because there's nothing secure about them. Can someone explain where attackers obtain SSN/DOB data with such a wides…

The US government should replace SSNs. SSNs were never meant to be used this way.

Any good replacement should start with a set of APIs specifically targeting financial institutions/credit. Give the consumer a random, easily rotatable, numeric key (e.g. "14830-29928-8921-29"). The key + API can return a unique ID, but a unique ID cannot return its corresponding key (i.e. single directional flow).

The unique ID never changes for a given individual. If the consumer's key is lost, stolen, or breached the key can be re-issued and old one expired.

Make it illegal to store the numeric key itself in a database for long periods. Only the resultant Unique ID can be held. You'd never request from the consumer the Unique ID itself (otherwise it itself would become the new SSN); only their key for API verification.

Why is this a secure system? The information companies would store (Unique ID) is not the same information they need to process a new credit requests (Key).

Meaning the piece of information that identity thieves need to steel is short lived, and the long lived info cannot convert back to the short lived.

Re: Myequifax.com Bypasses Credit Freeze Pin

#29

Post by adrr »

css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

I used to work at a fintech and seen Kba providers ask questions that provide zero security like “what county was your 1 Main Street Santa Monica,ca address located in”

Re: Myequifax.com Bypasses Credit Freeze Pin

#30

Post by techsupporter »

techsupporter wrote: post #26
css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

That looks like Ally Bank. --BUT, it isn't, per the reply below. It's Discover, though Ally asked me the same zodiac question in what looked like the same font.-- They won't open a joint savings account for my wife and I because my wife doesn't have a phone bill in her own name "for verification." (We've been on the same Southwestern Bell/Cingular/AT&T, recently T-Mobile, family plan for the past, oh, fifteen years,…

Oh, and one more thing: This is the same bank that called me the other day to inquire about our application and--even though they called me--their representative got mad when I wouldn't give him the last four digits of both of our Social Security numbers and our dates of birth and Mother's Maiden Name / Security Answers from the application.

When I pointed out that a) he called me and b) this is, quite literally, exactly how scam calls trying to steal money go, he got upset at how I wouldn't "believe him." I told him that's exactly what a scammer would say and hung up.

My "private" information has been leaked to other governments and various malicious actors at least six times, just in 2018, so I'm a little more wary than I used to be and that pissed me off.

Post reply on HN