Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's still easy for anyone to become you at Experian

krebsonsecurity.com

Post reply on HN
Print view View original

271–280 of 347 posts

Re: It's still easy for anyone to become you at Experian

#271

Post by noSyncCloud »

michpoch wrote: post #256
nulbyte wrote: post #253

Earlier quoted context omitted.

It was creating for the purpose of tracking an individual's account by the Social Security Administration. It later became a de facto identifier and, even worse, is many times abused as a form of authentication, but it was never designed to be either. As a result, we have processes that ask for or require a social security number that aren't even related to the purpose for which it was created: Health care, loans, de…

It still sounds like a good way to uniquely identify a person? How else would an institution confirm that it's talking about the same person?

It's a terrible way to uniquely identify a person; it was never designed as such. For instance, there aren't nearly enough of them – they get re-issued all the time.

Re: It's still easy for anyone to become you at Experian

#272

Post by mattferderer »

namdnay wrote: post #209
bradley13 wrote: post #208

Stepping back, and looking at the situation as a whole: the real problem is a lack of privacy laws. Banks, businesses and employers should be prohibited from sharing your personal information with third parties. I live in Switzerland, where this is the case. Even the government doesn't get this information. If the government thinks you're cheating on your taxes, they have to use warrants and follow the same procedure…

“Everything works just fine” It definitely worked great for a lot of dictators, tax cheats and the sort… I think Switzerland is a great example of why complete privacy isn’t fair on ordinary taxpayers - it allows the ultra-rich to hide what they owe

South Dakota, USA has entered the chat.

https://www.theguardian.com/world/2019/nov/14/the-great-amer...

> A South Dakotan trust changes all that: it protects assets from claims from ex-spouses, disgruntled business partners, creditors, litigious clients and pretty much anyone else. It won’t protect you from criminal prosecution, but it does prevent information on your assets from leaking out in a way that might spark interest from the police. And it shields your wealth from the government, since South Dakota has no income tax, no inheritance tax and no capital gains tax.

Re: It's still easy for anyone to become you at Experian

#273

Post by emodendroket »

whatshisface wrote: post #227
fkarg wrote: post #223

Earlier quoted context omitted.

problem is: what to use instead? They don't really have an alternative, either

Businesses can come up with their own ID systems. Google doesn't need your SSN for a Gmail account for example.

Nor do you need to provide an identity that’s not completely made up.

Re: It's still easy for anyone to become you at Experian

#274

Post by emodendroket »

michpoch wrote: post #256
nulbyte wrote: post #253

Earlier quoted context omitted.

It was creating for the purpose of tracking an individual's account by the Social Security Administration. It later became a de facto identifier and, even worse, is many times abused as a form of authentication, but it was never designed to be either. As a result, we have processes that ask for or require a social security number that aren't even related to the purpose for which it was created: Health care, loans, de…

It still sounds like a good way to uniquely identify a person? How else would an institution confirm that it's talking about the same person?

It is treated like a secret, so if you come to know someone else’s Social Security number (thanks to a thriving black market you can buy up plenty of them) that’s enough for lenders to start giving you money and then chasing down that other person to pay them back. Are you starting to see an issue yet?

Re: It's still easy for anyone to become you at Experian

#275

Post by michpoch »

alistairSH wrote: post #263
michpoch wrote: post #256

Earlier quoted context omitted.

It still sounds like a good way to uniquely identify a person? How else would an institution confirm that it's talking about the same person?

The same way they do for people who aren’t from the US? Some combination of name, address, birthdate, etc. But the problem isn’t using the SSN as a semi-unique ID. It’s using it for that and also assuming it’s secret. SSN shouldn’t be any more secret than name or address (and shouldn’t be used to unlock or access accounts).

> The same way they do for people who aren’t from the US? Some combination of name, address, birthdate, etc.

Plenty of countries have SSN-like numbers: https://en.wikipedia.org/wiki/National_identification_number

It's really not that special.

> But the problem isn’t using the SSN as a semi-unique ID. It’s using it for that and also assuming it’s secret. SSN shouldn’t be any more secret than name or address (and shouldn’t be used to unlock or access accounts).

Of course. Shouldn't it be trivial to sue any institution that uses SSN as a way to confirm your identity?

Re: It's still easy for anyone to become you at Experian

#276

Post by michpoch »

emodendroket wrote: post #274
michpoch wrote: post #256

Earlier quoted context omitted.

It still sounds like a good way to uniquely identify a person? How else would an institution confirm that it's talking about the same person?

It is treated like a secret, so if you come to know someone else’s Social Security number (thanks to a thriving black market you can buy up plenty of them) that’s enough for lenders to start giving you money and then chasing down that other person to pay them back. Are you starting to see an issue yet?

Well that's another thing, I don't see why would you need to get rid of SSNs. You just need to add another layer that will confirm that you're the "owner" of your SSN. Seems pretty easy to do?

Re: It's still easy for anyone to become you at Experian

#278

Post by bee_rider »

NoMoreNicksLeft wrote: post #151
marcosdumay wrote: post #34

Earlier quoted context omitted.

So you've found the problem. If they are immune from the crime, they won't stop practicing it.

My understanding is that in most cases, slander/libel is never a crime anyway. It's merely a tort (wrong). It never rises to the level of a crime. The few instances/places where slander is a crime in the US (historically or otherwise) are very problematic and subject to abuse. Perhaps this specific kind of slander should be criminal, but it might be the only kind that should be. Not only would you need to justify tha…

I don’t think it is that tricky philosophically; they are representing themselves as experts on a topic so, they have a responsibility to ensure that they have a professional level of competence in it. Just like doctors and civil engineers.

Agreed that getting legislators to do anything about it will be a pain, though.

Re: It's still easy for anyone to become you at Experian

#279

Post by electrondood »

happytiger wrote: post #83

How is Experian not sued out of existence for their total failure to protect their customers? I just don’t understand what law allows organizations that compromise large portions of entire societies to continue.

They didn't even ask me to verify my phone number when I entered it. Anyone with my SSN and phone number from an all-too-common data breach could easily pretend to be me and unfreeze my credit file.

That's criminal-grade negligence.

Re: It's still easy for anyone to become you at Experian

#280

Post by archon810 »

itissid wrote: post #159

FWIW 1. Freeze all your credit with experian, equifax and transunion 2. Opt out of them selling your info: https://consumerprivacy.experian.com/ https://myprivacy.equifax.com/opt-in-opt-out/personal-info https://service.transunion.com/dss/ccpa_optout.page

Thank you for the links, just submitted for all 3 with no issues.
Post reply on HN