Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Myequifax.com Bypasses Credit Freeze Pin

krebsonsecurity.com

Post reply on HN
Print view View original

31–40 of 206 posts

Re: Myequifax.com Bypasses Credit Freeze Pin

#31

Post by ams6110 »

gooseus wrote: post #17
mumphster wrote: post #7

Earlier quoted context omitted.

Ok and...? Seems like a valid line of conversation to me.

I agree, but this is not a helpful point form which to start a conversation. It's lazy and below the standards many expect from HN. A better way to start this conversation (imo) would be to make reference to the many mistakes Equifax has made over the years and ask what is preventing Equifax from facing real consequences, such as being shutdown? It's the effort that people place into having genuine conversations that…

So you want someone to write three paragraphs for what can be said in six words? I prefer the brevity.

Re: Myequifax.com Bypasses Credit Freeze Pin

#33

Post by mherdeg »

A real-life attack based on this kind of hole was discussed at https://www.reddit.com/r/personalfinance/comments/ay7aoy/ide... : someone says that an identity thief who knows all their knowledge-based question answers (because they have a copy of a credit report, no doubt) keeps somehow removing the freeze and committing more fraud.

Re: Myequifax.com Bypasses Credit Freeze Pin

#34

Post by davchana »

SketchySeaBeast wrote: post #18
arcticbull wrote: post #12

Earlier quoted context omitted.

You’re exactly right. It’s the same reason we’re required to sign checks then the bank promptly ignores the signatures. It’s cheaper to handle the fraud than check the signatures, but it makes us feel good to do it anyways.

I wish - a few years ago I was trying to pay for rent with a cheque and it bounced. I ended up sending another cheque, having that one get rejected, go into the bank and give them a new signature sample, and then have the next cheque be rejected as well due to the signature. Apparently my bank checks cheques.

Yes, Indian Banks too check Signatures on anything submitted to them.

I once had to deposit cash in my own account but in different city in India. It was free if I deposited it, but fees for anybody third party. Cashier told me my signature doesn’t match with whats on file and thus either I need to re-sign or need to pay fees.

Here in US I have seen policies in Stores saying we accept check, but we will onetime use the account & routing number on check to pull the amount. I am so confused if by merely giving someone a cheque they are able to “pull” money from just two numbers, and can do it for any amount & any number of times.

Re: Myequifax.com Bypasses Credit Freeze Pin

#35

Post by JustSomeNobody »

> “We deployed an experience that embraces both security standards (using a multi-factor and layered approach to verify the consumer’s identity) and reflects specific consumer feedback on managing security freezes and fraud alerts online without the use of a PIN,” she continued. “The account set-up process, which involves the creation of a username and password, relies on both user inputs and other factors to securely establish, verify, and authenticate that the consumer’s identity is connected to the consumer every time.”

She tosses around the word security, but really what she is saying is that Equifax decided to make the experience as simple as possible because having people create accounts with them without the need for boosting CSR headcount is more important that securing those accounts.

Re: Myequifax.com Bypasses Credit Freeze Pin

#36

Post by css »

techsupporter wrote: post #26
css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

That looks like Ally Bank. --BUT, it isn't, per the reply below. It's Discover, though Ally asked me the same zodiac question in what looked like the same font.-- They won't open a joint savings account for my wife and I because my wife doesn't have a phone bill in her own name "for verification." (We've been on the same Southwestern Bell/Cingular/AT&T, recently T-Mobile, family plan for the past, oh, fifteen years,…

It's Discover, not Ally.

Re: Myequifax.com Bypasses Credit Freeze Pin

#37

Post by techsupporter »

css wrote: post #36
techsupporter wrote: post #26

Earlier quoted context omitted.

That looks like Ally Bank. --BUT, it isn't, per the reply below. It's Discover, though Ally asked me the same zodiac question in what looked like the same font.-- They won't open a joint savings account for my wife and I because my wife doesn't have a phone bill in her own name "for verification." (We've been on the same Southwestern Bell/Cingular/AT&T, recently T-Mobile, family plan for the past, oh, fifteen years,…

It's Discover, not Ally.

Oh, they use the exact same font. Fair enough; I'll add a disclaimer at the top but Ally did the same thing to me (same zodiac question).

Re: Myequifax.com Bypasses Credit Freeze Pin

#38

Post by jjaredsimpson »

ams6110 wrote: post #31
gooseus wrote: post #17

Earlier quoted context omitted.

I agree, but this is not a helpful point form which to start a conversation. It's lazy and below the standards many expect from HN. A better way to start this conversation (imo) would be to make reference to the many mistakes Equifax has made over the years and ask what is preventing Equifax from facing real consequences, such as being shutdown? It's the effort that people place into having genuine conversations that…

So you want someone to write three paragraphs for what can be said in six words? I prefer the brevity.

No. I want no throwaway easily consumable venting.

Either take the time to contribute meaningfully or don't comment at all.

Anything else is pollution.

Re: Myequifax.com Bypasses Credit Freeze Pin

#39

Post by asark »

dev1n wrote: post #4

Can we just shut down equifax already?

What we ought to do—to tie into the "let's break up Google" story also being discussed right now—is make collecting and hoarding data about people incredibly risky. A leak of any size should be a "your company is finished" event. Much collection should simply be outlawed or at least placed under strict user control, GDPR-style.

It'd make the CRAs, various other financial institutions (credit card companies, banks), and the tech giants all stop doing a bunch of the most harmful crap they're getting up to. Or else actually pay what it takes to keep everything really secure, while ditching any data they don't absolutely have to have to operate.

Re: Myequifax.com Bypasses Credit Freeze Pin

#40

Post by sbr464 »

css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

If it’s not multiple choice, You can answer with random digits and keep your answers in a password manager.
Post reply on HN