Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's still easy for anyone to become you at Experian

krebsonsecurity.com

Post reply on HN
Print view View original

311–320 of 347 posts

Re: It's still easy for anyone to become you at Experian

#311

Post by harimau777 »

emodendroket wrote: post #212
bradley13 wrote: post #208

Stepping back, and looking at the situation as a whole: the real problem is a lack of privacy laws. Banks, businesses and employers should be prohibited from sharing your personal information with third parties. I live in Switzerland, where this is the case. Even the government doesn't get this information. If the government thinks you're cheating on your taxes, they have to use warrants and follow the same procedure…

I would say this problem would also be solved if we stopped pretending that a Social Security number was a serious substitute for secure national ID.

I thought the problem wasn't that we use SSN as an ID; rather it's that we use the SSN as a password?

Re: It's still easy for anyone to become you at Experian

#312

Post by narrator »

hiatus wrote: post #260
narrator wrote: post #69

This all goes back to the social security not being changeable and morphing from some thing to claim benefits with to it being your universal password. In contrast, I lost my drivers license and in order to get a new one I had to go the DMV in person and put my thumb print on a biometric scanner which pulls up my picture for the DMV person to look at before they authorize the request. I can also file an affidavit of…

> go the DMV in person and put my thumb print on a biometric scanner which pulls up my picture How does the state have your fingerprints on file?

https://www.dmv.ca.gov/portal/driver-education-and-safety/ed...

It's a basic requirement in California to get any form of ID.

Re: It's still easy for anyone to become you at Experian

#313

Post by emodendroket »

michpoch wrote: post #276
emodendroket wrote: post #274

Earlier quoted context omitted.

It is treated like a secret, so if you come to know someone else’s Social Security number (thanks to a thriving black market you can buy up plenty of them) that’s enough for lenders to start giving you money and then chasing down that other person to pay them back. Are you starting to see an issue yet?

Well that's another thing, I don't see why would you need to get rid of SSNs. You just need to add another layer that will confirm that you're the "owner" of your SSN. Seems pretty easy to do?

I didn’t propose getting rid of the SSN without replacing it with an actual, secure national ID. If that involves legacy SSNs still somehow whatever.

Re: It's still easy for anyone to become you at Experian

#314

Post by FireBeyond »

mindslight wrote: post #138
FireBeyond wrote: post #71

Earlier quoted context omitted.

> We need DMVs to begin issuing IDs that are physical with digital capabilities The problem is that there is a very vocal segment that views such things as "government overreach" through to the literal mark of the devil. And then there are the challenges of issuing them. There are states (the same states, typically, who shut down voting locations in working class areas and defund their DMVs) who will fight tooth and…

You've put forth an utter straw man. I am rationally against making government verification of identity stronger precisely because the existing identity systems have been pervasively abused with essentially no recourse. After there is a US equivalent of the GDPR that lets me prevent the surveillance industry, including the traditional financial surveillance industry, from unilaterally creating dossiers about me, then…

> You've put forth an utter straw man. I am rationally against making government verification of identity stronger precisely because the existing identity systems have been pervasively abused with essentially no recourse.

There's absolutely no straw man. Among other reasons, things like this are exactly why there is opposition in some segments.

You've literally argued "You're making a strawman by describing what I think!" You're against it because overreach and abuse. I say a segment is against it because of reasons including that. Maybe less of a hair trigger is needed.

Re: It's still easy for anyone to become you at Experian

#315

Post by ryukoposting »

Aaargh20318 wrote: post #250
ryukoposting wrote: post #243

Earlier quoted context omitted.

There are a million things broken about the American credit reporting system, but I'm going to try to make a case for one very specific part of it: > how much is your income and how much are your current financial obligations This doesn't work if your income doesn't show up in the government's system. For example, if your income comes from illegal activity. Crime is bad and you shouldn't do it, but crime is an econom…

> This doesn't work if your income doesn't show up in the government's system. For example, if your income comes from illegal activity. It's not a government system. Banks will typically ask for a payslip. > For example, if your income comes from illegal activity. You think banks are going to give you a loan if your income is from criminal activity? That's cute. Banks are required to report suspicious activity and th…

> It's not a government system. Banks will typically ask for a payslip.

I admit to misunderstanding but I fail to see how this diminishes my point.

> You think banks are going to give you a loan if your income is from criminal activity? That's cute.

That's exactly what I'm saying. The above approach systemically blackballs anyone who lacks a better avenue to a reliable income.

That's a failure that exists in both the American system and the Danish one. My point is this: In the American one, it's a byproduct of AML law, which could easily be changed to allow banks to ignore small-time cases (with conditions, of course). In the Danish system, the blocker is inbuilt - it can't be regulated away without fundamental changes to the design of the system. Adding a "proceeds from criminal activity" box doesn't work great. Ask Al Capone.

Petty criminals don't pose enough of a threat to society for it to be worthwhile to block them out of basic, low-risk financial services like checking accounts and debit-backed credit cards. Barring them from those services doesn't discourage the illegal activity. It does more to lock them into their current socioeconomic status.

Re: It's still easy for anyone to become you at Experian

#316

Post by jam_ocean »

pdonis wrote: post #141
csharpminor wrote: post #52

I’ve received two data breach notices in the past week, one from my healthcare provider and the other from the bank that holds my mortgage. In both instances they said to lock my credit, and provide free credit monitoring for a year. I find this egregiously insufficient to the point where I think we need more regulation in this space. They should provide lifelong credit monitoring and full insurance on any financial…

> We need DMVs to begin issuing IDs that are physical with digital capabilities, like credit cards. We need the equivalent of Apple/Android Pay for identity online. We need to mandate that banks support digital IDs. And we need strict enforcement for people who misuse a digital ID. And how will all this magically work online? Answer: you'll have to provide whatever digital secret gives you access, just the way you pr…

Actually, you can use cryptography to prove who you are without giving anyone else the ability to simply "copy" your ID and impersonate you later. It's how message signing works: https://en.wikipedia.org/wiki/Digital_signature#Authenticati...

Some countries already have national ID systems that use cryptography like this to secure identify oneself online, such as Estonia: https://en.wikipedia.org/wiki/Estonian_identity_card#Electro...

Re: It's still easy for anyone to become you at Experian

#317

Post by matheusmoreira »

rescbr wrote: post #116
gchamonlive wrote: post #63

Maybe this is why for the past few weeks I am receiving countless emails from major retailers like Casas Bahia or Americanas and even Magazine Luiza with purchase confirmation listing several smartphones and notebooks whose invoice bare my name and cpf. I tried contacting every retailer. Only Magazine Luiza seem to have acknowledged the fraud and issued a warning but to no avail, as I am still receiving invoices from…

I've been on a similar situation once, this is what I did, and I think you're on the right path. > I tried contacting every retailer. Try to reach out to the ombudsman (ouvidoria) and explain your case. Even if they don't actually solve the problem, you documented that you tried to friendly resolve the issue. > I am expecting fallout from this. Very worst case scenario, the retailers will send the fraudulent invoices…

This is really good information, thank you.

Re: It's still easy for anyone to become you at Experian

#318

Post by mindslight »

FireBeyond wrote: post #314
mindslight wrote: post #138

Earlier quoted context omitted.

You've put forth an utter straw man. I am rationally against making government verification of identity stronger precisely because the existing identity systems have been pervasively abused with essentially no recourse. After there is a US equivalent of the GDPR that lets me prevent the surveillance industry, including the traditional financial surveillance industry, from unilaterally creating dossiers about me, then…

> You've put forth an utter straw man. I am rationally against making government verification of identity stronger precisely because the existing identity systems have been pervasively abused with essentially no recourse. There's absolutely no straw man. Among other reasons, things like this are exactly why there is opposition in some segments. You've literally argued "You're making a strawman by describing what I th…

> There's absolutely no straw man. Among other reasons, things like this are exactly why there is opposition in some segments.

Sure, technically there is a sliver of actual people out there worried about "mark of the devil". I'd still say it's a straw man to use that to characterize general opposition.

> You've literally argued "You're making a strawman by describing what I think!"

Uh, not at all. I accept that the government wants to be able to identify citizens. I'm not calling this government overreach. What I have a problem with is the ongoing failure to pass any corresponding laws that prohibit companies from abusing these identification systems to build limitless privately-owned completely-unaccountable surveillance databases. These abuses need to be stopped first, rather than brushing off the problems we're already suffering and giving even more to the surveillance industry.

As I said, pass a US GDPR that gives me the right to opt out of most of the surveillance industry, lets me drastically curtail and audit the parts I don't completely opt out of, and make sure any new types of identity attestation are still refutable in the legal system, and I am generally on board with stronger identification through something like a smart card.

Re: It's still easy for anyone to become you at Experian

#319

Post by kccqzy »

Aaargh20318 wrote: post #306
kccqzy wrote: post #304

Earlier quoted context omitted.

I still don't understand. Of course getting a judge to take it out of your paycheck is possible in America too. But preferably before a bank loans you money, they want to determine whether they can rely on you paying back on your own or whether there's a high likelihood they will get a judge involved? What if the bank doesn't want the hassle of involving a judge? How do you even measure the probability of needing to…

Obviously it’s a last resort. The point is that someone who can afford to pay and doesn’t is very uncommon as this would cause a lot of trouble for the person in question.

Then you might as well say that in the first comment. In the U.S. banks certainly already look at your income to make sure you can afford to pay. Credit scores just measure willingness to pay. And before AutoPay became popular, they also measure whether a person can consistently take care of their own affairs and remember to pay.

Re: It's still easy for anyone to become you at Experian

#320

Post by bigbacaloa »

namdnay wrote: post #209
bradley13 wrote: post #208

Stepping back, and looking at the situation as a whole: the real problem is a lack of privacy laws. Banks, businesses and employers should be prohibited from sharing your personal information with third parties. I live in Switzerland, where this is the case. Even the government doesn't get this information. If the government thinks you're cheating on your taxes, they have to use warrants and follow the same procedure…

“Everything works just fine” It definitely worked great for a lot of dictators, tax cheats and the sort… I think Switzerland is a great example of why complete privacy isn’t fair on ordinary taxpayers - it allows the ultra-rich to hide what they owe

[dead]
Post reply on HN