Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Myequifax.com Bypasses Credit Freeze Pin

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 206 posts

Re: Myequifax.com Bypasses Credit Freeze Pin

#61

Post by nkrisc »

css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

Zodiac sign? Seriously? I don't know what mine is because that is not a belief system/religion I subscribe to so I had to Google it. Turns out my birthdate must be on the border because different sources have it as a different sign. They might as well ask what color my aura is.

Re: Myequifax.com Bypasses Credit Freeze Pin

#62

Post by ben174 »

css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

That is incredible. There are only twelve signs. I mean why not just ask your birth month? And even then, incredibly easy to guess or to find out. I honestly want to know who came up with that security gateway and question them on how they thought that was secure.

Re: Myequifax.com Bypasses Credit Freeze Pin

#63

Post by orky56 »

sevensor wrote: post #22
fhinson wrote: post #15

> SSN and DOB data is widely available for sale in the cybercrime underground on almost all U.S. citizens. This has been the reality for years, and was so well before Equifax announced its big 2017 breach. Again, I find that this only reinforces the fact that SSNs are not a useful identification system because there's nothing secure about them. Can someone explain where attackers obtain SSN/DOB data with such a wides…

So if everybody knows your SSN/DOB, I'd say that makes a very good identity system in the sense that we can all unambiguously refer to the same person. It's just not any use as a means of authenticating that you are the person who has that identity.

SSN on its own is sufficient for verifying identity. SSN coupled with a phone verification step is more secure for authenticating than DOB.

Re: Myequifax.com Bypasses Credit Freeze Pin

#64

Post by rlucas »

ryanlol wrote: post #20
fhinson wrote: post #15

> SSN and DOB data is widely available for sale in the cybercrime underground on almost all U.S. citizens. This has been the reality for years, and was so well before Equifax announced its big 2017 breach. Again, I find that this only reinforces the fact that SSNs are not a useful identification system because there's nothing secure about them. Can someone explain where attackers obtain SSN/DOB data with such a wides…

Accurint is a big one. The people selling SSN lookups have big DB collections, but the primary source tends be realtime access to DBs like these. I'd imagine it's trivial to pretend to be a cop and just purchase access to this stuff, not that it's going to be hard to hack most police departments either.

Having looked at getting Accurint and Clear back in 2013, I can tell you the process is not trivial but not comforting either.

On the non-trivial side: I was doing a startup where we sublet from a law firm. We had an on-site audit by someone who came in and we were cautioned that we had to have an independently locking door on our office. We also had to give a reasonably thorough explanation of what we wanted to do with the data and certify, as well as convince the auditor, that we would be using it for GLBA (anti-fraud in financial transactions) purposes.

We actually failed one of the audits the first time because some paperwork wasn't in place (I think we had changed the Delaware company name and not re-filed something, like our local jurisdiction foreign corporate registration, in the new name).

On the not comforting side: the sales reps for these products have full access and will let you do lookups and surf through on whatever. 100% unmasked details on any numbers you want. DMV, aircraft, SSN, judgments, etc., all linked and at the ready.

Also, GLBA is a giant Sherman-tank sized loophole that means that essentially anybody can fully legally use these databases as long as there's some cognizable financial transaction that you're protecting from fraud (even proactively / research wise).

See https://risk.nexis.com/AMLSolutions/help/GLBA_Permissible_Us...

So no, you can't just "pretend to be a cop" but if you actually go to the trouble of being some sort of fraud-prevention business, you can just go wild.

Re: Myequifax.com Bypasses Credit Freeze Pin

#65

Post by isoskeles »

css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

I remember being asked the name of a street I lived near once. I still don't know the right answer, but I think it was some official or unofficial name of I-80 or the 101 that no one calls it any more (e.g. Lincoln Highway).

I would rather be asked my Zodiac sign, although that is definitely weird.

You shouldn't have to spend time doing research on different versions of road names to prove my identity. That's absurd. I can imagine some dystopian future where I'm strapped to a chair and my kidnapper is demanding I answer to obscure names of highways as my only reprieve from torture.

Re: Myequifax.com Bypasses Credit Freeze Pin

#66

Post by mikeash »

sbr464 wrote: post #40
css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

If it’s not multiple choice, You can answer with random digits and keep your answers in a password manager.

Not only is it multiple choice, but there are only five choices.

Re: Myequifax.com Bypasses Credit Freeze Pin

#67

Post by jstarfish »

human wrote: post #42
shawnz wrote: post #8

Earlier quoted context omitted.

Except it doesn't address the problem at all. What happens when another negligent credit bureau pops up to replace it?

We should really work on making personal data transactions illegal. I can’t think of a single company that I would be happy to hear that they sold my data to third-party. These companies provide no additonal benefits. Equifax is the worst. You can call them and ask to buy lists of names, addresses and phone numbers of people matching certain financial criterias. Facebook would look dull in comparison if people knew t…

> Equifax is the worst. You can call them and ask to buy lists of names, addresses and phone numbers of people matching certain financial criterias. Facebook would look dull in comparison if people knew the extent of the Equifax abuse of privacy.

Don't be silly. The long arm of Equifax has a finite length. We know where they get their data from and you have to at least pretend to "consent" to provide it to them by initiating a financial transaction. The Breach aside, there are federal laws (FCRA, etc.) governing willful dissemination of the data they have on you, and the scope of the data they collect is entirely financial.

None of this applies to Facebook/Google. There is no "consent" or opting-in to their lifestyle intelligence pool. You start building a dossier a few seconds after venturing onto the internet for the first time.

Your name ending up on a list of middle-to-upper-class sales leads is not a crime against humanity. There are many other ways to get the same data, starting with public records.

Re: Myequifax.com Bypasses Credit Freeze Pin

#68

Post by bonestamp2 »

css wrote: post #3

> the data being asked about in these KBA quizzes is culled from public records Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an…

I wonder if these questions were less about identity validation and more about stopping bots from opening accounts? Either way, it's not the ideal solution, but one is a little better than the other. The chance of a bot guessing all three right is pretty slim, but at least if a real person did research and made educated guesses then it would slow them down considerably.

Re: Myequifax.com Bypasses Credit Freeze Pin

#69

Post by arcticbull »

rlucas wrote: post #52
athenot wrote: post #43

Earlier quoted context omitted.

> I am so confused if by merely giving someone a cheque they are able to “pull” money from just two numbers, and can do it for any amount & any number of times. That is exactly how checks work. It's optimized for happy-path, with a big mess of a process to handle fraud. The cash equivalent would be to carry a bucket with all your money and when you pay, you present your bucket so that the shop can pull out the amount…

"Optimized for happy-path" is true, but it also reveals something pretty neat about the American financial / business climate. "Default trust" actually works in our economy. And because of that, friction can be low and things Just Work. Default trust / happy-path optimization in turn works because of the backstop of a strong legal system, fairly clear precedent, and reasonably well defined property rights. Think: UCC…

I just realized something -- the cryptocurrency-maximalist and antivaxx movement are born of a similar phenomenon.

Humans are great at rallying and pushing and making change when they see identify something as wrong in their direct lives. We work as hard as possible, and develop solutions (vaccines, a strong legal backstop). Then, all is well, and the problems we solved are no longer part of our lives because the system works.

Years later a vocal minority becomes very suspicious (they're inflating away my wealth!, autism!) and tries to overhaul the system. Then they learn why we do things the way we do (scams/manipulation/etc, measles) the hard way.

Post reply on HN