The Equifax Hack Didn't Have to Be This Bad
bloomberg.com
The Equifax Hack Didn't Have to Be This Bad
1–10 of 74 posts
Re: The Equifax Hack Didn't Have to Be This Bad
#2Title not supported by article.
Re: The Equifax Hack Didn't Have to Be This Bad
#3Title not supported by article.
It is, and is related to some of the discussion in the main Equifax hack threads.
The idea is that this information shouldn't be so sensitive because it isn't really secret in the first place. It also cannot be changed, so it doesn't really meet any reasonable criteria for authenticating information.
To quote the relevant top-level comment I had in mind:
>mikeash 2 hours ago [-]
>If we're lucky, this will be the best leak of personal info ever. The primacy of the SSN in American society is idiotic. It's a "secret" that you have to hand out to dozens of different organizations. I've long thought that we should phase this out by committing to publish all SSNs (and the associated info, obviously, so it's not just a list of most 9-digit numbers...) which would force all these companies to stop treating it as confidential. The system is dumb and works poorly, but worked will enough that there was no impetus to fix it. Some people got affected by breaches, and it sucked for them, but it was always a small enough group that most people didn't care. Now that a majority of people's "secret" info is no longer confidential, maybe they'll realize they can't rely on it anymore. OK, the odds of this actually coming to pass are not great. But I can hope.
Re: The Equifax Hack Didn't Have to Be This Bad
#4Title not supported by article.
It is, and is related to some of the discussion in the main Equifax hack threads. The idea is that this information shouldn't be so sensitive because it isn't really secret in the first place. It also cannot be changed, so it doesn't really meet any reasonable criteria for authenticating information. To quote the relevant top-level comment I had in mind: >mikeash 2 hours ago [-] >If we're lucky, this will be the best…
Also note that other countries don't have this insanity.
Re: The Equifax Hack Didn't Have to Be This Bad
#5Indeed. This pervasive usage of SSNs should be dropped.
Re: The Equifax Hack Didn't Have to Be This Bad
#6Title not supported by article.
It is, and is related to some of the discussion in the main Equifax hack threads. The idea is that this information shouldn't be so sensitive because it isn't really secret in the first place. It also cannot be changed, so it doesn't really meet any reasonable criteria for authenticating information. To quote the relevant top-level comment I had in mind: >mikeash 2 hours ago [-] >If we're lucky, this will be the best…
I recently encountered an advertisement advising people to keep their Medicare card number secret.
So if the SSN stops being considered as a combination identifier/authenticator, other government agencies stand eager and ready to plunge headlong into the same mistake.
The way around it is to pass a law that requires government agents and agencies to consider identifiers to be public, and authenticators to be secret, and that nothing can ever be both. The government could require itself to publish indexes of names to SSNs and SSNs to names, such that no stretch of anyone's imagination would ever generate a presumption that knowing the number proves you are the person to whom it is assigned.
The ridiculous assumptions made in the credit and credit reporting industry that are held out to be reasonable should never be allowed to hold up in court.
Re: The Equifax Hack Didn't Have to Be This Bad
#7Title not supported by article.
It is, and is related to some of the discussion in the main Equifax hack threads. The idea is that this information shouldn't be so sensitive because it isn't really secret in the first place. It also cannot be changed, so it doesn't really meet any reasonable criteria for authenticating information. To quote the relevant top-level comment I had in mind: >mikeash 2 hours ago [-] >If we're lucky, this will be the best…
CGP has a good video on this: https://www.youtube.com/watch?v=Erp8IAUouus
Re: The Equifax Hack Didn't Have to Be This Bad
#8Earlier quoted context omitted.
It is, and is related to some of the discussion in the main Equifax hack threads. The idea is that this information shouldn't be so sensitive because it isn't really secret in the first place. It also cannot be changed, so it doesn't really meet any reasonable criteria for authenticating information. To quote the relevant top-level comment I had in mind: >mikeash 2 hours ago [-] >If we're lucky, this will be the best…
Also note that other countries don't have this insanity.
[deleted]
Re: The Equifax Hack Didn't Have to Be This Bad
#9The hack isn't just SSNs - it includes address history, date of birth, drivers license number - everything reasonably necessary to establish identity. Not sure why the focus is SSNs, any solution needs to be even higher. This is about companies stockpiling our personal information and us having little say in the matter.
Re: The Equifax Hack Didn't Have to Be This Bad
#10Indeed. This pervasive usage of SSNs should be dropped.
The pervasive want of private corporations to stockpile our private information is a huge concern as well. There's hardly any reason they should store anything beyond name and contact info.