4 ms·

Fear not. You can check to see if you were affected by visiting their site and giving them more personal data: https://www.equifaxsecurity2017.com https://www.

Fear not. You can check to see if you were affected by visiting their site and giving them more personal data: https://www.equifaxsecurity2017.com https://www.equifaxsecurity2017.com /s Maybe it doesn't matter much, since they've likely already got it. But, it feels a bit too soon. An interesting side-note: That domain was registered about two weeks ago on 8/22/2017. Whois reveals not a single pointer to Equifax (e.g. equifax.com email address, etc.). It shows only DNStination Inc., and so is effectively private. When you click the "Enroll" link, then "Begin Enrollment" button, it takes you to https://trustedidpremier.com https://trustedidpremier.com, which was registered on 8/28/2017, using a different registrar (Amazon, with Whois Privacy). There's not even a reference to Equifax in the domain itself. As of today, someone registered equifaxsecurity2018.com with a private (this time, Domains By Proxy) registration. Given the timing and the fact that this is a different registrar from the original, it's a good bet that's not Equifax. Or is it? Who knows? And SSL-wise, these don't even appear to be using extended validation certs (FWIW). At least one is an Amazon cert, free to anyone who hosts on AWS. They are virtually training people to be phished and creating another potential disaster with all of these additional domains, private registrations, etc.

mr_overalls 9y ago
This comment should be nearer the top. Also, equifaxsecurity2017.com appears to be a stock Wordpress site. Equifax is a bunch of fucking amateurs. Their security culture is broken.
- unclebucknasty 9y ago
  >Their security culture is broken. That sums it up perfectly. This is not a mistake here or there, but a fundamental lack of appreciation for even the most basic principles of online security. It's like no one there is even thinking about the consequences of their choices. Elsewhere on this thread, I commented on their reliance on an outside security firm to post-mortem this incident. That is ridiculous. They don't seem to understand that they are in the security business as much as anything else. They can't outsource this stuff. Their internal teams should be unparalleled. You're right. It's absolutely cultural.

mr_overalls 9y ago

This comment should be nearer the top. Also, equifaxsecurity2017.com appears to be a stock Wordpress site. Equifax is a bunch of fucking amateurs. Their security culture is broken.

unclebucknasty 9y ago
>Their security culture is broken. That sums it up perfectly. This is not a mistake here or there, but a fundamental lack of appreciation for even the most basic principles of online security. It's like no one there is even thinking about the consequences of their choices. Elsewhere on this thread, I commented on their reliance on an outside security firm to post-mortem this incident. That is ridiculous. They don't seem to understand that they are in the security business as much as anything else. They can't outsource this stuff. Their internal teams should be unparalleled. You're right. It's absolutely cultural.