12 ms·

This class action will likely be settled in the same way the Ticketmaster case was settled ... with a coupon book good for 2 free credit reports.

by billh 9y ago

bm1362 9y ago
Is that what the lawyers received for taking the Ticketmaster case?
rayiner 9y ago
Probably for good reason. $500 per class member is an insanely high damages estimate. 99.9% of people will suffer zero damages because their identities will not be stolen. Even the ones who do have their identities stolen will likely be made whole by the credit card companies. The real damages here are going to be to the banks and credit card companies that will have to absorb the costs of all the fraud. As to the Ticket Master case, you can read the complaint yourself and see if $5 or so per class member settlement value was reasonable: http://www.ticketfeelitigation.com/docs/Fourth_Amended_Complaint.pdf http://www.ticketfeelitigation.com/docs/Fourth_Amended_Compl.... The theory was that TicketMaster didn't disclose that it was marking up fees for things like UPS delivery and order processing, and that if customers had known they wouldn't have ordered the tickets. That's a weak damages theory, because customers don't care about line items they care about the bottom line. Either they'll pay $X for the tickets or they won't. Unsurprisingly, that weak damages theory lead to a small per-class-member settlement.
- heartbreak 9y ago
  All of the identities have been stolen. It’s a matter of whether they’re used at this point.
  - vel0city 9y ago
    True, but in the US you can not really sue for possible harms. You can only sue for actual harms which can be remedied by the court. Leaking your information isn't a harm the court can remedy. Abuse of the leaked information is a harm the court can remedy.
    - actsasbuffoon 9y ago
      I don’t think that’s a generally accepted legal standard. It seems similar to saying that Edward Snowden and Chelsea Manning only released information, which the courts can’t remedy. If anything bad should happen due to that leak, then the courts can remedy that in the case of the people who committed those acts. The government is clearly of the opinion that they can and should prosecute people for leaking information which could cause possible harms. I’m clearly not a lawyer, but these scenarios seem pretty similar to my untrained eye.
      - sbov 9y ago
        The difference is that their intentional leaking of classified information as people with a security clearance is letter of the law illegal. The difference seems huge and obvious to my untrained eye.
        KGIII 9y ago
        To add to this, their acts were intentional. Yes, you're very right that they were very much illegal acts. However, it needn't be intentionally spilled classified information in order to be illegal. Under certain circumstances, even accidental 'spillage' is a felony. Negligent 'spillage' is also very much a felony. I've been through quite a bit of training and held my clearance for years. I was a victim of the OPM hack. Well, I guess I still am a victim. Mens rea doesn't really apply when handling classified material/data. If it is accidental AND you report it properly, it's not jail - you are so losing your job, however. You also lose your clearance. It has been a while, but I'm pretty sure you lose it forever.
      - umanwizard 9y ago
        The State prosecuting someone for a crime is not the same thing as a private individual suing another individual for a tort. Basically everything is different: different rules of procedure, different rules of evidence, different standard of proof required, etc. etc.
    - deleted 9y ago
      [deleted]
- deleted 9y ago
  [deleted]
- thaumaturgy 9y ago
  > Even the ones who do have their identities stolen will likely be made whole by the credit card companies. Are credit card companies now in the habit of reimbursing consumers for the considerable time and headache required to sort out fraudulent charges caused by insecure data storage practices in the credit reporting agencies that the credit card companies contract with? There are numerous reports of identity fraud causing a significant amount of trouble for the consumers involved, and as far as I know, not a one of them has ever received a letter beginning, "We're sorry for the time and trouble you went through to clear this up", with an attached check.
  - jlarocco 9y ago
    > Are credit card companies now in the habit of reimbursing consumers for the considerable time and headache required to sort out fraudulent charges caused by insecure data storage practices in the credit reporting agencies that the credit card companies contract with? It's not a "habit", it's the law. It doesn't matter how the fraudulent charges came to be. If a person disputes a charge and has evidence to show it's fraudulent, then by law the credit card company has to investigate, and deal with it. It also makes business sense. CC companies make a ton of money with legal transactions, and an anti-consumer, pro-fraud reputation would cost them customers. > There are numerous reports of identity fraud causing a significant amount of trouble for the consumers involved, and as far as I know, not a one of them has ever received a letter beginning, "We're sorry for the time and trouble you went through to clear this up", with an attached check. Why would the bank or credit card company send a check? Presumably they're not the one who committed the crime, so why should they cover the damages? I've had my identity stolen, and it was a PITA to clear up, but the bank and credit companies were reasonable about it, IMO. In a case like this, where it's easy to point at the Equifax breach and say, "See? This is how they got my info.", it's probably even easier to clear up, though I'm sure it's still a hassle.
    - jldugger 9y ago
      > It's not a "habit", it's the law. It doesn't matter how the fraudulent charges came to be. If a person disputes a charge and has evidence to prove they didn't make it, then by law the credit card company has to investigate, and deal with it. But the time it takes on the phone to talk to an agent, review your records for legit vs illegit charges, etc. are not reimbursed, which is what they were on about. > Why would the bank or credit card company send a check? I think we're talking Target writing the check. Which they didn't exactly volunteer to do, but was covered in the class action at least: https://targetbreachsettlement.com/mainpage/CommonlyAskedQuestions.aspx#a-7 https://targetbreachsettlement.com/mainpage/CommonlyAskedQue...
- chimeracoder 9y ago
  > 99.9% of people will suffer zero damages because their identities will not be stolen. Even the ones who do have their identities stolen will likely be made whole by the credit card companies. The extent of the potential damages here isn't limited to credit card fraud. Having your SSN leaked along with your name, date of birth, every recent address you've had, etc. opens you up to a lot of other attack vectors. Furthermore, credit reports can often inadvertently contain information that relates to one's medical history - you can request that this information be obscured or sealed in your report if you find it, but that means that certain medical information is also within the scope of the potential leak.
- code_duck 9y ago
  A bank 'absorbing' a cost surely means passing on that cost to consumers in some way.
- sokoloff 9y ago
  > Even the ones who do have their identities stolen will likely be made whole by the credit card companies. No one will be paid for their time wasted over ID theft resulting from this breach. That's what "made whole" would mean to me.
- raisedbyninjas 9y ago
  "Even the ones who do have their identities stolen will likely be made whole by the credit card companies." Fraudulent charges on a credit card are the least of my concerns. This opens us up to a lifetime of identity theft and insecure accounts of every sort. I'm not even sure how they can approach remedying the problem. Coordinate with the SSA to get 150 million people new SSNs at the least.
  - logfromblammo 9y ago
    Why would people need new SSNs? It was the credit industry that misused them as combination of unique identifier and authenticator, and that is not the SSA's responsibility to fix. The government even tried to curb misuse of the SSN, but it was not binding on private entities, and they just ignored it. The solution, whatever it is, does not include anyone continuing to pretend that the SSN is now or has ever been suitable for any purposes other than for tracking government benefits managed by the SSA, and possibly also for tax filings with the IRS.
    - raisedbyninjas 9y ago
      You're absolutely correct. We should move to a well designed identity system. However I'd SWAG the development and deployment of such a system around 10-15 years if all of the involved parties were on-board. Equifax could provide the SSA a pile of money and the victims could have a reasonably effective defense against identity theft within months.
      - LoSboccacc 9y ago
        wouldn't it be simpler to make ssn number last only five years? it's a partial workaround, but would immediately help by reducing the attack opportunity time massively, along with making it standard to have variable ssn thorough the system and making it easier for people to just renew their after breaches like this, since the current bar for obtaining a new one is quite high
    - aeorgnoieang 9y ago
      > other than for tracking government benefits managed by the SSA, and possibly also for tax filings with the IRS ... and all of the other government benefits, programs, or mandated activities, many (all?) of which demand your SSN. Are you even sure that the credit industry, i.e. banks, originally misused SSNs? I wouldn't be surprised if they were required, by the government, to use them, precisely because it is the closest thing to an official "unique identifier". Some people also might be concerned with not receiving their SS benefits either, which isn't entirely far-fetched given that others might now be using it for nefarious purposes (like trying to collect their SS benefits).
- ericd 9y ago
  Do you think that the FCRA punitive damages ($100-$1000 per person) might apply here?
  - jstarfish 9y ago
    Unlikely since it doesn't appear credit report-related data was leaked, only PII.
    - Zigurd 9y ago
      The leaked PII makes it trivially easy to obtain the credit report data
- fleitz 9y ago
  There was a class action suit because a company was marking up the cost of the goods / services they were selling? Isn't this just called business?
  - TheCoelacanth 9y ago
    Most businesses include their markup in their displayed price. Ticket Master was displaying one price and then sneaking in an extra fee later in the process.
- Johnny555 9y ago
  $500 may be high, but $100 would be more reasonable even for those that didn't have their identity stolen, I've already spent an hour researching the hack to figure out what to look for and whether or not I was included in the set of stolen identities.
- maxerickson 9y ago
  If there are 140 million members then any settlement will be individually quite modest (Equifax has annual income of ~600 million dollars, so multiple years of all of it to get to even $10). It does seem like any penalty for something like this should severely impact the ability of the company to operate though. I suppose a $0 way to penalize them severely would be to force Equifax to allow individuals to opt out of having Equifax store information about them. Lots of people would do so without understanding that it might impact their ability to get a loan, but so what.
  - daemin 9y ago
    But that would also make Equifax's product not that appealing to the companies that would purchase it. So organisations would have to use one of the other agencies as well.
- willstrafach 9y ago
  > The real damages here are going to be to the banks and credit card companies that will have to absorb the costs of all the fraud. This is not true at all. They simply reverse the charges. Businesses who accepted the fraudulent transaction(s) are on the hook for it. Anyone who runs a business and handles credit card processing can confirm this.
tajen 9y ago
One scenario would be SSN being massively used by pirates, so companies would stop trusting SSN altogether. Let's hope a startup creates a "proof of identity" service with a photo ID with a chip, a code, and an online certificate for tax purpose.
- walshemj 9y ago
  ah lovely "papers please citizen" and what happen when friend computer with all this proof of identity gets hacked. Maybe the USA needs everyone to have a new ssn and ban with very strict penalties is use by any one other than the state and then only for highly restricted usages as it is in the UK
  - sandworm101 9y ago
    True only if the papers are issued by government. A private or non-profit scheme, if hacked, could be abandoned within hours and replaced. To post this comment i had to present some virtual ID to a private organization.
  - actsasbuffoon 9y ago
    Considering that Social Security numbers are not secure, and were never intended to be secure, I favor this approach. Unless you’re the federal government, you shouldn’t know or care about my social security number. Idiots are always going to think SSNs are a good UUID, and I’m always in favor of punishing idiots.
    - walshemj 9y ago
      almost 20 years ago when working for british telecom we where read the riot act an where told any non permitted use on NI numbers would be considered gross misconduct and you would be sacked on the spot.
  - cr0sh 9y ago
    > ah lovely "papers please citizen" and what happen when friend computer with all this proof of identity gets hacked. While it doesn't solve the "papers please" aspect: 1. Card holds biometric data of person, plus PIN. Card is the only thing that holds this. 2. All card does is output "yes or no" if you are you. 3. You have or use a reader for authenticating who you are. The reader takes you biometric data (fingerprint scan, face scan, or something else), and has you enter your pin. It takes this info, hashes it, compares to the stored info, and outputs the "yes" or "no" answer. Very basic thing here. 3-factor, and the data about you is never stored anywhere, and the card/reader combo does the rest. The data about you never leaves the card (in fact, it can't - it would be write only for that data). We have all the technology to do this today. What we don't have is the will. So it won't be implemented. I'm not saying the above is perfect - but it is 3-factor (what you are, what you have, what you know), and that is what is needed most. The information stays with the owner on the card. All transactions can only be done with the card on-hand to prove you are you. You can change the PIN at will, maybe even the biometric data - but both are write-only, and can't leave the card. The card can read in data (an image for the biometric data, and the code for the PIN), but all it does is hash that together, compare it to the stored hash, and output a yes/no. I'm not saying the above is perfect, and I am sure I have forgotten something. But it - or something like it - is what we ultimately need. But we won't get it. Ever.
Bluestrike2 9y ago
To be fair, class action suits aren't really about recovering damages for the class members. Or at least, not entirely. That's almost incidental. Rather, they're most often about leveraging a large class of injured parties--whose injuries are usually relatively minor on an individual basis--to force a change of behavior by adding up all of those small injuries. The cost of pursuing each claim individually would usually be sufficiently high as to make pursuing a claim unviable. The behavior would remain uncorrected, and the injured parties would receive neither compensation nor the knowledge that the behavior has been altered or eliminated. Nobody wins in that situation. And while it's almost inevitable that discussions about class action suits will involve complaints about the lawyers fees, that's not really fair. Mass tort litigation is complex and involves significant investments of time and resources on the part of the attorneys involved. Especially if they actually make it to trial. It might seem unfair at first glance, but it enables the class to access the legal system and justice where it otherwise would not. They may be imperfect, but they're a hell of a lot better than the alternative and have had a profound positive impact on our society.
- paulgb 9y ago
  Exactly. It's hard to measure the value of class actions without knowing how the behavior of companies would change without them. I expect we'll see that natural experiment play out now that arbitration clauses are commonplace.
- prklmn 9y ago
  Your first point is only sometimes valid as damages do depend on the severity of the injury, just as in any other case. See http://www.nytimes.com/1999/10/08/business/fen-phen-maker-to-pay-billions-in-settlement-of-diet-injury-cases.html http://www.nytimes.com/1999/10/08/business/fen-phen-maker-to... for a class action suit involving serious injury.
- hueving 9y ago
  >And while it's almost inevitable that discussions about class action suits will involve complaints about the lawyers fees, that's not really fair. Of course it's fair. It's not like the members of the class get to shop around for cheaper lawyers. The class gets shit either way, they just have to decide if they hate the company more than the lawyers that charge the obscene percentages. And you can't make any kind of cost argument because a billion dollar case isn't anymore complex than a million dollar case. The whole point of it being a class is that it impacted everyone the same so the dollar figures don't change the complexity.
dbatten 9y ago
You mean, with a coupon book good for 2 free credit reports... except with ridiculous fine print that will prevent 99% of people from using said coupons...
- HillaryBriss 9y ago
  ... 2 free credit reports with the purchase of 3 or more credit reports at the usual price

This class action will likely be settled in the same way the Ticketmaster case was settled ... with a coupon book good for 2 free credit reports.

by billh 9y ago

This class action will likely be settled in the same way the Ticketmaster case was settled ... with a coupon book good for 2 free credit reports.

bm1362 9y ago

Is that what the lawyers received for taking the Ticketmaster case?

rayiner 9y ago

Probably for good reason. $500 per class member is an insanely high damages estimate. 99.9% of people will suffer zero damages because their identities will not be stolen. Even the ones who do have their identities stolen will likely be made whole by the credit card companies. The real damages here are going to be to the banks and credit card companies that will have to absorb the costs of all the fraud. As to the Ticket Master case, you can read the complaint yourself and see if $5 or so per class member settlement value was reasonable: http://www.ticketfeelitigation.com/docs/Fourth_Amended_Complaint.pdf http://www.ticketfeelitigation.com/docs/Fourth_Amended_Compl.... The theory was that TicketMaster didn't disclose that it was marking up fees for things like UPS delivery and order processing, and that if customers had known they wouldn't have ordered the tickets. That's a weak damages theory, because customers don't care about line items they care about the bottom line. Either they'll pay $X for the tickets or they won't. Unsurprisingly, that weak damages theory lead to a small per-class-member settlement.

heartbreak 9y ago
All of the identities have been stolen. It’s a matter of whether they’re used at this point.
- vel0city 9y ago
  True, but in the US you can not really sue for possible harms. You can only sue for actual harms which can be remedied by the court. Leaking your information isn't a harm the court can remedy. Abuse of the leaked information is a harm the court can remedy.
  - actsasbuffoon 9y ago
    I don’t think that’s a generally accepted legal standard. It seems similar to saying that Edward Snowden and Chelsea Manning only released information, which the courts can’t remedy. If anything bad should happen due to that leak, then the courts can remedy that in the case of the people who committed those acts. The government is clearly of the opinion that they can and should prosecute people for leaking information which could cause possible harms. I’m clearly not a lawyer, but these scenarios seem pretty similar to my untrained eye.
    - sbov 9y ago
      The difference is that their intentional leaking of classified information as people with a security clearance is letter of the law illegal. The difference seems huge and obvious to my untrained eye.
      - KGIII 9y ago
        To add to this, their acts were intentional. Yes, you're very right that they were very much illegal acts. However, it needn't be intentionally spilled classified information in order to be illegal. Under certain circumstances, even accidental 'spillage' is a felony. Negligent 'spillage' is also very much a felony. I've been through quite a bit of training and held my clearance for years. I was a victim of the OPM hack. Well, I guess I still am a victim. Mens rea doesn't really apply when handling classified material/data. If it is accidental AND you report it properly, it's not jail - you are so losing your job, however. You also lose your clearance. It has been a while, but I'm pretty sure you lose it forever.
    - umanwizard 9y ago
      The State prosecuting someone for a crime is not the same thing as a private individual suing another individual for a tort. Basically everything is different: different rules of procedure, different rules of evidence, different standard of proof required, etc. etc.
  - deleted 9y ago
    [deleted]
deleted 9y ago
[deleted]
thaumaturgy 9y ago
> Even the ones who do have their identities stolen will likely be made whole by the credit card companies. Are credit card companies now in the habit of reimbursing consumers for the considerable time and headache required to sort out fraudulent charges caused by insecure data storage practices in the credit reporting agencies that the credit card companies contract with? There are numerous reports of identity fraud causing a significant amount of trouble for the consumers involved, and as far as I know, not a one of them has ever received a letter beginning, "We're sorry for the time and trouble you went through to clear this up", with an attached check.
- jlarocco 9y ago
  > Are credit card companies now in the habit of reimbursing consumers for the considerable time and headache required to sort out fraudulent charges caused by insecure data storage practices in the credit reporting agencies that the credit card companies contract with? It's not a "habit", it's the law. It doesn't matter how the fraudulent charges came to be. If a person disputes a charge and has evidence to show it's fraudulent, then by law the credit card company has to investigate, and deal with it. It also makes business sense. CC companies make a ton of money with legal transactions, and an anti-consumer, pro-fraud reputation would cost them customers. > There are numerous reports of identity fraud causing a significant amount of trouble for the consumers involved, and as far as I know, not a one of them has ever received a letter beginning, "We're sorry for the time and trouble you went through to clear this up", with an attached check. Why would the bank or credit card company send a check? Presumably they're not the one who committed the crime, so why should they cover the damages? I've had my identity stolen, and it was a PITA to clear up, but the bank and credit companies were reasonable about it, IMO. In a case like this, where it's easy to point at the Equifax breach and say, "See? This is how they got my info.", it's probably even easier to clear up, though I'm sure it's still a hassle.
  - jldugger 9y ago
    > It's not a "habit", it's the law. It doesn't matter how the fraudulent charges came to be. If a person disputes a charge and has evidence to prove they didn't make it, then by law the credit card company has to investigate, and deal with it. But the time it takes on the phone to talk to an agent, review your records for legit vs illegit charges, etc. are not reimbursed, which is what they were on about. > Why would the bank or credit card company send a check? I think we're talking Target writing the check. Which they didn't exactly volunteer to do, but was covered in the class action at least: https://targetbreachsettlement.com/mainpage/CommonlyAskedQuestions.aspx#a-7 https://targetbreachsettlement.com/mainpage/CommonlyAskedQue...
chimeracoder 9y ago
> 99.9% of people will suffer zero damages because their identities will not be stolen. Even the ones who do have their identities stolen will likely be made whole by the credit card companies. The extent of the potential damages here isn't limited to credit card fraud. Having your SSN leaked along with your name, date of birth, every recent address you've had, etc. opens you up to a lot of other attack vectors. Furthermore, credit reports can often inadvertently contain information that relates to one's medical history - you can request that this information be obscured or sealed in your report if you find it, but that means that certain medical information is also within the scope of the potential leak.
code_duck 9y ago
A bank 'absorbing' a cost surely means passing on that cost to consumers in some way.
sokoloff 9y ago
> Even the ones who do have their identities stolen will likely be made whole by the credit card companies. No one will be paid for their time wasted over ID theft resulting from this breach. That's what "made whole" would mean to me.
raisedbyninjas 9y ago
"Even the ones who do have their identities stolen will likely be made whole by the credit card companies." Fraudulent charges on a credit card are the least of my concerns. This opens us up to a lifetime of identity theft and insecure accounts of every sort. I'm not even sure how they can approach remedying the problem. Coordinate with the SSA to get 150 million people new SSNs at the least.
- logfromblammo 9y ago
  Why would people need new SSNs? It was the credit industry that misused them as combination of unique identifier and authenticator, and that is not the SSA's responsibility to fix. The government even tried to curb misuse of the SSN, but it was not binding on private entities, and they just ignored it. The solution, whatever it is, does not include anyone continuing to pretend that the SSN is now or has ever been suitable for any purposes other than for tracking government benefits managed by the SSA, and possibly also for tax filings with the IRS.
  - raisedbyninjas 9y ago
    You're absolutely correct. We should move to a well designed identity system. However I'd SWAG the development and deployment of such a system around 10-15 years if all of the involved parties were on-board. Equifax could provide the SSA a pile of money and the victims could have a reasonably effective defense against identity theft within months.
    - LoSboccacc 9y ago
      wouldn't it be simpler to make ssn number last only five years? it's a partial workaround, but would immediately help by reducing the attack opportunity time massively, along with making it standard to have variable ssn thorough the system and making it easier for people to just renew their after breaches like this, since the current bar for obtaining a new one is quite high
  - aeorgnoieang 9y ago
    > other than for tracking government benefits managed by the SSA, and possibly also for tax filings with the IRS ... and all of the other government benefits, programs, or mandated activities, many (all?) of which demand your SSN. Are you even sure that the credit industry, i.e. banks, originally misused SSNs? I wouldn't be surprised if they were required, by the government, to use them, precisely because it is the closest thing to an official "unique identifier". Some people also might be concerned with not receiving their SS benefits either, which isn't entirely far-fetched given that others might now be using it for nefarious purposes (like trying to collect their SS benefits).
ericd 9y ago
Do you think that the FCRA punitive damages ($100-$1000 per person) might apply here?
- jstarfish 9y ago
  Unlikely since it doesn't appear credit report-related data was leaked, only PII.
  - Zigurd 9y ago
    The leaked PII makes it trivially easy to obtain the credit report data
fleitz 9y ago
There was a class action suit because a company was marking up the cost of the goods / services they were selling? Isn't this just called business?
- TheCoelacanth 9y ago
  Most businesses include their markup in their displayed price. Ticket Master was displaying one price and then sneaking in an extra fee later in the process.
Johnny555 9y ago
$500 may be high, but $100 would be more reasonable even for those that didn't have their identity stolen, I've already spent an hour researching the hack to figure out what to look for and whether or not I was included in the set of stolen identities.
maxerickson 9y ago
If there are 140 million members then any settlement will be individually quite modest (Equifax has annual income of ~600 million dollars, so multiple years of all of it to get to even $10). It does seem like any penalty for something like this should severely impact the ability of the company to operate though. I suppose a $0 way to penalize them severely would be to force Equifax to allow individuals to opt out of having Equifax store information about them. Lots of people would do so without understanding that it might impact their ability to get a loan, but so what.
- daemin 9y ago
  But that would also make Equifax's product not that appealing to the companies that would purchase it. So organisations would have to use one of the other agencies as well.
willstrafach 9y ago
> The real damages here are going to be to the banks and credit card companies that will have to absorb the costs of all the fraud. This is not true at all. They simply reverse the charges. Businesses who accepted the fraudulent transaction(s) are on the hook for it. Anyone who runs a business and handles credit card processing can confirm this.

tajen 9y ago

One scenario would be SSN being massively used by pirates, so companies would stop trusting SSN altogether. Let's hope a startup creates a "proof of identity" service with a photo ID with a chip, a code, and an online certificate for tax purpose.

walshemj 9y ago
ah lovely "papers please citizen" and what happen when friend computer with all this proof of identity gets hacked. Maybe the USA needs everyone to have a new ssn and ban with very strict penalties is use by any one other than the state and then only for highly restricted usages as it is in the UK
- sandworm101 9y ago
  True only if the papers are issued by government. A private or non-profit scheme, if hacked, could be abandoned within hours and replaced. To post this comment i had to present some virtual ID to a private organization.
- actsasbuffoon 9y ago
  Considering that Social Security numbers are not secure, and were never intended to be secure, I favor this approach. Unless you’re the federal government, you shouldn’t know or care about my social security number. Idiots are always going to think SSNs are a good UUID, and I’m always in favor of punishing idiots.
  - walshemj 9y ago
    almost 20 years ago when working for british telecom we where read the riot act an where told any non permitted use on NI numbers would be considered gross misconduct and you would be sacked on the spot.
- cr0sh 9y ago
  > ah lovely "papers please citizen" and what happen when friend computer with all this proof of identity gets hacked. While it doesn't solve the "papers please" aspect: 1. Card holds biometric data of person, plus PIN. Card is the only thing that holds this. 2. All card does is output "yes or no" if you are you. 3. You have or use a reader for authenticating who you are. The reader takes you biometric data (fingerprint scan, face scan, or something else), and has you enter your pin. It takes this info, hashes it, compares to the stored info, and outputs the "yes" or "no" answer. Very basic thing here. 3-factor, and the data about you is never stored anywhere, and the card/reader combo does the rest. The data about you never leaves the card (in fact, it can't - it would be write only for that data). We have all the technology to do this today. What we don't have is the will. So it won't be implemented. I'm not saying the above is perfect - but it is 3-factor (what you are, what you have, what you know), and that is what is needed most. The information stays with the owner on the card. All transactions can only be done with the card on-hand to prove you are you. You can change the PIN at will, maybe even the biometric data - but both are write-only, and can't leave the card. The card can read in data (an image for the biometric data, and the code for the PIN), but all it does is hash that together, compare it to the stored hash, and output a yes/no. I'm not saying the above is perfect, and I am sure I have forgotten something. But it - or something like it - is what we ultimately need. But we won't get it. Ever.

Bluestrike2 9y ago

To be fair, class action suits aren't really about recovering damages for the class members. Or at least, not entirely. That's almost incidental. Rather, they're most often about leveraging a large class of injured parties--whose injuries are usually relatively minor on an individual basis--to force a change of behavior by adding up all of those small injuries. The cost of pursuing each claim individually would usually be sufficiently high as to make pursuing a claim unviable. The behavior would remain uncorrected, and the injured parties would receive neither compensation nor the knowledge that the behavior has been altered or eliminated. Nobody wins in that situation. And while it's almost inevitable that discussions about class action suits will involve complaints about the lawyers fees, that's not really fair. Mass tort litigation is complex and involves significant investments of time and resources on the part of the attorneys involved. Especially if they actually make it to trial. It might seem unfair at first glance, but it enables the class to access the legal system and justice where it otherwise would not. They may be imperfect, but they're a hell of a lot better than the alternative and have had a profound positive impact on our society.

paulgb 9y ago
Exactly. It's hard to measure the value of class actions without knowing how the behavior of companies would change without them. I expect we'll see that natural experiment play out now that arbitration clauses are commonplace.
prklmn 9y ago
Your first point is only sometimes valid as damages do depend on the severity of the injury, just as in any other case. See http://www.nytimes.com/1999/10/08/business/fen-phen-maker-to-pay-billions-in-settlement-of-diet-injury-cases.html http://www.nytimes.com/1999/10/08/business/fen-phen-maker-to... for a class action suit involving serious injury.
hueving 9y ago
>And while it's almost inevitable that discussions about class action suits will involve complaints about the lawyers fees, that's not really fair. Of course it's fair. It's not like the members of the class get to shop around for cheaper lawyers. The class gets shit either way, they just have to decide if they hate the company more than the lawyers that charge the obscene percentages. And you can't make any kind of cost argument because a billion dollar case isn't anymore complex than a million dollar case. The whole point of it being a class is that it impacted everyone the same so the dollar figures don't change the complexity.

dbatten 9y ago

You mean, with a coupon book good for 2 free credit reports... except with ridiculous fine print that will prevent 99% of people from using said coupons...

HillaryBriss 9y ago
... 2 free credit reports with the purchase of 3 or more credit reports at the usual price