5 ms·

Consider the possibility that the hackers were agents of a sovereign power, such as one who has been hurt by economic sanctions and has a history of cyber warfa

by Dowwie 9y ago

Consider the possibility that the hackers were agents of a sovereign power, such as one who has been hurt by economic sanctions and has a history of cyber warfare. This state could decide to respond to US economic aggression by using the compromised information of hundreds of millions of Americans to engage in fraudulent activity. This event is leading me to about how social security numbers can no longer serve the role that they have with establishing trust in identity, although they can continue to be used to uniquely identify a US citizen. This hack may push markets, and government, to widely adopt biometrics and other sensitive, personally identifiable information. What won't happen, unfortunately, is the political will to regulate how uniquely identifiable personal information is managed and stored. Suppose that rather than Equifax, Facebook were hacked. What kind of intelligence and reports does Facebook have on people that would eclipse that of social security numbers and credit history?

gbarc888 9y ago
Undoubtedly Equifax will claim that the hackers were agents of a sovereign power, to escape liability. Regardless, they admitted on their own web page that there was a flaw in their web application. Biometrics would be a terrible idea. Mass surveillance, anyone?
- pc86 9y ago
  I was not aware the citizenship of the hackers had any bearing on Equifax's liability in this case.
  - jedberg 9y ago
    If it's a foreign government it's considered and "act of god", (I.e. Something out of their control) which releases a lot of liability.
    - Dowwie 9y ago
      Force Majeure
    - manquer 9y ago
      to me if you store passwords in plaintext, it is criminal negligence even if God himself did the hack
- cr0sh 9y ago
  > Biometrics would be a terrible idea. Mass surveillance, anyone? What if the biometrics were stored on something you have - say a smartcard (definitely not a phone!)? Along with a PIN. Plus, these two items went into a "write only" store on the card (actually, a hashed value of both are stored). You have a card reader (one at home - and any place you are doing a transaction to confirm identity also has one). You put in your card. Type your PIN. Present your (physical) biometric. The reader takes the data, passes it to the card (or maybe the card has the reader and pin pad?). The card runs the hashing again, and compares the values. If all is good, it outputs a "Yes" otherwise a "No". Remember, only the card holds the data (a hashed version) of the biometric and the PIN. That can only be written (you can do this with your terminal at home?). The only output the card has is that "yes/no" value. All transactions of such nature would be done with this card. I'm probably missing some steps or such - but the idea is there. That gives a 3-factor authentication system. Don't expect it to ever be implemented.
floatrock 9y ago
That was the threat when the OPM got hacked a few years back -- anyone who ever had a background investigation done for a federal job now had their background info in some russian or chinese database dump. With that level of detail, you could start blackmailing some Lockheed or Raytheon employees until they leak some stealth fighter radar secrets to make the monthly false homeloan headaches go away. I don't think the next world war will be fought with nukes, it will be an economic fight. Leak a few corporate secrets [1] to stall the economy, use the OPM dump and this Equifax dump to originate enough false loans to seize up the financial sector, then cause havok across the electrical grid [2] like you did during the annexation of Crimea just to make sure they stay down. We've been blind to the other half of the threat of centralized information repositories... the 1984 Big Brother scenario assumes the holder of the information wants to control the citizens, but we never considered the information might have leaked to an actor who wants to destroy the citizens. [1]: https://en.wikipedia.org/wiki/Sony_Pictures_hack https://en.wikipedia.org/wiki/Sony_Pictures_hack [2]: https://www.wired.com/story/hackers-gain-switch-flipping-access-to-us-power-systems/ https://www.wired.com/story/hackers-gain-switch-flipping-acc...
- carapace 9y ago
  Welcome to WWIII, now in progress. The Russians are kicking our teeth in: they managed to trick us into electing Donald Trump as President...

by Dowwie 9y ago

gbarc888 9y ago

Undoubtedly Equifax will claim that the hackers were agents of a sovereign power, to escape liability. Regardless, they admitted on their own web page that there was a flaw in their web application. Biometrics would be a terrible idea. Mass surveillance, anyone?

pc86 9y ago
I was not aware the citizenship of the hackers had any bearing on Equifax's liability in this case.
- jedberg 9y ago
  If it's a foreign government it's considered and "act of god", (I.e. Something out of their control) which releases a lot of liability.
  - Dowwie 9y ago
    Force Majeure
  - manquer 9y ago
    to me if you store passwords in plaintext, it is criminal negligence even if God himself did the hack
cr0sh 9y ago
> Biometrics would be a terrible idea. Mass surveillance, anyone? What if the biometrics were stored on something you have - say a smartcard (definitely not a phone!)? Along with a PIN. Plus, these two items went into a "write only" store on the card (actually, a hashed value of both are stored). You have a card reader (one at home - and any place you are doing a transaction to confirm identity also has one). You put in your card. Type your PIN. Present your (physical) biometric. The reader takes the data, passes it to the card (or maybe the card has the reader and pin pad?). The card runs the hashing again, and compares the values. If all is good, it outputs a "Yes" otherwise a "No". Remember, only the card holds the data (a hashed version) of the biometric and the PIN. That can only be written (you can do this with your terminal at home?). The only output the card has is that "yes/no" value. All transactions of such nature would be done with this card. I'm probably missing some steps or such - but the idea is there. That gives a 3-factor authentication system. Don't expect it to ever be implemented.

floatrock 9y ago

That was the threat when the OPM got hacked a few years back -- anyone who ever had a background investigation done for a federal job now had their background info in some russian or chinese database dump. With that level of detail, you could start blackmailing some Lockheed or Raytheon employees until they leak some stealth fighter radar secrets to make the monthly false homeloan headaches go away. I don't think the next world war will be fought with nukes, it will be an economic fight. Leak a few corporate secrets [1] to stall the economy, use the OPM dump and this Equifax dump to originate enough false loans to seize up the financial sector, then cause havok across the electrical grid [2] like you did during the annexation of Crimea just to make sure they stay down. We've been blind to the other half of the threat of centralized information repositories... the 1984 Big Brother scenario assumes the holder of the information wants to control the citizens, but we never considered the information might have leaked to an actor who wants to destroy the citizens. [1]: https://en.wikipedia.org/wiki/Sony_Pictures_hack https://en.wikipedia.org/wiki/Sony_Pictures_hack [2]: https://www.wired.com/story/hackers-gain-switch-flipping-access-to-us-power-systems/ https://www.wired.com/story/hackers-gain-switch-flipping-acc...

carapace 9y ago
Welcome to WWIII, now in progress. The Russians are kicking our teeth in: they managed to trick us into electing Donald Trump as President...