24 ms·
Equifax security freeze PINs are the timestamp of when you request the freeze
- Axsuul 9y agoCalling all hackers, brute force much?
- buildbot 9y agoI am curious what programmer would make such a choice vs. calling random or asking the user. However, while undeniably stupid, hopefully they have rate limiting in place so guessing the PIN would not be feasible even if you know the day the credit freeze was put into place.
- pkulak 9y agoDo you really think a company that has visibly demonstrated this much incompetence thus far would be making smart decisions where you can't see them?
- foota 9y agoIf you have a 1 in 60*24 chance of guessing correctly then after 1000 guesses (potentially against different people) you have a 50 chance of being correct on one.
- y0ghur7_xxx 9y agoIt's probably even less that 1 in 60 * 24, because usually a freezes is requested during business hours? So 1 in 60 * 8?
- skj 9y agoCould you explain your math here? Is there something you learn about the other digits when you make a wrong guess?
- jooke 9y ago60*24 = 1440 possibilities. If you guess half these numbers you would expect to crack half the pins.
- jon_richards 9y agoYour chance of being wrong in a guess is 1-1/(60* 24) Your chance of being wrong in all 1000 guesses, assuming you guess randomly (not ensuring you never make the same guess twice) is (1-1/(60* 24))^1000 That's about .5 This is based on the assumption that you are guessing for a different person each time, so you can't increase your odds by eliminating any guesses you've already made. If you're guessing for the same person every time, you just need to guess half the possibilities. You can confirm this by realizing: Your chance of being wrong in a guess is 1-1/(60* 24-x) where x is the number of guesses you have already made. The product of 1-1/(60* 24-x) from x=0 to x=60* 24/2-1 is .5 Edit: hackernews formatting is weird
- foota 9y agoYou could probably increase your odds significantly over time by analyzing the distribution of pins (and as others note, by making common sense observations you can also increase your odds)
- noway421 9y agomaybe there was no way to save and transfer the pin from one place of the system to another, and the only way to do it is to guess on the other side by timestamp. pretty hacky implementation but oh well
- rocqua 9y agoHash with a secret key (a pepper) solves that. Heck, hashing with a salt or even just plain hashing would be miles better than this.
- scentoni 9y agoHash? I wouldn't trust the folks at Equifax to know the difference between a one-way function, a cannabis concentrate, and a fried potato dish.
- MichaelApproved 9y agoCarrying around the password wasn't a problem. There's an option to pick your own password during the previous step but having an automated one is the default option, so a lot of people miss it.
- raverbashing 9y agoThey don't want to migrate their db to add an extra field?
- rbanffy 9y agoOr add a new table with this field.
- khazhoux 9y agoSomeone probably read an article about how RNGs aren't truly random, and so decided timestamp (which never repeats!) was the right alternative.
- roywiggins 9y agoOf course, two people who happen to request at the same time will get the same key anyway, so it doesn't even solve that problem.
- khazhoux 9y agoRight, of course not. They're idiots.
- chris_wot 9y agoWhoa... one guy said on Twitter this was the case in 2007!!
- ranci 9y ago9:38 PM - 8 Sep 2017
- MichaelApproved 9y agoOP was referring to the top reply to the linked tweet. > Verified PIN format w/ several people who froze today. And I got my PIN in 2007—same exact format. Equifax has been doing this for A DECADE. https://twitter.com/webster/status/906361966645710849 https://twitter.com/webster/status/906361966645710849
- darawk 9y agoAMA request: the developer who made this decision. 1. How does it feel to be literally the dumbest engineer on the planet?
- dang 9y agoPlease don't do this here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- pcurve 9y agoSerious question... if there are 3-5 attempt lock out, would this be any less secure than randomly generated number?
- wtfequifax 9y agoNot sure I'd count on them having lock out, and even if they do, a shitload of the PINs will be easy to guess since they'll be clustered around now, when many people are rushing to lock their credit.
- mkagenius 9y agoYes -- if lot of people freeze their accounts on a day and the attacker has a way to try same pin on lot of accounts. (No -- if random number generator is only 2 digits long)
- didgeoridoo 9y ago1) Target individual for identity theft. 2) Search their twitter history for "I just froze my credit" or similar. 3) Try the PIN corresponding to t-1, t-2... t-5. 4) Profit!
- mikeash 9y agoVery much so. If you can guess when someone froze their stuff to within a day, for example, then 5 tries gives you a 1 in 288 chance of getting in. A proper random number would be more like 1 in a trillion trillion trillion trillion trillion trillion trillion trillion.
- encoderer 9y agoTrue thing: until recently you could remove hard inquiries from your credit report merely by pulling your own credit so often in one month using an array of daily monitoring services that you would overflow the field and bump off legit inquiries. I did this in 2009-10, it had been going on for a while, and lasted for a while but sadly I hear they've solved it seemingly by nightly batch job to remove your own credit pulls. These companies are just barely functional for their purpose. Experian seemed to have their act together a bit more.
- subroutine 9y agoI recently turned down a job offer at Experian; it (at least their San Diego office) was a shitshow.
- throwaway762 9y agoI used to work for Experian. When I left, they paid me an extra month's wages before their payroll caught up to the fact that I was gone, then had to ask for it back. (I paid them back, FWIW.) If you can't run your own payroll, why should you be trusted with a credit bureau?
- outoftacos 9y agoYou should see Denver. It was like The Shining.
- astura 9y agoHow many requests, specifically, did you have to have to overflow the field?
- rokhayakebe 9y agoSomething worth taking into consideration is these companies are not Engineering/Tech companies at the core. They were probably born as paper-companies and digitized their operations later on. I am hoping for the day something and more appropriate for this age will make them irrelevant.
- wyager 9y ago> I am hoping for the day something and more appropriate for this age will make them irrelevant. We have the technology to build vastly superior replacements right now. It's mostly network effect requirements that make this extremely challenging/slow to implement. An example of something we could do is cryptographically authenticated web-of-trust creditworthiness estimation, with techniques like proof of burn and selective trust anchoring used to establish terminal nodes in the unrolled trust DAG. This sort of thing would allow for pseudonymous, automated determination of trust without the extreme security and privacy risks posed by centralized identity stores like the credit bureaus.
- antimatter 9y agoI find technical discussions around this subject extremely fascinating but I'm a total noob in this space. Would you mind sharing any relevant links on the topics you mentioned?
- rbanffy 9y ago> are not Engineering/Tech companies Which means each and every line of code was written by the lowest bidder.
- solomatov 9y agoIt's time to have a mandatory certification for people who develop critical systems. After such certification, you can consider such an implementation a malpractice, and sue them for it (of course the penalty is paid by the insurance company which sold the malpractice insurance). Doctors, lawyers, and many other professions have such system, why can't we have it as well?
- ben_jones 9y agoDevelopers don't control budgets and deadlines at large companies, management does. So what does this "certified" individual do when he's given a project without resources allocated for proper security auditing? Does he intentionally get fired for refusing the assignment? That works if he has bountiful savings, no mortgage, no kids. Surely no unethical contracting company will pick up the job after he leaves...
- rhizome 9y agoIf only there were more software jobs out there, then they wouldn't be hemmed in so intractably.
- ranci 9y agoNice red herring
- peoplewindow 9y agoFinding another software job is insufficient. You need to find one that gives its employees the time and space they say need regardless of other competitive or financial pressures. Not so easy.
- geofft 9y agosomething something software developers need a union something
- mikeash 9y agoHow does it work with lawyers or engineers?
- krzrak 9y agoOK, what is "Equifax security freeze"?
- gruez 9y agohttps://en.wikipedia.org/wiki/Credit_freeze https://en.wikipedia.org/wiki/Credit_freeze
- chris_st 9y agoA security freeze (which you can get from all three credit reporting agencies for small fee, $10 or $20) prevents them from giving your credit information to a bank (or car company, or college loan agency, or...) asking about you, when you ask for a loan. I don't know if they charge for this service or not. It also prevents them from selling your credit information to credit card companies (and, I'm sure, insurance agencies and many other businesses). These businesses want a list of people with good credit history to market their wares to. Essentially, you're "taking yourself off their sales shelf", so they do not want you doing this, and will make it as hard as they legally can. Also note that you pretty much cannot get a loan while your credit records at these firms are frozen, but it's actually easy to get them un-frozen and then frozen again once you get the loan. In fact, you should find out which credit agency your bank (car dealer, whatever) uses and then only unfreeze that one.
- Keeeeeeeks 9y agoThis is embarrassing at this point; a credit authority printing dividends is too busy placating shareholders to even pretend to give a shit about the data of the people who _involuntarily_ have their PII stored on their platform. Whoever files a class action should make a motion such that anyone can purge their PII from a credit authority that's experienced a public hack such that their PII was exposed, or some other sort of incentive for these too-big-to-improve companies to do their job
- rbanffy 9y ago> too-big-to-improve Love that!
- FLUX-YOU 9y ago>purge their PII from a credit authority I can't see that happening if they do any kind of offsite back up and archiving. They will purge you from the current master, say they purged you, and you'll be none-the-wiser.
- toomuchtodo 9y agoI wish someone would go Mr Robot and corrupt their offsite tape backups with the HVAC system.
- samstave 9y agoThis is a unix system! I know this!
- eicnix 9y agoThe best solution for this would be to enable similar data protection laws like the ones that will become active in 2018 in the EU. A breach of this law would cost a company 2-4% of their revenue as a fine. Seeing how these big companies operate there would be a lot of breaches.
- solomatov 9y ago
- withdavidli 9y agoAnyone else confirmed this? Don't know who Tony is, usually like more sources that a tweet.
- anyfoo 9y agoJust try it out for yourself, like others did: https://news.ycombinator.com/item?id=15204573 https://news.ycombinator.com/item?id=15204573
- withdavidli 9y agoI'm not using anything that Equifax set up in case it waives any of my rights. This is how bad it's gotten, people are afraid/untrusting of their security/protection measures. Thank you for linking to more accounts of this.
- wglb 9y agoThey can't waive your rights. See https://twitter.com/AGSchneiderman/status/906195350532304896 https://twitter.com/AGSchneiderman/status/906195350532304896
- Toxygene 9y agoI worked with Tony a number of years ago and have been following him on social media. He does a lot of public records research, and for the last two+ years or so, he's been fighting the Hennepin Count Sheriffs office over public records requests about law enforcement's use of biometrics. As of April of this year, the Minnesota Court of Appeals ruled against Hennepin county. I'm not sure if the county is planning on appealing to the Minnesota Supreme Court, but based on their behavior so far, I'd bet on an appeal. If you need more convincing, check out his blog at https://tonywebster.com/ https://tonywebster.com/. PS. Direct link to his post about the MN Court of Appeals outcome: https://tonywebster.com/2017/04/minnesota-court-of-appeals-data-practices-burden/ https://tonywebster.com/2017/04/minnesota-court-of-appeals-d...
- 8cmj7A 9y agoI can confirm at least the first 6 digits are MMDDYY based on the date that I saved it into 1password. The last 4 digits seem like could very likely be hhmm. Edit: Can confirm: The pin is the exact date/time stamp that my freeze was applied. I'm able to tell based on another note saved to 1password. It is within 1 minute :(
- justherefortart 9y agoOutsourcing/H1b costing a lot more than they save is my guess. If you develop in-house software, you ARE A SOFTWARE COMPANY, whether you want to be or not. Amazing how this good old boy network still thinks like it's 1970.
- bitxbitxbitcoin 9y agoEquifax is also the only one out of the big three that shows your SSN in plaintext while you type it in on that online request form. They're just lacking in all departments it seems.
- tvaughan 9y agoAnd the hits just keep on coming... www.equifaxsecurity2017.com uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported. Error code: SEC_ERROR_UNKNOWN_ISSUER
- xrstf 9y agoThe cert is signed by GeoTrust and works perfectly fine on my Chrome on Windows 10. [Edit: Ah, the chain is incomplete, see https://www.ssllabs.com/ssltest/analyze.html?d=www.equifaxsecurity2017.com&s=104.20.65.37 https://www.ssllabs.com/ssltest/analyze.html?d=www.equifaxse...]
- wonderous 9y agoHere's an explaination of the error: https://serverfault.com/questions/788019/this-servers-certificate-chain-is-incomplete https://serverfault.com/questions/788019/this-servers-certif...
- jeffwass 9y agoI was surprised they didn't even use a link on their main equifax domain, but set up a new one that could just as well been any phisher.
- gregmac 9y agoThis is such an awful domain to use in the first place. It's conditioning users in exactly the wrong way, aside from there being a security warning for some users. How do you explain to your father/grandfather/whoever that equifaxsecurity2017.com is ok, but equifax-security-breach.com, checkyourequifaxaccount.com, equifaxsecurity-2017.com and equifaxsecurity2018.com are not legit? Stick to your top level domain. Something like security2017.equifax.com or equifax.com/security2017 would be okay.
- misingnoglic 9y agoThis is how every class action lawsuits do their websites too and it blows my mind! It looks so sketchy.
- paultopia 9y agoAt this point, I will be legit shocked if there aren't actual lines forming around courthouses, full of plaintiff-side lawyers trying to get a piece of this unbelievably stupid and negligent company. Holy shit.
- anigbrowl 9y agoI'd like if Equifax was just shut down and the assets redistributed to the affected parties. Shareholders have no incentive to hire ethical and competent managers if they don't have to bear the losses stemming from bad decisions.
- ulkesh 9y agoIt's like the Keystone Cops are running Equifax. They are now a complete joke. And it's sadly not funny.
- alpb 9y agoPossibly because Equifax's Chief Security Officer (CSO) might not be the best fit for the job. Here's their LinkedIn profile: https://imgur.com/a/dkjzD https://imgur.com/a/dkjzD
- bga 9y agoThis isn't okay. Don't dox this guy. Besides, lots of "hacker" hackers are self-taught.
- nogbit 9y agoThe only solution is to put the data in our hands only and we authorize access to it on an as needed basis. It should not be centralized anywhere.
- mrguyorama 9y agoHow do you prevent User X from lying then?
- nogbit 9y agoCredit card x,y, and z all know my current balance, place of residence and payment history. They let me and only me know that info via some method that can be trusted by anyone (blockchain?). At a later date, I autorize credit card w to access some computed score that I compute and verify via other trusted means (another blockchain or whatever). Credit card w never sees all my data and the verifier gets access to only what it needs. Nobody needs to trust anyone and instead trusts the chain. Just an idea.
- mdip 9y agoThere are a few things here that shouldn't surprise me[0], but do. A credit reporting agency's one product is personal data (basically, it's you). Leaking that data basically makes it worthless (or worth a lot less) and besides affecting the people who's data was leaked[1], it damages the product of their competitors. You'd think that would be something that's protected with so many layers that a breach of their web property wouldn't make much of a difference[2]. At previous employers, without going into terribly much detail, we had an asset that was treated with the kind of security that something like this should have been treated with. It was on a segregated network that could only be accessed through proxy hosts, requiring two-factor authentication. The proxy hosts were hardened (only the specific, needed, services/components installed/running, audited and firewalled to death). The devices in the secure network could not see the corporate network, let alone the Internet and the corporate network/internet could not see these devices. Even special 'management interfaces' for corporate devices were segregated. This was in addition to all of the rigor put in to securing each endpoint. Companies need to realize that security is purely a defense related behavior. You have to be "perfect" 100% of the time, but your attacker need only be right a small number of times. The goal is to increase the number of times an attacker has to be right to get at your data. From ensuring your database accounts can only execute specific things[2], that your web servers are hardened and isolated to limit exposure, to properly configured firewalls (including application-layer firewalls/log analysis). And ensuring that employee access to high-value targets is as minimal as possible and protected thoroughly. There are both "preventative" and "reductive" technologies that need to be put in place. Preventative is designed to stop a breach, reductive is designed to ensure that if breached, the breach is either worthless (i.e. proper password hashing) or caught and interrupted before all of the data is exfiltrated. It's a lot easier to explain to investors (and your fellow countrymen) that a couple of million user accounts were exposed than it is to explain that 124 million of them left. From the looks of it, it appears Equifax treats security like most large, non-tech businesses -- an expense that should be cut as deeply as possible. It's probably fitting that they have the word "fax" in their name. If I had a guess, they probably have mandatory security auditing requirements, they paid the least they could to meet that regulation, and got the answer they paid for (or found someone to give them the answer). I'll also guess that this PIN issue will turn out not to be the worst of the security practices in place -- I mean, how many weeks did they wait to report this[3]? [0] I have a few years' history at a large corporation working in and around security. I've seen the ugly, though I feel that we handled things very well (incredibly well compared against Equifax!) [1] i.e. not their customers. [2] I'm thinking in terms of a typical SQL server, where one can eliminate table/view level access in favor of stored procedures that limit what they provide and require a level of knowledge of the operation of the system (and can be tracked by logging in a manner that identifies behavior that's not normal). [3] And is it just me being overly cynical or does anyone else think that they waited until a historic hurricane would dominate the news cycle before going public with it? It was pretty good timing, really -- coming right off of Harvey and right into Irma, it's easy to miss this story among the other big news (one 'general news/politics' site that I expected to see all kinds of headlines on had it quite low on the fold for a day and nowhere to be found, today). Or maybe they were just waiting to give time for more of their higher-ups to sell stock. /s
- ryanqian 9y agoWhat a joke.
- nytesky 9y agoWhat would be the best credit monitoring service then? Any recs of ones that have their act together?