4 ms·

I am curious what programmer would make such a choice vs. calling random or asking the user. However, while undeniably stupid, hopefully they have rate limitin

I am curious what programmer would make such a choice vs. calling random or asking the user. However, while undeniably stupid, hopefully they have rate limiting in place so guessing the PIN would not be feasible even if you know the day the credit freeze was put into place.

pkulak 9y ago
Do you really think a company that has visibly demonstrated this much incompetence thus far would be making smart decisions where you can't see them?
foota 9y ago
If you have a 1 in 60*24 chance of guessing correctly then after 1000 guesses (potentially against different people) you have a 50 chance of being correct on one.
- y0ghur7_xxx 9y ago
  It's probably even less that 1 in 60 * 24, because usually a freezes is requested during business hours? So 1 in 60 * 8?
- skj 9y ago
  Could you explain your math here? Is there something you learn about the other digits when you make a wrong guess?
  - jooke 9y ago
    60*24 = 1440 possibilities. If you guess half these numbers you would expect to crack half the pins.
  - jon_richards 9y ago
    Your chance of being wrong in a guess is 1-1/(60* 24) Your chance of being wrong in all 1000 guesses, assuming you guess randomly (not ensuring you never make the same guess twice) is (1-1/(60* 24))^1000 That's about .5 This is based on the assumption that you are guessing for a different person each time, so you can't increase your odds by eliminating any guesses you've already made. If you're guessing for the same person every time, you just need to guess half the possibilities. You can confirm this by realizing: Your chance of being wrong in a guess is 1-1/(60* 24-x) where x is the number of guesses you have already made. The product of 1-1/(60* 24-x) from x=0 to x=60* 24/2-1 is .5 Edit: hackernews formatting is weird
  - foota 9y ago
    You could probably increase your odds significantly over time by analyzing the distribution of pins (and as others note, by making common sense observations you can also increase your odds)
noway421 9y ago
maybe there was no way to save and transfer the pin from one place of the system to another, and the only way to do it is to guess on the other side by timestamp. pretty hacky implementation but oh well
- rocqua 9y ago
  Hash with a secret key (a pepper) solves that. Heck, hashing with a salt or even just plain hashing would be miles better than this.
  - scentoni 9y ago
    Hash? I wouldn't trust the folks at Equifax to know the difference between a one-way function, a cannabis concentrate, and a fried potato dish.
- MichaelApproved 9y ago
  Carrying around the password wasn't a problem. There's an option to pick your own password during the previous step but having an automated one is the default option, so a lot of people miss it.
raverbashing 9y ago
They don't want to migrate their db to add an extra field?
- rbanffy 9y ago
  Or add a new table with this field.
khazhoux 9y ago
Someone probably read an article about how RNGs aren't truly random, and so decided timestamp (which never repeats!) was the right alternative.
- roywiggins 9y ago
  Of course, two people who happen to request at the same time will get the same key anyway, so it doesn't even solve that problem.
  - khazhoux 9y ago
    Right, of course not. They're idiots.

pkulak 9y ago

Do you really think a company that has visibly demonstrated this much incompetence thus far would be making smart decisions where you can't see them?

foota 9y ago

If you have a 1 in 60*24 chance of guessing correctly then after 1000 guesses (potentially against different people) you have a 50 chance of being correct on one.

y0ghur7_xxx 9y ago
It's probably even less that 1 in 60 * 24, because usually a freezes is requested during business hours? So 1 in 60 * 8?
skj 9y ago
Could you explain your math here? Is there something you learn about the other digits when you make a wrong guess?
- jooke 9y ago
  60*24 = 1440 possibilities. If you guess half these numbers you would expect to crack half the pins.
- jon_richards 9y ago
  Your chance of being wrong in a guess is 1-1/(60* 24) Your chance of being wrong in all 1000 guesses, assuming you guess randomly (not ensuring you never make the same guess twice) is (1-1/(60* 24))^1000 That's about .5 This is based on the assumption that you are guessing for a different person each time, so you can't increase your odds by eliminating any guesses you've already made. If you're guessing for the same person every time, you just need to guess half the possibilities. You can confirm this by realizing: Your chance of being wrong in a guess is 1-1/(60* 24-x) where x is the number of guesses you have already made. The product of 1-1/(60* 24-x) from x=0 to x=60* 24/2-1 is .5 Edit: hackernews formatting is weird
- foota 9y ago
  You could probably increase your odds significantly over time by analyzing the distribution of pins (and as others note, by making common sense observations you can also increase your odds)

noway421 9y ago

maybe there was no way to save and transfer the pin from one place of the system to another, and the only way to do it is to guess on the other side by timestamp. pretty hacky implementation but oh well

rocqua 9y ago
Hash with a secret key (a pepper) solves that. Heck, hashing with a salt or even just plain hashing would be miles better than this.
- scentoni 9y ago
  Hash? I wouldn't trust the folks at Equifax to know the difference between a one-way function, a cannabis concentrate, and a fried potato dish.
MichaelApproved 9y ago
Carrying around the password wasn't a problem. There's an option to pick your own password during the previous step but having an automated one is the default option, so a lot of people miss it.

raverbashing 9y ago

They don't want to migrate their db to add an extra field?

rbanffy 9y ago
Or add a new table with this field.

khazhoux 9y ago

Someone probably read an article about how RNGs aren't truly random, and so decided timestamp (which never repeats!) was the right alternative.

roywiggins 9y ago
Of course, two people who happen to request at the same time will get the same key anyway, so it doesn't even solve that problem.
- khazhoux 9y ago
  Right, of course not. They're idiots.