5 ms·

This really pisses me off. It's only a matter of time before some random person opens up a cellphone, utlity, or bank account... or worse. Completely messed up.

This really pisses me off. It's only a matter of time before some random person opens up a cellphone, utlity, or bank account... or worse. Completely messed up. Everyone American should be scared shitless at this incompetence. It's going to cost everyone thousands of dollars over their lives for credit fraud protection. Just another expense to add.

sschueller 9y ago
This issue has existed before the hack. None of these companies give a shit about security. Maybe this will change things.
- nkrisc 9y ago
  They won't care until they have to personally pay out of pocket. Many of us probably will, but they won't.
pavel_lishin 9y ago
> It's going to cost everyone thousands of dollars over their lives for credit fraud protection. In my mind, the Just thing to do would be for Equifax to offer ongoing fraud protection to all of their customers affected by this leak. (Gosh, that might be expensive!)
- rhizome 9y ago
  I mean sure, if they can't make fraud-avoidance part of their fundamental business model.
jimktrains2 9y ago
It's also extortion. "Please pay us money to solve the massive problem we created." I don't know how it's legal.
- martin1975 9y ago
  The legal term is racketeering (https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corrupt_Organizations_Act https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corru...).
- 13of40 9y ago
  Not saying it would be great in the short term, but I wonder how it would play out if the entire database was made widely available. It seems like it would be a lot harder to enforce a debt if the borrower was originally identified based on "secrets" that were well known to be public at the time. Maybe then they would come up with a better authentication scheme than "what color was your first car?"
  - samstave 9y ago
    What would happen if the DB was widely available and many many people just randomly and inexplicably opened as many ranom accounts as possible - it would cause chaos in the economy. What would an accurate "what if" scenario like this look like?
    - _jal 9y ago
      That's the first five minutes. Then the market for new consumer credit would seize up, banking share prices would flip out, and talking heads on cable would have something new to hyperventilate over. Overall, many thousands of folks would have their home plans/vacation/card-flipping/whatever plans screwed up, some thousands would have a more severe financial problem, the banks would muddle through, "we'd" rebuild the financial-surveillance system over again, and it would probably be less stupid in some ways at the cost of being more uniformly intrusive.
  - thephyber 9y ago
    Maybe then enough people at the same time would pressure state and federal legislators to regulation suspicious data brokers and creditors (and/or address insufficient/broken authentication in new credit accounts). The Target breach was the thing that finally catalyzed the move from magstripe ccs to EMV ccs. I think we are currently on the precipice of the point when we need to move towards a second factor of authentication ("something you have" or "something you are" in addition to the lots of "something you know" that the current credit bureau system uses).
ocdtrekkie 9y ago
The thing is, up until now, there was a false sense of security that if someone didn't have your SSN, they couldn't open up financial accounts as you. And there was little being done to protect people whose SSNs are already disclosed in some way. With such a large percentage of our social security numbers being potentially outright public, financial institutions need to stop assuming that an account holder is legitimate because they provide an SSN. And it is in their best interests to do so, since they end up on the hook in most cases for fraudulent accounts (after putting you through an awful process to prove it isn't yours). For example, rather than letting someone sign up for an account with the SSN as a verification of identity, new credit accounts could potentially be considered probationary (or just outright not created) until a one-time code is mailed to the credit holder's established home address (based on their existing credits and payment history) as confirmation that the real person with that SSN authorizes that transaction. While such a step would not be completely impossible to defeat, it would mitigate attackers on the other side of the globe opening fraudulent accounts.
- peter303 9y ago
  Agreed. If you used medical services in any significant way before 2010, your SS and birthdate was all over the place in insurance and medical records.

sschueller 9y ago

This issue has existed before the hack. None of these companies give a shit about security. Maybe this will change things.

nkrisc 9y ago
They won't care until they have to personally pay out of pocket. Many of us probably will, but they won't.

pavel_lishin 9y ago

> It's going to cost everyone thousands of dollars over their lives for credit fraud protection. In my mind, the Just thing to do would be for Equifax to offer ongoing fraud protection to all of their customers affected by this leak. (Gosh, that might be expensive!)

rhizome 9y ago
I mean sure, if they can't make fraud-avoidance part of their fundamental business model.

jimktrains2 9y ago

It's also extortion. "Please pay us money to solve the massive problem we created." I don't know how it's legal.

martin1975 9y ago
The legal term is racketeering (https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corrupt_Organizations_Act https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corru...).
13of40 9y ago
Not saying it would be great in the short term, but I wonder how it would play out if the entire database was made widely available. It seems like it would be a lot harder to enforce a debt if the borrower was originally identified based on "secrets" that were well known to be public at the time. Maybe then they would come up with a better authentication scheme than "what color was your first car?"
- samstave 9y ago
  What would happen if the DB was widely available and many many people just randomly and inexplicably opened as many ranom accounts as possible - it would cause chaos in the economy. What would an accurate "what if" scenario like this look like?
  - _jal 9y ago
    That's the first five minutes. Then the market for new consumer credit would seize up, banking share prices would flip out, and talking heads on cable would have something new to hyperventilate over. Overall, many thousands of folks would have their home plans/vacation/card-flipping/whatever plans screwed up, some thousands would have a more severe financial problem, the banks would muddle through, "we'd" rebuild the financial-surveillance system over again, and it would probably be less stupid in some ways at the cost of being more uniformly intrusive.
- thephyber 9y ago
  Maybe then enough people at the same time would pressure state and federal legislators to regulation suspicious data brokers and creditors (and/or address insufficient/broken authentication in new credit accounts). The Target breach was the thing that finally catalyzed the move from magstripe ccs to EMV ccs. I think we are currently on the precipice of the point when we need to move towards a second factor of authentication ("something you have" or "something you are" in addition to the lots of "something you know" that the current credit bureau system uses).

ocdtrekkie 9y ago

The thing is, up until now, there was a false sense of security that if someone didn't have your SSN, they couldn't open up financial accounts as you. And there was little being done to protect people whose SSNs are already disclosed in some way. With such a large percentage of our social security numbers being potentially outright public, financial institutions need to stop assuming that an account holder is legitimate because they provide an SSN. And it is in their best interests to do so, since they end up on the hook in most cases for fraudulent accounts (after putting you through an awful process to prove it isn't yours). For example, rather than letting someone sign up for an account with the SSN as a verification of identity, new credit accounts could potentially be considered probationary (or just outright not created) until a one-time code is mailed to the credit holder's established home address (based on their existing credits and payment history) as confirmation that the real person with that SSN authorizes that transaction. While such a step would not be completely impossible to defeat, it would mitigate attackers on the other side of the globe opening fraudulent accounts.

peter303 9y ago
Agreed. If you used medical services in any significant way before 2010, your SS and birthdate was all over the place in insurance and medical records.