13 ms·

Counterintuitively, this is evidence that the Equifax breach isn't necessarily going to cause massive harm. If someone wanted to impersonate you, they could alr

• waqf 9y ago
  > the world The United States. I assure you that even though other countries have credit reporting, they do not use SSNs. > will have no choice but to finally switch to a new system. Really? I think they will just carry on unless and until the financial downside (losses from extending bad credit, or lawsuits from identity theft victims, or penalties from the federal government intervening directly) is shown to be really huge.
  • sillysaurus3 9y ago
    Fixed, thanks. What do you feel are some sensible systems used by the rest of the world? One that's hopefully hard enough to break but easy enough not to cause massive hassles.
    • kmonsen 9y ago
      Better checks by the banks, they need to take responsibility when opening accounts and not rely on the credit bureaus. This could mean slightly more expensive banking services.
    • user5994461 9y ago
      To confirm your identify: national ID card, passport or driver license. To confirm your income: Your yearly income tax sheet, a payslip or your contract of employment. There is really no reason whatsoever for credit check and background check agencies to exist. All they do is ask for these papers anyway.
      • harryh 9y ago
        It's worth noting that the perpetrator in the bloomberg article had a fake driver's license in the name of the victim. So ID cards aren't a complete solution either.
        • mcguire 9y ago
          Not to mention the other documents from the GP.
        • u801e 9y ago
          Couldn't they verify the authenticity of the drivers license by contacting the department of motor vehicles? One shouldn't verify documents unless you're a member of the organization that issued them.
          • djsumdog 9y ago
            It was most likely a real license. Credit checks use the DL number. You need an SSN card to get a license or ID card and the SSN card is gained using security questions and has no photo, fingerprints or biometrics associated with it. I remember needing to get a new SSN card once and it was creepy how easy it was.
  • incompatible 9y ago
    Other countries have the equivalent of SSNs, i.e., a number issued by the government tax collector. However, other countries don't use it as a form of ID. In my experience, they use passports, ID cards, drivers licenses, etc., which are supposedly "hard to forge".
    • incompatible 9y ago
      These systems don't work well remotely, of course. Sometimes an organisation will accept an upload of a scan or a mailing of a photocopy. They sometimes require it to be signed by a somebody to verify that it's genuine (e.g., a Justice of the Peace). But by doing that, the "hard to forge" feature is lost entirely.
      • my_ghola 9y ago
        They do use a scan or a photocopy, but having that stored it is easier to check the identity of the real person once they claim there was identity theft.
        • incompatible 9y ago
          The "verified photocopies" can be a bit of a joke. I know somebody who was having trouble finding enough ID for something. They printed an online bank statement, photocopied it, and got a JP to verify the photocopy against the original printout.
      • kilotaras 9y ago
        Ukraine is experimenting and slowly rolling out an oauth-like system called BankID, where you bank can provide information to third party.
        • novium 9y ago
          At first I was surprised by you mentioning Ukraine and BankID, especially since it's developed by Swedish banks. But reading about it now makes it seem like they are branching out to other European countries as well. Over here it's basically used for everything that needs authentication / signatures - taxes, banking etc.
  • Maarten88 9y ago
    I think the eagerness of US banks to offer credit is a big part of the problem. Having people endebted is an essential part of the system of wealth transfer and class control, and the system is set up to make this really easy. In the Netherlands, where I live, it might also be possible to obtain a fake id if someone would go through the length this impersonator went through, but I think it would be much harder to open bank accounts and get meaningful credit without questions being asked. What I do not understand is why victims of this have not sued their banks over this yet. Suing should be the US couterbalance to this. People are innocent victims of fraudulent behaviour of their banks, and those banks are being robbed by thieves. Banks are supposed to guard their customers' money, which in this case they are clearly not doing. Maybe they do it unknowingly, or they are incompetent, but in the end those banks are behaving fraudulently too.
    • roel_v 9y ago
      While not a bank account, let's not be smug about our country: http://m.telegraaf.nl/binnenland/article/24095858/man-in-problemen-door-identiteitsdiefstal http://m.telegraaf.nl/binnenland/article/24095858/man-in-pro... . (For the non Dutch speakers, Amsterdam guy had several houses rented in his name, some of which were used for mj plantations, and various other expenses incurred in gis name). Identity theft is not just because of ssn or other unique semi secret numbers. It's part of it, yes, but the root cause is a combination of culture and lack of inventive (ie, identity theft is just not a big enough problem for actors to care).
    • jackskell 9y ago
      Or, they have relinquished their ability to legal redress in court AS A CONDITION of doing business with them, agreeing to arbitration.
      • defined 9y ago
        This is a HUGE issue in the USA, one which, apparently, too few people know about, or take seriously. More and more companies are insisting on customers signing binding arbitration clauses as a condition of doing business: car dealers, banks, airlines, you mention it. It's all very well to say, well, don't do business with them, when all the competition are doing the exact same thing. If you need, say, a new car, well, good luck getting one without signing most of your rights away, and this is no exaggeration. Binding mandatory arbitration clauses mean that you cannot sue the company, and agree to accept the verdict of the arbitrator, for which there is no appeal, and who is generally hired by the company having the arbitration dispute and is therefore impartial /s. I have read FTC field reports about vehicle warranty claims where one arbitration decision was so outlandish even the FTC wrote that it was irrational, and the vast majority were in favor of the dealer.
  • freeflight 9y ago
    > The United States. I assure you that even though other countries have credit reporting, they do not use SSNs. They use ID cards with at least some features to make forging said ID cards more difficult, unlike the US SSN which is pretty much just a number on a piece of paper. This is mainly an issue of authentification and as long as your credentials remain crappy/easy to guess/easy to forge (like the US SSN system), that long it will stay easy to game the system. Imho this def con talk about birthing and killing virtual babies might also be quite relevant to the issue, tho it's not entirely focused on the US: https://www.youtube.com/watch?v=9FdHq3WfJgs https://www.youtube.com/watch?v=9FdHq3WfJgs
  • chimeracoder 9y ago
    > I assure you that even though other countries have credit reporting, they do not use SSNs. No, but many use systems which are not appreciably better than SSNs from a security and identity theft perspective.
• noncoml 9y ago
  > Counterintuitively, this is evidence that the Equifax breach isn't necessarily going to cause massive harm. If someone wanted to impersonate you, they could already. This argument doesn't not follow logically. It's like saying you shouldn't lock your house because if somebody really wants to get in, they will do it.
  • sillysaurus3 9y ago
    Yes and no. At a certain point, if people keep breaking into our houses, it's a good idea to think about the locks we use.
    • noncoml 9y ago
      That's a different argument, than the one in the first line, to which I completely agree.
  • matz1 9y ago
    It does follow. Not locking your house is not going to cause massive harm. If somebody really wants to get in, they will do itm
    • noncoml 9y ago
      I guess you leave your front door open every morning before leaving for work?
      • matz1 9y ago
        We are talking about leaving door unlocked, not leaving the door open. I lock the door every morning out of habit but I'm pretty sure its unlikely that something happen if I don't.
        • noncoml 9y ago
          I don't know what you are trying to argue about, but somebody got hold of personal details, SSN and credit card details of 140 million people. The argument that it is ok, because anyway if somebody wanted it really hard they would find a way to get my personal details, is illogical.
• incompatible 9y ago
  How would a more secure system work? Biometrics? Smart cards?
  • sampo 9y ago
    > How would a more secure system work? Just look what many other countries do.
    • incompatible 9y ago
      I'm not sure that any country has really solved it convincingly. Sure, they do better than the US and its secret SSNs, but that doesn't say much.
      • incompatible 9y ago
        I mean, countries may have national identity cards with chips and perhaps biometrics that make them hard to forge, but a) I believe there's opposition in the US to identity cards b) do they help establish identity remotely, e.g., online?
        • detaro 9y ago
          You can activate German ID cards to work as RFID smartcards for online identification. Practically, there aren't all that many places to do it, and not many people do so. You also need a smartcard reader, but those were available reasonably cheap (no idea if a smartphone with NFC can do it or not) (You also can have a certificate on it, but they missed an opportunity and didn't make it default, you have to ask for and pay extra for that. Would have been a chance to widely roll out certificates of the standard necessary to legally replace signatures, instead of other crap that has been proposed as a replacement sigh)
        • twiss 9y ago
          The Netherlands has an OAuth system for online identity verification, called DigiD, for anything government-related (taxes, healthcare, etc.) Other than that, occasionally a service asks for a copy of your passport, although that's not really allowed.
• quuquuquu 9y ago
  >the US will have no choice [but to switch to a better, non-SSN based system] I absolutely hope this happens too... ... but I have a feeling all of the banks and agencies involved will find a way to plug their ears more and pretend nothing is wrong. They will look at how costly and complex it is to create a halfway decent identity system (even though it's really not hard, other countries do it just fine with digital and physical keys/tokens). And they will just continue to push the burden of ID theft onto consumers, rather than their businesses.
• rxhernandez 9y ago
  This logic is so impressively bad I don't know where to begin. Okay how about this, I'm going to pretend I lack morals for a second. I would do this with the information: 1. Write a script to webscrape sites like LinkedIn to find out if a name/address/ssn key could be tied to people like doctors, engineers and whoever else might have sufficient disposable income. 2. I would take out loans in their name. If I have to be there in person, I would go from city to city and find people I could easily get dirt on, like people that might be here illegally. I would then cut them in for a piece of the loan and then move onto a random city in a 200 mile radius. 3. Move away after I get away with enough to live on for the rest of my life. 4. Hell I might just sell the rest of the information and scripts to other people who lack scruples.
  • sillysaurus3 9y ago
    And you'd end up in prison pretty quickly. The point is, it'd be worth the pain. We'd come out of it with a better system.
  • usaphp 9y ago
    The flaw in your logic lays with the bank. You will need a bank account/visit branch/transfer loaned money somewhere where you can cash them. Banks have cameras + Irs will quickly find you and won't allow you disappear or use that money
    • deleted 9y ago
      [deleted]
    • rxhernandez 9y ago
      The flaw in your logic is that you fail to realize i have access to 143 million bank accounts and can transfer any number of ways I want to. You also overestimate the competence of smaller banks. Neglecting all of that you do realize that International wire transfers do exist right?
      • usaphp 9y ago
        It takes 1-3 business days for a US bank to transfer any amount and I am sure it will be even higher if the transaction is not matching a usual pattern of your victim. So 144 million bank accounts mean nothing with such long processing delays
• pmorici 9y ago
  Start issuing everyone a FIPS 201-2 PIV card instead of those flimsy paper cards the SSN's are currently printed on.
• snarf21 9y ago
  The big problem is switch from SSN to what? Just another number that serves the same purpose? SSN is fine, what we need is the right for our credit to always be frozen and anyone who grants credit outside of our approval is liable for the loss. We also just need to bite the bullet and make chip and pin mandatory everywhere. We don't need to make identity theft impossible just reasonably hard. Other nations seem to have it figured out.
  • narrator 9y ago
    All they need is an ssn you can change if it gets stolen. To change it all that's needed is to go into a government office and do a biometric scan in person. That would be so ridiculously easy. Of course the government will never let a good crisis go to waste. Instead, we will all get chips under our skin that can't be removed that will be passively scanned by the authorities everywhere we go.
    • pas 9y ago
      SSN is a primary key, not a shared secret. The entire problem is that people started using SSN as a shared secret, but it was classic password reuse. Use the same secret every fucking where. No. If you want to establish trust, use a random secret for each new trust relationship. If you want to establish identity ask the identity providers what kind of anti-forgery guarantees they provide. Oh, nothing, you say!? Then don't use that provider. Banks are trying to use easy to forge things to make sure they won't lose money. Sounds like stupidity. So they limit their stupidity (hence you can't just register for a credit card online, otherwise bored Russian teenagers would have already bankrupted them).
      • narrator 9y ago
        What if, when you replaced your SSN, banks could use a system that would return "invalid SSN" on any new credit application. The existing accounts would be suspended unless you called them and updated your SSN. It would be about as much as a hassle as updating all of one's autopays when a credit card number gets stolen.
• eastWestMath 9y ago
  I think I've seen you defending Equifax on every post related to identity theft since the breach. Do you work there or something, why are you so invested in this?
• tryingagainbro 9y ago
  The SSN shouldn't be the critical key in that list. So it would a "Credit ID," Passport Number, DL #, or something related. What's the difference, it will need to be stored next all your stuff, awaiting to be stolen. Now the banks eat the small % caused by fraud (cost of doing biz), your life is hell, but not theirs. Scan your iris before getting the new loan isn't going to happen either, too costly and slow. If they ever do that online, they'll find a way to recreate that based on your existing scan, stored at the future Experian.
  • watwut 9y ago
    I haven't seen password I'd or national card I'd used as identification, ever. The way it works is that you bring it physically and they look into it. Or that you send photo of the id (yes that is easier to forge, then again harder then forging utility bill) - that is done only where it is impossible to do physical check and never with loans and such. Identity theft in Europe is extremely rare. It is possible to do something in your name, sure, but it does not happen nowhere near as often and damage is limited compared to ssn system.
    • tryingagainbro 9y ago
      >> The way it works is that you bring it physically and they look into it. Not gonna happen, banks for now will rather swallow the relatively low loses due to fraud. In USA you sign a piece of paper (pre-approved loan), or login online and the loan money is deposited in your account within a few days. All automated. So far it works out for them, if fraud loses increase, the banks, not us, will choose the next method. And Congress will approve it within weeks.
      • rocqua 9y ago
        The issue is that fraud causes more loss than just for the bank. Whomever got impersonated is also fucked. At the moment, they have very little recourse to recoup their costs from the bank that got fooled.
  • ProblemFactory 9y ago
• joshmn 9y ago
  Hate to break it to you, but with very minimal browsing and $4 in bitcoin, anyone can buy any SSN of a US person born after 2003.
  • nitrogen 9y ago
    anyone can buy any SSN of a US person born after 2003. Why only 14-year-olds and younger?
    • tscs37 9y ago
      Because the kids these days will enter their SSN and their parent's Credit Card into anything that looks like flappy bird to unlock the extra jump boost or something like that.
      • joshmn 9y ago
        That wouldn't explain my sister's.
    • joshmn 9y ago
      I haven't the base, and there are conflicting sources about where the base came from (only two persons have it that I know of)
• Tomte 9y ago
  > if that happens, the US will have no choice but to finally switch to a new system. Impossible. A large part of the American people is obsessed with "the government is going to oppress us all". National IDs or anything similarly working are therefore a big no-go. If you could solve this problem, you could presumably also solve the gun debate to a large degree.
  • criddell 9y ago
    There's also a lot of people that object to a national ID number on religious grounds. These people vote and seem to be influential.
• glitcher 9y ago
  > “Once you have somebody's name, social, birth date, and address, you can go and open new accounts.” >The SSN shouldn't be the critical key in that list. Nothing in that list is secret.
• md_ 9y ago
  I recently had the brilliant idea that someone should create a site where we all enter our social security numbers and personal information (DOB, name, etc), with the promise that once the site collects, say, 100M verified records, all of them will be released. Seems like an opportunity to force the hand. I, like you, imagine such an action would induce systemic change. Maybe.
• stretchwithme 9y ago
  The hassles and inconvenience this problem causes victims is sort of an unpriced externality of the credit industry. If those extending credit had to compensate the victims for their negligence, maybe they'd stop being so negligent. And it would help if individual making the faulty decision to extend credit lost all their commissions for the week. It should be a blight on their record, with more than 5 instances causing them to lose their jobs. And CEO of the worst offending company gets a hefty fine. Maybe that would focus the industry on solving this problem.