11 ms·
(FYI mods this is a repost of my original submission: https://news.ycombinator.com/item?id=15294218 https://news.ycombinator.com/item?id=15294218) Ideally Equi
by nikisweeting 9y ago
(FYI mods this is a repost of my original submission: https://news.ycombinator.com/item?id=15294218 https://news.ycombinator.com/item?id=15294218)
Ideally Equifax will listen and either move it to equifax.com, or take down the site altogether. Since the real version seems to be answering randomly, they may as well just shut the whole thing down.
But seeing as they're a massive, bumbling, bureaucratic organization, there's probably a non-zero change they'll try to sue me instead.
If there are any lawyers here, am I in potential legal hot water for making this site?
- krastanov 9y agoI might be missing something, what do you mean by "the real version is answering randomly"?
- SketchySeaBeast 9y agoIf you entered gibberish into the site, it seems it would randomly tell you if you were compromised or not. https://techcrunch.com/2017/09/08/psa-no-matter-what-you-write-equifax-may-tell-you-youve-been-impacted-by-the-hack/ https://techcrunch.com/2017/09/08/psa-no-matter-what-you-wri...
- deleted 9y ago[deleted]
- m3andros 9y agoBehold! Today's National Gibberish Day.
- SketchySeaBeast 9y agoInternational Gibberish Day - they still haven't even made an effort to identify those in Canada and the UK who were affected. It's a whole world of nonsense.
- bionsuba 9y agoSince this signs you up for their ID protection, doesn't this count as fraud?
- SketchySeaBeast 9y agoJust like everything else in regards to this issue - who knows? It's a noisy mess, and the only thing we can be sure of is that it's going to be a never-ending nightmare for a lot of people through absolutely no fault of their own, requiring constant vigilance for the rest of their lives, and the system that built and continues to support this monster isn't going away any time soon.
- throwaway613834 9y agoDoes it? I thought it just tells you if you're compromised.
- mikeash 9y agoFraud is basically lying for profit. There's no profit in putting gibberish into this form, so it's just lying.
- breakingcups 9y agoI think GP means fraud on Equifax's end (by telling you you are compromised even though they shouldn't be able tot ell you that since tha data is fake) to get you to bey into their protection service.
- mikeash 9y agoI hadn't thought of that. If they're lying to get you to sign up for a paid service then that does indeed seem like pretty blatant fraud.
- wheaties 9y agoI am not a lawyer. I would strongly advise you to instead make it so obvious that the site is a lampoon. As in, when they enter, you respond with "This site is a mockery of Equifax. If you were lead here by Equifax or any affiliate, you are at the wrong site. I'm sorry, I can't help you. I can reinforce that if your information was compromised, more people may be attempting you use this to phish additional people."
- nikisweeting 9y agoTry entering some fake data into the form and hitting "Continue", I put a pretty clear message there, but I guess I can also put it elsewhere.
- rory096 9y agos/loose/lose on that alert box
- nikisweeting 9y agoFixed, thanks.
- beager 9y agoDevil's advocate: how does anyone know you're not actually phishing with this site?
- chipperyman573 9y agoYou can watch the network using the network tab in devtools. No data is sent on the form's page.
- beager 9y agoMy point is, a layman may not know that, a judge may not care.
- monochromatic 9y agoequifaxsecurity2017.com sounds like such a scammy site too. It's exactly the kind of thing I'd expect a fake site to be named. Why in the world wouldn't they just put it on their own domain?
- tyingq 9y agoProbably because they wanted to farm it out to some agency with zero dependencies on their known-incompetent internal IT team? You're right of course, but I'm betting that was the motivation.
- mjcl 9y agoMy guess was that they wanted to reduce the chance of news leaking before they announced it. If they're like other large companies I've seen from the inside, changes to the main website involve lots of meetings and lots of people/stakeholders.
- Kluny 9y agoYou'd think even the world's most incompetent IT team could manage to point a subdomain at a remote server, but apparently not.
- mdavidn 9y agoNot without sending every user's equifax.com cookies to that outside agency's servers.
- Kluny 9y agoHmm, point. Of course, there are tons of ways to get around that problem.
- wutwutwutwut 9y agoCan you share the best?
- beager 9y agoIANAL, IANYL, TINLA but I can't imagine that using Equifax's name in your domain, using their branding and IP on your site, impersonating the site very strongly, or even presenting the option to enter sensitive info on your domain will end very well for you. I'd certainly have avoided it, or at least shown good will by having the site on that domain unambiguously say that it's not Equifax.
- nikisweeting 9y agoI just got domain-blacklisted by Chrome, so I'm going to take the site down. I think the point is made, and there are plenty of screenshots out there if people want to see it.
- exikyut 9y agoThe tweet: http://archive.is/h9Xzt http://archive.is/h9Xzt The website: https://archive.is/PjlIK https://archive.is/PjlIK