3 ms·

You don't have to provide consent to having a CRA host "your" data, because you're not the customer unless you buy a product from one of them. CRAs are regulat

You don't have to provide consent to having a CRA host "your" data, because you're not the customer unless you buy a product from one of them. CRAs are regulated by the government, with things like GLBA, CFPB, FCRA, and other acronyms covering what they can and cannot do, what their responsibilities are, etc. The CRAs have all been fined for improper handling of data, failing to adequately vet data provided to customers, etc. CRAs get data from two places primarily: public records and CRA members (banks, credit card companies, retailers, etc.) The public records stuff is just that: public. Anyone can get it if they ask and are willing to pay the costs to gather it. Member data is provided by members to CRAs, and you absolutely grant the right to them to do so when you signed up to use them. When you get a bank account, or credit card, or sign up for a store card, or really agree to do business with any entity on a financial basis, you approved it with your signature. Your statement about "covert surveillance" is factually incorrect. You have a right under the law to view your entire credit file as held by all CRAs once per year. I also think (not sure) that you can get a copy if you're turned down for credit due to information on a credit report. So how is it "covert", if you not only know about it but can see it?

yebyen 9y ago
It's interesting that "your" data is in quotes. I understand what you mean by "your" data and it's a valid point. It's not my data, not in this country anyway, even when it identifies me personally. That's another subject. You have made a substantive comment and I don't have time to respond substantively to any more comments right now unfortunately. I'm not arguing that they didn't have the right to collect the data. I'm arguing that we have two other credit reporting agencies that appear to be functioning properly, and one that looks like it is in a continuing state of dysfunction. There appears to be no end to their ongoing dysfunctional behavior, and no possible remediation for affected parties on the horizon at all. I just want to know what other kind of business in America would still have any customers after the two weeks that Equifax has just had? Do you think that Equifax should now have the right to continue operating, all things considered?
- g051051 9y ago
  > I'm arguing that we have two other credit reporting agencies that appear to be functioning properly, and one that looks like it is in a continuing state of dysfunction. I strongly suggest you do some research about that. You'll find that the other two CRAs have been equally "negligent" at different times. > I just want to know what other kind of business in America would still have any customers after the two weeks that Equifax has just had? Remember the Target data breach? Or the Home Depot breach? How about when Sony was distributing a rootkit on their music CDs? Or when Lenovo was distributing a malware package preinstalled on their laptops? Or when Best Buy was selling digital picture frames that had a virus? The list, sadly, goes on and on and on... > Do you think that Equifax should now have the right to continue operating, all things considered? Of course. Since you're here on Hacker News, I presume you must have some knowledge of computer security...do you really think it was negligence that caused all of this? Do you think that the other CRAs are in any way more secure or less negligent? Or banks? Or any business that uses, say Cisco switches (which have tons of vulnerabilities)? Or businesses that uses Microsoft Windows (too many viruses and worms to count)?
  - yebyen 9y ago
    I'm personally more upset about their continued incompetence in their response to the breach, than about the breach itself. I'm sorry I can't write more right now... First they suppressed valuable information in the form of interviews with their CISO that were public until September 10, when they came down for some reason. Then they started tweeting out links to a phishing site that looked just like their own "equifaxsecurity2017" site. About this time, the CIO and CISO were removed from the picture entirely. A few days later, each of these gaffes became known. Meanwhile they had delayed long past the timeline outlined in legal requirements for their reporting of the breach. Where are the Congressional interviews with their executive directorship? Not on the calendar yet, why don't we schedule it for next February 30th. First of never. I'm just as incensed about the (seeming lack of) response of law enforcement, which admittedly I don't personally have much visibility into, but seems inadequate. At a minimum I would argue that Equifax needs a "time-out." Ideally they would not be handling the response to this situation at all. They should go on the hook to pay someone competent to handle the response.

yebyen 9y ago

It's interesting that "your" data is in quotes. I understand what you mean by "your" data and it's a valid point. It's not my data, not in this country anyway, even when it identifies me personally. That's another subject. You have made a substantive comment and I don't have time to respond substantively to any more comments right now unfortunately. I'm not arguing that they didn't have the right to collect the data. I'm arguing that we have two other credit reporting agencies that appear to be functioning properly, and one that looks like it is in a continuing state of dysfunction. There appears to be no end to their ongoing dysfunctional behavior, and no possible remediation for affected parties on the horizon at all. I just want to know what other kind of business in America would still have any customers after the two weeks that Equifax has just had? Do you think that Equifax should now have the right to continue operating, all things considered?

g051051 9y ago
> I'm arguing that we have two other credit reporting agencies that appear to be functioning properly, and one that looks like it is in a continuing state of dysfunction. I strongly suggest you do some research about that. You'll find that the other two CRAs have been equally "negligent" at different times. > I just want to know what other kind of business in America would still have any customers after the two weeks that Equifax has just had? Remember the Target data breach? Or the Home Depot breach? How about when Sony was distributing a rootkit on their music CDs? Or when Lenovo was distributing a malware package preinstalled on their laptops? Or when Best Buy was selling digital picture frames that had a virus? The list, sadly, goes on and on and on... > Do you think that Equifax should now have the right to continue operating, all things considered? Of course. Since you're here on Hacker News, I presume you must have some knowledge of computer security...do you really think it was negligence that caused all of this? Do you think that the other CRAs are in any way more secure or less negligent? Or banks? Or any business that uses, say Cisco switches (which have tons of vulnerabilities)? Or businesses that uses Microsoft Windows (too many viruses and worms to count)?
- yebyen 9y ago
  I'm personally more upset about their continued incompetence in their response to the breach, than about the breach itself. I'm sorry I can't write more right now... First they suppressed valuable information in the form of interviews with their CISO that were public until September 10, when they came down for some reason. Then they started tweeting out links to a phishing site that looked just like their own "equifaxsecurity2017" site. About this time, the CIO and CISO were removed from the picture entirely. A few days later, each of these gaffes became known. Meanwhile they had delayed long past the timeline outlined in legal requirements for their reporting of the breach. Where are the Congressional interviews with their executive directorship? Not on the calendar yet, why don't we schedule it for next February 30th. First of never. I'm just as incensed about the (seeming lack of) response of law enforcement, which admittedly I don't personally have much visibility into, but seems inadequate. At a minimum I would argue that Equifax needs a "time-out." Ideally they would not be handling the response to this situation at all. They should go on the hook to pay someone competent to handle the response.