3 ms·

And when you sign up for [website X], there's never an explicit "and I authorize you to store my data in AWS" and yet that's exactly what happens. You are tryi

And when you sign up for [website X], there's never an explicit "and I authorize you to store my data in AWS" and yet that's exactly what happens. You are trying to draw boundaries that don't exist.

yebyen 9y ago
They don't need permission to store the identifying personal data about me for some reason (they, Equifax, the entity that I have no direct relationship with...) what was that reason exactly? Medical providers would not store your personally identifying information without permission, even if it was shared with them. You can ask a health care provider to furnish you with your records and delete their copy at any time, if I'm not mistaken. Shouldn't they have some kind of licensing requirement in order to be held accountable for their security practices? Where is the line, that when they cross it, they should lose their accreditation? There isn't one, because there is no such accreditation (not to my knowledge anyway.) It is not reasonable if there are only 3 credit reporting agencies and they do not have any licensing requirements. If I am mistaken about this, please correct me.
- caseysoftware 9y ago
  I agree that some boundaries, licensing, and potentially security requirements make a ton of sense. I'm cautiously for them. (Only cautiously because the govt can't get their own act together most of the time.) But as of now, those requirements don't apply to them. So acting like they do is distracting at best. Let's figure out ways: a) to know what they have, b) to force them to accept corrections, and c) add major negative consequences if/when they f* up.
  - yebyen 9y ago
    If we can't have reasonable licensing requirements, then we need a "right to be erased" like they have across all of the European states. If 140MM Americans (or even 50MM, let's be reasonable) told Equifax that they wanted to be removed from their database in response to the breach, and Equifax was required to honor those requests, it would be a step in the right direction. That would be enough to put some "fear of God" into the shareholders at the remaining credit reporting agencies, and it does not sound like an unreasonable request at all. Companies going forward would have a disincentive to do business with Equifax, because 1/3 of people are missing from their database. (Instead, we're all permitted to buy more "Credit Freeze and Monitoring" solutions from Equifax, for the low price of $0, plus a low low payment of $10 every time we need to freeze or unfreeze our credit again to access it in the future. So let's dig the hole even deeper!) Citizens that want to have credit would not be incentivized to remove their credit history from all three reporting agencies; as you probably already know, having no credit history is worse than having a bad credit history. Then again, if we allowed that, then what's to stop those hackers from benevolently making the request on behalf of all 140MM people whose information they have appropriated. There is no negative consequence that will incentivize Equifax to do better next time, if the result of this breach and their subsequent bungling of the response, is that they are allowed to continue operating their business without interruption. Take the keys to the car away from the drunk driver. That's step one.

And when you sign up for [website X], there's never an explicit "and I authorize you to store my data in AWS" and yet that's exactly what happens. You are trying to draw boundaries that don't exist.

yebyen 9y ago

They don't need permission to store the identifying personal data about me for some reason (they, Equifax, the entity that I have no direct relationship with...) what was that reason exactly? Medical providers would not store your personally identifying information without permission, even if it was shared with them. You can ask a health care provider to furnish you with your records and delete their copy at any time, if I'm not mistaken. Shouldn't they have some kind of licensing requirement in order to be held accountable for their security practices? Where is the line, that when they cross it, they should lose their accreditation? There isn't one, because there is no such accreditation (not to my knowledge anyway.) It is not reasonable if there are only 3 credit reporting agencies and they do not have any licensing requirements. If I am mistaken about this, please correct me.

caseysoftware 9y ago
I agree that some boundaries, licensing, and potentially security requirements make a ton of sense. I'm cautiously for them. (Only cautiously because the govt can't get their own act together most of the time.) But as of now, those requirements don't apply to them. So acting like they do is distracting at best. Let's figure out ways: a) to know what they have, b) to force them to accept corrections, and c) add major negative consequences if/when they f* up.
- yebyen 9y ago
  If we can't have reasonable licensing requirements, then we need a "right to be erased" like they have across all of the European states. If 140MM Americans (or even 50MM, let's be reasonable) told Equifax that they wanted to be removed from their database in response to the breach, and Equifax was required to honor those requests, it would be a step in the right direction. That would be enough to put some "fear of God" into the shareholders at the remaining credit reporting agencies, and it does not sound like an unreasonable request at all. Companies going forward would have a disincentive to do business with Equifax, because 1/3 of people are missing from their database. (Instead, we're all permitted to buy more "Credit Freeze and Monitoring" solutions from Equifax, for the low price of $0, plus a low low payment of $10 every time we need to freeze or unfreeze our credit again to access it in the future. So let's dig the hole even deeper!) Citizens that want to have credit would not be incentivized to remove their credit history from all three reporting agencies; as you probably already know, having no credit history is worse than having a bad credit history. Then again, if we allowed that, then what's to stop those hackers from benevolently making the request on behalf of all 140MM people whose information they have appropriated. There is no negative consequence that will incentivize Equifax to do better next time, if the result of this breach and their subsequent bungling of the response, is that they are allowed to continue operating their business without interruption. Take the keys to the car away from the drunk driver. That's step one.