4 ms·

> I'm arguing that we have two other credit reporting agencies that appear to be functioning properly, and one that looks like it is in a continuing state of dy

> I'm arguing that we have two other credit reporting agencies that appear to be functioning properly, and one that looks like it is in a continuing state of dysfunction. I strongly suggest you do some research about that. You'll find that the other two CRAs have been equally "negligent" at different times. > I just want to know what other kind of business in America would still have any customers after the two weeks that Equifax has just had? Remember the Target data breach? Or the Home Depot breach? How about when Sony was distributing a rootkit on their music CDs? Or when Lenovo was distributing a malware package preinstalled on their laptops? Or when Best Buy was selling digital picture frames that had a virus? The list, sadly, goes on and on and on... > Do you think that Equifax should now have the right to continue operating, all things considered? Of course. Since you're here on Hacker News, I presume you must have some knowledge of computer security...do you really think it was negligence that caused all of this? Do you think that the other CRAs are in any way more secure or less negligent? Or banks? Or any business that uses, say Cisco switches (which have tons of vulnerabilities)? Or businesses that uses Microsoft Windows (too many viruses and worms to count)?

yebyen 9y ago
I'm personally more upset about their continued incompetence in their response to the breach, than about the breach itself. I'm sorry I can't write more right now... First they suppressed valuable information in the form of interviews with their CISO that were public until September 10, when they came down for some reason. Then they started tweeting out links to a phishing site that looked just like their own "equifaxsecurity2017" site. About this time, the CIO and CISO were removed from the picture entirely. A few days later, each of these gaffes became known. Meanwhile they had delayed long past the timeline outlined in legal requirements for their reporting of the breach. Where are the Congressional interviews with their executive directorship? Not on the calendar yet, why don't we schedule it for next February 30th. First of never. I'm just as incensed about the (seeming lack of) response of law enforcement, which admittedly I don't personally have much visibility into, but seems inadequate. At a minimum I would argue that Equifax needs a "time-out." Ideally they would not be handling the response to this situation at all. They should go on the hook to pay someone competent to handle the response.
- g051051 9y ago
  > Then they started tweeting out links to a phishing site that looked just like their own "equifaxsecurity2017" site. Not much to say about that one, for sure. I still don't understand why they wanted to make a completely separate site with that stupid name. > Meanwhile they had delayed long past the timeline outlined in legal requirements for their reporting of the breach. I think you'll find that they adhered to the letter of the law on that. Maybe you know when Equifax made the breach public, but you don't know when they first contacted the relevant authorities (law enforcement or regulatory). > Where are the Congressional interviews with their executive directorship? Oh, that's coming, for sure. Other companies have been called before congress for far less. But what good has ever come out of such a hearing? That's what you do when you want to save face with the American public and seem like you're going to do something. There might be hope...Al Franken is the ranking member on what I think is the relevant committee, and he usually does a good job in calling out BS when he sees it. > I'm just as incensed about the response of law enforcement How so? What would you expect from law enforcement here?
  - yebyen 9y ago
    > How so? What would you expect from law enforcement here? Copied from another sub-thread I posted in... When Sonny Vleisides plead guilty to Felony Mail Fraud in 2007, he was forbidden to engage in loan programs, gambling or gaming activities, telemarketing activities, investment programs or any other business involving the solicitation of funds. He went on to co-found the company called Butterfly Labs in 2010, a company that took pre-orders for Bitcoin mining equipment (in many cases soliciting funds for hardware that didn't exist, until it did). Many people argued that this business model was a direct violation of the terms of his supervised release. He stood in front of a judge in 2014 that said there was a "strong smell" of fraud with respect to his company. Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world. When does Equifax get their 14 months in jail followed by a supervised release? Never, apparently, they just go on about their business and no charges are filed. I would expect for them to get a "time-out" after their bungling of the response to this breach, at the bare minimum. But no, let's give them a participation trophy instead, let them continue handling the response to the breach, they've earned it...
yebyen 9y ago
> Remember the Target data breach? Or the Home Depot breach? How about when Sony was distributing a rootkit on their music CDs? Or when Lenovo was distributing a malware package preinstalled on their laptops? Or when Best Buy was selling digital picture frames that had a virus? I remember all of those things, and NONE of them were on the scale or level of impact of the Equifax breach. People who were affected by the Target breach, got replacement cards and moved on with their lives. Lenovo's malware package could be uninstalled and their hard drives could be reformatted. People who are affected by Equifax breach... can do what? We are ALL affected by this breach. Every last American Citizen. The credit system itself, as we currently know it, now hangs in the balance. I know that ALL of the credit reporting agencies have similar poorly designed systems, and THAT is EXACTLY what I am so goddamned mad about. Because THAT is a fact that is NOT going to change as a result of this. You know it and I know it! We will still have the same 3 credit reporting agencies a year from now, and Equifax will STILL be profitable after whatever fines are imposed. We Need To Seriously Change This Shit Right.Fucking.Now! (NB. I have no specific suggestion, but I am so furious because of your apparent suggestion that there is no line that Equifax or any other CRA can cross that will earn them an honest decapitation. If not now, then when?) This should NOT have been possible in any reasonable system designed to store sensitive data on every last American with a credit history, and the fact that it happened is all the evidence of negligence that you need. Someone exfiltrated ALL of the information they need to impersonate ANY American citizen with a credit file. Nobody in particular needs to be held criminally negligent. No redress will make me happy about what has happened. The game is just over. The system is fucked, there's nothing left for them to protect. "Not for Identification Purposes" it's time to read the words on the card, and take them seriously.
- g051051 9y ago
  > NONE of them were on the scale or level of impact of the Equifax breach. I concede the possibility. > We are ALL affected by this breach. POTENTIALLY affected. There's been no disclosure of exactly how many records were accessed...I don't think they know, but it seems highly unlikely that their entire credit database could have been exfiltrated in that amount of time. > I know that ALL of the credit reporting agencies have similar poorly designed systems They don't actually. They tend to have above average security. It's just that it CANNOT be perfect. Just like we can't stop viruses, but Windows is still around. > I am so furious because of your apparent suggestion that there is no line that Equifax or any other CRA can cross that will earn them an honest decapitation. How about real criminal activity? You keep glossing over the point that Equifax was victimized here as well. What criminal intent, or even legitimate incompetence, can you claim that even remotely justifies that sort of reaction? Do you think this is Enron-level criminality? That was flat-out fraud, proven in court. > the fact that it happened is all the evidence of negligence that you need You're sadly mistaken as to the efficacy of computer security. The fact that it hasn't happened before, for a company that must be a target under constant and unrelenting assault, is actually a testimony to the how well they were maintaining security. > "Not for Identification Purposes" it's time to read the words on the card, and take them seriously. 100% agreement on this.

yebyen 9y ago

I'm personally more upset about their continued incompetence in their response to the breach, than about the breach itself. I'm sorry I can't write more right now... First they suppressed valuable information in the form of interviews with their CISO that were public until September 10, when they came down for some reason. Then they started tweeting out links to a phishing site that looked just like their own "equifaxsecurity2017" site. About this time, the CIO and CISO were removed from the picture entirely. A few days later, each of these gaffes became known. Meanwhile they had delayed long past the timeline outlined in legal requirements for their reporting of the breach. Where are the Congressional interviews with their executive directorship? Not on the calendar yet, why don't we schedule it for next February 30th. First of never. I'm just as incensed about the (seeming lack of) response of law enforcement, which admittedly I don't personally have much visibility into, but seems inadequate. At a minimum I would argue that Equifax needs a "time-out." Ideally they would not be handling the response to this situation at all. They should go on the hook to pay someone competent to handle the response.

g051051 9y ago
> Then they started tweeting out links to a phishing site that looked just like their own "equifaxsecurity2017" site. Not much to say about that one, for sure. I still don't understand why they wanted to make a completely separate site with that stupid name. > Meanwhile they had delayed long past the timeline outlined in legal requirements for their reporting of the breach. I think you'll find that they adhered to the letter of the law on that. Maybe you know when Equifax made the breach public, but you don't know when they first contacted the relevant authorities (law enforcement or regulatory). > Where are the Congressional interviews with their executive directorship? Oh, that's coming, for sure. Other companies have been called before congress for far less. But what good has ever come out of such a hearing? That's what you do when you want to save face with the American public and seem like you're going to do something. There might be hope...Al Franken is the ranking member on what I think is the relevant committee, and he usually does a good job in calling out BS when he sees it. > I'm just as incensed about the response of law enforcement How so? What would you expect from law enforcement here?
- yebyen 9y ago
  > How so? What would you expect from law enforcement here? Copied from another sub-thread I posted in... When Sonny Vleisides plead guilty to Felony Mail Fraud in 2007, he was forbidden to engage in loan programs, gambling or gaming activities, telemarketing activities, investment programs or any other business involving the solicitation of funds. He went on to co-found the company called Butterfly Labs in 2010, a company that took pre-orders for Bitcoin mining equipment (in many cases soliciting funds for hardware that didn't exist, until it did). Many people argued that this business model was a direct violation of the terms of his supervised release. He stood in front of a judge in 2014 that said there was a "strong smell" of fraud with respect to his company. Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world. When does Equifax get their 14 months in jail followed by a supervised release? Never, apparently, they just go on about their business and no charges are filed. I would expect for them to get a "time-out" after their bungling of the response to this breach, at the bare minimum. But no, let's give them a participation trophy instead, let them continue handling the response to the breach, they've earned it...

yebyen 9y ago

> Remember the Target data breach? Or the Home Depot breach? How about when Sony was distributing a rootkit on their music CDs? Or when Lenovo was distributing a malware package preinstalled on their laptops? Or when Best Buy was selling digital picture frames that had a virus? I remember all of those things, and NONE of them were on the scale or level of impact of the Equifax breach. People who were affected by the Target breach, got replacement cards and moved on with their lives. Lenovo's malware package could be uninstalled and their hard drives could be reformatted. People who are affected by Equifax breach... can do what? We are ALL affected by this breach. Every last American Citizen. The credit system itself, as we currently know it, now hangs in the balance. I know that ALL of the credit reporting agencies have similar poorly designed systems, and THAT is EXACTLY what I am so goddamned mad about. Because THAT is a fact that is NOT going to change as a result of this. You know it and I know it! We will still have the same 3 credit reporting agencies a year from now, and Equifax will STILL be profitable after whatever fines are imposed. We Need To Seriously Change This Shit Right.Fucking.Now! (NB. I have no specific suggestion, but I am so furious because of your apparent suggestion that there is no line that Equifax or any other CRA can cross that will earn them an honest decapitation. If not now, then when?) This should NOT have been possible in any reasonable system designed to store sensitive data on every last American with a credit history, and the fact that it happened is all the evidence of negligence that you need. Someone exfiltrated ALL of the information they need to impersonate ANY American citizen with a credit file. Nobody in particular needs to be held criminally negligent. No redress will make me happy about what has happened. The game is just over. The system is fucked, there's nothing left for them to protect. "Not for Identification Purposes" it's time to read the words on the card, and take them seriously.

g051051 9y ago
> NONE of them were on the scale or level of impact of the Equifax breach. I concede the possibility. > We are ALL affected by this breach. POTENTIALLY affected. There's been no disclosure of exactly how many records were accessed...I don't think they know, but it seems highly unlikely that their entire credit database could have been exfiltrated in that amount of time. > I know that ALL of the credit reporting agencies have similar poorly designed systems They don't actually. They tend to have above average security. It's just that it CANNOT be perfect. Just like we can't stop viruses, but Windows is still around. > I am so furious because of your apparent suggestion that there is no line that Equifax or any other CRA can cross that will earn them an honest decapitation. How about real criminal activity? You keep glossing over the point that Equifax was victimized here as well. What criminal intent, or even legitimate incompetence, can you claim that even remotely justifies that sort of reaction? Do you think this is Enron-level criminality? That was flat-out fraud, proven in court. > the fact that it happened is all the evidence of negligence that you need You're sadly mistaken as to the efficacy of computer security. The fact that it hasn't happened before, for a company that must be a target under constant and unrelenting assault, is actually a testimony to the how well they were maintaining security. > "Not for Identification Purposes" it's time to read the words on the card, and take them seriously. 100% agreement on this.