2 ms·

Their behavior during the response has been chock full of negligence, and I don't need to prove it in a court of law. I just need you to concede that point, an

by yebyen 9y ago

Their behavior during the response has been chock full of negligence, and I don't need to prove it in a court of law. I just need you to concede that point, and I can go on with my day. :-D They should not have been in charge of the response, but there was no way for us to know that for sure until they had already flubbed it so badly. They are guilty of handling the response very poorly in a way that has been hashed out and rehashed at least six dozen times on HN until the culmination (so far) yesterday, when we found out that their site was so easy to spoof it fooled even Tim, the Twitter guy from Equifax, who tweeted links to the spoof site out to eight or nine customers over the course of the response. That was possible because of their initial poor (evidently hasty, and negligently so) response. I'm not asking to make anyone criminally liable, I'm suggesting that next time a company leaks sensitive records on 140MM Americans, we should remember this chain of events and somehow all do better. (And not have another repeat of this shit show, if possible... but who am I kidding, it will repeat.) The poor response was probably made worse because of their internal culture that resulted in the CIO and CISO being canned (that sounds like all of their top technical leadership put out the door) right as the response was just getting underway. That too, in my opinion, was probably negligence! I know we don't put companies in "time out" but it seems like we had better think about doing exactly that in this case, lest we soon find out what it will look like when the (next) other shoe drops. The Equifax story will only continue to get worse! Just wait until their new free credit monitoring systems are breached, and we get to find out exactly what that mandatory class-action arbitration clause we've all heard about is actually intended to do!

g051051 9y ago
> They should not have been in charge of the response Then who should have? > we should remember this chain of events and somehow all do better. (And not have another repeat of this shit show, if possible... but who am I kidding, it will repeat.) 100% agreement here.
- yebyen 9y ago
  > > They should not have been in charge of the response > Then who should have? Better question: what would be an appropriate response? Because this one isn't, that much is sure, but I don't have an answer for this question other than "one that is not so hastily and shoddily implemented."
  - g051051 9y ago
    You were lamenting about the "delayed" response before, and now you're unhappy with the "hasty" response. Further, do you really think this was a hasty response? This is the response dictated by the law, coupled with recommendations from their legal team, and probably with input from regulators as well.
    - yebyen 9y ago
      It was delayed, in terms of how long it took them to let us know that we could be affected. It was hasty, in terms of... just look at equifaxsecurity2017.com Did they run this plan by even one security researcher before it was put into action? If so, that person's advice was either terrible, or ignored. No time at all had elapsed between the time we were alerted to the breach, and when Equifax revealed the 2-day old site that was protected by Amazon certificate. I am building an HR web portal for employees to submit their identity when they do not go through our background checking service (some classes of employee who are exempt from the requirement to get a background check, for archaic reasons), and I am holding up Equifax's response to the breach as an example of "What Not To Do." There is no legal requirement for them to put up a website that looks like a phishing scam, and respond to people who put in their information with a random value of "Yes you were affected/Check back later to find out if you were affected". There would certainly have been questions about "who was affected" but it would be better to answer with a blanket response of "everyone with a credit file" than to do as they did, and say "143 million Americans, now fill out this pointless form attached to a random number generator to find out if you are one of them."
      - g051051 9y ago
        > There is no legal requirement for them to put up a website that looks like a phishing scam Seriously, what were they thinking? Even the most charitable light isn't enough for this to make sense.

by yebyen 9y ago

g051051 9y ago

> They should not have been in charge of the response Then who should have? > we should remember this chain of events and somehow all do better. (And not have another repeat of this shit show, if possible... but who am I kidding, it will repeat.) 100% agreement here.

yebyen 9y ago
> > They should not have been in charge of the response > Then who should have? Better question: what would be an appropriate response? Because this one isn't, that much is sure, but I don't have an answer for this question other than "one that is not so hastily and shoddily implemented."
- g051051 9y ago
  You were lamenting about the "delayed" response before, and now you're unhappy with the "hasty" response. Further, do you really think this was a hasty response? This is the response dictated by the law, coupled with recommendations from their legal team, and probably with input from regulators as well.
  - yebyen 9y ago
    It was delayed, in terms of how long it took them to let us know that we could be affected. It was hasty, in terms of... just look at equifaxsecurity2017.com Did they run this plan by even one security researcher before it was put into action? If so, that person's advice was either terrible, or ignored. No time at all had elapsed between the time we were alerted to the breach, and when Equifax revealed the 2-day old site that was protected by Amazon certificate. I am building an HR web portal for employees to submit their identity when they do not go through our background checking service (some classes of employee who are exempt from the requirement to get a background check, for archaic reasons), and I am holding up Equifax's response to the breach as an example of "What Not To Do." There is no legal requirement for them to put up a website that looks like a phishing scam, and respond to people who put in their information with a random value of "Yes you were affected/Check back later to find out if you were affected". There would certainly have been questions about "who was affected" but it would be better to answer with a blanket response of "everyone with a credit file" than to do as they did, and say "143 million Americans, now fill out this pointless form attached to a random number generator to find out if you are one of them."
    - g051051 9y ago
      > There is no legal requirement for them to put up a website that looks like a phishing scam Seriously, what were they thinking? Even the most charitable light isn't enough for this to make sense.