3 ms·

> They should not have been in charge of the response Then who should have? > we should remember this chain of events and somehow all do better. (And not have

> They should not have been in charge of the response Then who should have? > we should remember this chain of events and somehow all do better. (And not have another repeat of this shit show, if possible... but who am I kidding, it will repeat.) 100% agreement here.

yebyen 9y ago
> > They should not have been in charge of the response > Then who should have? Better question: what would be an appropriate response? Because this one isn't, that much is sure, but I don't have an answer for this question other than "one that is not so hastily and shoddily implemented."
- g051051 9y ago
  You were lamenting about the "delayed" response before, and now you're unhappy with the "hasty" response. Further, do you really think this was a hasty response? This is the response dictated by the law, coupled with recommendations from their legal team, and probably with input from regulators as well.
  - yebyen 9y ago
    It was delayed, in terms of how long it took them to let us know that we could be affected. It was hasty, in terms of... just look at equifaxsecurity2017.com Did they run this plan by even one security researcher before it was put into action? If so, that person's advice was either terrible, or ignored. No time at all had elapsed between the time we were alerted to the breach, and when Equifax revealed the 2-day old site that was protected by Amazon certificate. I am building an HR web portal for employees to submit their identity when they do not go through our background checking service (some classes of employee who are exempt from the requirement to get a background check, for archaic reasons), and I am holding up Equifax's response to the breach as an example of "What Not To Do." There is no legal requirement for them to put up a website that looks like a phishing scam, and respond to people who put in their information with a random value of "Yes you were affected/Check back later to find out if you were affected". There would certainly have been questions about "who was affected" but it would be better to answer with a blanket response of "everyone with a credit file" than to do as they did, and say "143 million Americans, now fill out this pointless form attached to a random number generator to find out if you are one of them."
    - g051051 9y ago
      > There is no legal requirement for them to put up a website that looks like a phishing scam Seriously, what were they thinking? Even the most charitable light isn't enough for this to make sense.

yebyen 9y ago

> > They should not have been in charge of the response > Then who should have? Better question: what would be an appropriate response? Because this one isn't, that much is sure, but I don't have an answer for this question other than "one that is not so hastily and shoddily implemented."

g051051 9y ago
You were lamenting about the "delayed" response before, and now you're unhappy with the "hasty" response. Further, do you really think this was a hasty response? This is the response dictated by the law, coupled with recommendations from their legal team, and probably with input from regulators as well.
- yebyen 9y ago
  It was delayed, in terms of how long it took them to let us know that we could be affected. It was hasty, in terms of... just look at equifaxsecurity2017.com Did they run this plan by even one security researcher before it was put into action? If so, that person's advice was either terrible, or ignored. No time at all had elapsed between the time we were alerted to the breach, and when Equifax revealed the 2-day old site that was protected by Amazon certificate. I am building an HR web portal for employees to submit their identity when they do not go through our background checking service (some classes of employee who are exempt from the requirement to get a background check, for archaic reasons), and I am holding up Equifax's response to the breach as an example of "What Not To Do." There is no legal requirement for them to put up a website that looks like a phishing scam, and respond to people who put in their information with a random value of "Yes you were affected/Check back later to find out if you were affected". There would certainly have been questions about "who was affected" but it would be better to answer with a blanket response of "everyone with a credit file" than to do as they did, and say "143 million Americans, now fill out this pointless form attached to a random number generator to find out if you are one of them."
  - g051051 9y ago
    > There is no legal requirement for them to put up a website that looks like a phishing scam Seriously, what were they thinking? Even the most charitable light isn't enough for this to make sense.