33 ms·

The Equifax disaster points to a much bigger problem

230 points by petethomas 9y ago

stanleydrew 9y ago
> A credit report could be stored in an encrypted form so that it could be thawed only with a key held or managed by the consumer. This is a nice idea. In practice the keys would have to be accessible via some kind of password to make them usable to ordinary people. And then those passwords would need to be re-settable via email or phone. There are security issues with that I guess, but we'd probably be better-off than we are now.
- breischl 9y ago
  I guess it couldn't be worse than no key, even if most people's passwords are terrible and poorly handled. But presumably the credit agencies would need the key as well, to enable those resets and so they can add to the records, which probably negates much of the benefit.
  - tylersmith 9y ago
    There should be (authenticated) differentiations between what the credit agency does, what you do, and what third parties do.
    - breischl 9y ago
      One could have a signed audit log, and that's fine. But no matter what you do the CRA has to be able to write to the data, and read from it to give it to third parties, and be able to reset passwords. AFAIK that requires that they have the keys to decrypt the data.
- frahs 9y ago
  Also, with 2FA it's not so bad.
- ghthor 9y ago
  This isn't true. Almost all "ordinary humans" manage to keep and use a pair of physical keys to there home, among other things. We only need a physical key with one simple piece of software that provides the key when asked for it, the user says yes by physically pressing a button on the key, and the key is "connected" (phy or wless). This isn't because ordinary humans can't use and manage protecting a key, it's a UX problem, and IMO a simple UX problem that hasn't been solved because it will destroy the major technological incumbents major source of revenue.
  - chimeracoder 9y ago
    > Almost all "ordinary humans" manage to keep and use a pair of physical keys to there home, among other things And what happens when someone loses their encryption key? This happens often enough with house keys that there are entire businesses set up for emergency locksmith services.
    - athenot 9y ago
      > And what happens when someone loses their encryption key? DigitalLocksmith.io (YC S2018) Jokes aside, this is why combining accessible and strong cryptography is hard. Certainly not impossible but hard. And historically, not at all within the competency of companies like Equifax.
- otakucode 9y ago
  And when you fail to pay a debt to me, and I go to add it to your encrypted credit report, you provide the key at that point as well to facilitate this?
tylersmith 9y ago
This article completely fails to address the main issue: conflating identity and authentication. If credit reports required some sort of attestation of secret knowledge in order to apply for things the issue would be dramatically lessened. A social security number should be no more damaging to know than someone's email address.
- semi-extrinsic 9y ago
  What you really need is a standardised login portal for government and private services that deal with personal information. Then you can have multiple service providers for the actual login, e.g. your bank's proper 2FA login, YubiKeys etc. We've had this for years in my country (with ~2% of the population of the US) and it's working great. Typically the SS number is used for identification, and you have password + one-time code on top of that.
  - tylersmith 9y ago
    I disagree. Centralizing the data and the access control would only create more issues. If somebody got into your account they'd have the keys to your life. We need to embrace decentralizing data and access control along with healthy security habits like proper secret generation and frequent rotation.
    - will_hughes 9y ago
      > along with healthy security habits like proper secret generation and frequent rotation. While having the populace in general be security aware would be a great thing, it's barely possible to get them to do even basic shit like not putting credit card numbers and other secret information into an email and sending it to anyone who asks nicely. Educating people on why 'healthy security habits' and 'key rotation' doesn't mean locking the front door and hanging their housekeys differently is pretty much a non-starter.
      - tylersmith 9y ago
        As people continue to get their money stolen they'll slowly come around to utilizing good security.
notgood 9y ago
DNA should be the only fully trusted proof of identity. To apply for a credit of any important amount (or any other important procedure) you should be required to be pinched to extract a drop of blood and determine if you are who you say you are according to the DNA database.
- rcfox 9y ago
  This would likely reduce the rate of bone marrow donation.
- mkagenius 9y ago
  Just the application or would you want to get pinched every time you would want to log in? Sounds really painful.
  - tylersmith 9y ago
    Not to mention changing your DNA if it gets compromised will be difficult.
    - Spivak 9y ago
      I think it's actually could be a pretty good system. It's a piece of information that uniquely identifies you and even if it's totally public it doesn't help someone impersonate you. Sure someone could easily produce a sample of your DNA but they couldn't fake a fresh blood sample taken by the person authorizing you.
  - ceejayoz 9y ago
    Cheek swabs are a thing, and the most common venue for collecting DNA.
- dogecoinbase 9y ago
  "Perfect for identical twins!"
  - 9y ago
pgnas 9y ago
Looks like Equifax gets a junk bond rating in the personal information handling. This company should be shut down. 3.1B revenue and can't secure data, not even really trying. Greed.
- tudorw 9y ago
  Which company can secure data? Are we're just assuming it's viable and reasonable, there are a lot more examples of failure than success, Sony, Apple, AT&T, Snapchat the US Army, https://en.wikipedia.org/wiki/List_of_data_breaches https://en.wikipedia.org/wiki/List_of_data_breaches I'm not really sure the protocol is up to the job, while theoretically it would appear possible to secure data on the internet, the reality seems to be that the complexity of the systems involved means there is no reliable solution.
  - jv22222 9y ago
    Holy crap, that list of data breaches is incredible. And by incredible, I mean really difficult to believe. If anything should be #1 on hacker news for an entire month it should be that page right there.
    - KGIII 9y ago
      What is remarkable, and it pains me to say this, is that Microsoft isn't on that list. With all the telemetry data they collect, they might have some good data stored. I'm sure people are trying to hack it, even right this minute. They seem pretty capable, so far, of keeping their own collected data secured.
      - tluyben2 9y ago
        Some of these breaches, for instance the Gmail/Google breach, might have not been a breach of there systems at all. So far for that example (but there are more), one could apply that to Outlook/MS and get identical results. Aka; hack some service that has millions of emails/password (accumulated), filter all gmail emails, try to login to gmail with that compbi and if it works, put them into the list of 'hacked gmail accounts'. Not trying to stick up for Google here, but, like MS, there seems to not be a real breach there.
Nanite 9y ago
Ok so: a third party (Equifax) has collected sensitive personal data on citizens without their consent and is asking a fee to prevent other third parties from accessing this information. isn't this technically blackmail?
- KGIII 9y ago
  Assuming you're serious, probably not. Intent matters and they aren't threatening to release the data, only monitoring if someone else uses the already released data. I am not a lawyer, this is not legal advice. Before deciding to blackmail, you should consult a qualified attorney in the appropriate jurisdiction.
  - bogomipz 9y ago
    No, the fee they require you to pay to lock your credit profile has nothing to do with them monitoring anything. They require you to pay money in order to stop doing something you never authorized or asked them to do - releasing your credit profile to anyone who asks. While blackmail is a specific case of extortion where unfavorable information is released, what the agencies do by requiring you to pay for protection(the freezing of your credit)seems to qualify as extortion. "What Is Extortion? Most states define extortion as the gaining of property or money by almost any kind of force, or threat of 1) violence, 2) property damage, 3) harm to reputation, or 4) unfavorable government action." I think you could make a case for number 3 - gaining money for threat of harm to reputation. Your credit score is very much your financial reputation. source: http://criminal.findlaw.com/criminal-charges/extortion.html http://criminal.findlaw.com/criminal-charges/extortion.html
    - gm-conspiracy 9y ago
      Also, it seems like it could fall under RICO: https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corrupt_Organizations_Act https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corru... One could argue the disclosure timing and executive stock sales (pre-disclosure) could constitute investor/securities fraud, as well.
snarfy 9y ago
> In the wake of the Equifax breach, Congress should require stronger cybersecurity measures at credit reporting agencies, as well as for any company that stores large quantities of sensitive data about individuals, even if those individuals are not the company’s customers. Yes, they should, but that's not what they are doing. They are doing the opposite. [1] It doesn't matter what the majority want Congress to do when they don't listen or care and instead do what their special interests tell them. The 'bigger problem' the article mentions is not that the laws are tilted towards the corporations. It's that they will continue to be tilted towards them due to corruption. [1] http://www.latimes.com/business/lazarus/la-fi-lazarus-republican-credit-agency-bills-20170919-story.html http://www.latimes.com/business/lazarus/la-fi-lazarus-republ...
- snsr 9y ago
  What. the. fuck. http://www.latimes.com/business/lazarus/la-fi-lazarus-republican-credit-agency-bills-20170919-story.html http://www.latimes.com/business/lazarus/la-fi-lazarus-republ... > The FCRA Liability Harmonization Act is particularly noxious. Authored by Rep. Barry Loudermilk (R-Ga.), the bill would cap actual and statutory damages for class actions involving credit agencies at $500,000, and completely eliminate punitive damages. Loudermilk said Friday that his bill “is aimed at curbing frivolous class action lawsuits against businesses under the Fair Credit Reporting Act,” which contains many of the rules for credit agencies.
  - revmoo 9y ago
    > Loudermilk said Friday that his bill “is aimed at curbing frivolous class action lawsuits against businesses under the Fair Credit Reporting Act,” Has this ever even happened?
    - ceejayoz 9y ago
      Sure, when you define "frivolous" as "anything aimed at one of my campaign contributors".
  - pjc50 9y ago
AndyMcConachie 9y ago
Just as a point of reference, in The Netherlands there is a central agency for recording the debt of people who mostly have fallen behind on payments. They only record debts that last longer than 3 months and of those delete all record of them after 5 years after being paid off. It is forbidden for this agency to record that you have a mortgage unless you fall behind on payments. Only negative information is stored on borrowers. If you pay your loan down on time nothing will be stored about you. Also, it is forbidden for information in this agency to be used for identifying purposes by banks and the like. This means considerably less risk for me as a citizen, and it also means the information is less valuable for hackers. Mortgage interest rates are currently 1-2 points less in The Netherlands than they are in the USA, so there's no correlation I can see between America's vampire capitalism credit model and cheaper loans.
- lettergram 9y ago
  FYI historically we did away with many of the debt related laws and centralization, because that could / will likely lead to debters prison. That being said, obviously things need to change, but based on your description, it's not really a credit agency. If they can't determine how credit worthy you are (historic payments are the #1 indicator), then they really don't have any information besides current debt.
  - bakhy 9y ago
    your ability to pay is better determined by looking at pay slips, which a bank can (and probably will) demand from you. the fact that you paid X dollars monthly for Y years is not sufficient to determine the upper limit of your paying ability. so, i think a combination of nice pay slips + lack of defaults in the past is quite sufficient.
- bogomipz 9y ago
  Yes that sounds like a sane system. It's worth nothing that though that this breach also affected some non-US citizens as well, most reports mentioned UK residents and Canadian residents as well.
- 9y ago
la6470 9y ago
They should at the minimum provide free credit monitoring for LIFE for all individuals affected by this breach.
featherverse 9y ago
Yeah, human beings en masse are stupid. And they are ruled by thieves, and they never do anything about it. That is the single _biggest_ problem facing the human species.
otakucode 9y ago
When the article got to mentioning encryption... I do not understand what they are proposing. How would it be possible for the customer to hold the key necessary to decrypt the credit record? Credit records are not read-only. Other parties have to be able to submit additions to your credit record, like if you fail to pay your water utility bill or something. So how exactly are they going to append to your locked credit record? Would creditors have to contact the customer and get them to provide the key in order to encrypt a new addition?
- haikuginger 9y ago
  Public-key encryption. The report item could be encrypted with the customer's public key, but to read the report after it's added, the customer would need to provide access to a private key.
njarboe 9y ago
I think the false "identity theft" idea that the banks have promoted has started to really get people confused. The idea that a person can own the facts about their behavior toward others, when you think about it, is very strange. In theory a credit report is just a report from people you have borrowed money from on how well you repaid the loan to them. I don't think anyone would feel that they should legally be able to prevent people from telling other people how they have truthfully interacted with them. I don't think most people feel it is unfair or immoral to release "unfavorable" information. If one didn't pay back a credit card, most reasonable people think, "OK that's true and on my report. My bad." What people think it is deeply wrong is for a fraudster to get a loan from a bank, the fraudster does not pay, and the bank libels them by sending a false report to the credit agency saying they defaulted on the loan. This agency and bank have no penalties for propagating the libel/slander and this libel will hurt the person in many ways. Everyone knows that getting this libel to stop is very difficult and the credit agencies and banks don't care about fixing the errors. The run-a-rounds people go through are legendary. People fear getting libeled by banks and other issuers of credit, so much so many buy insurance for "peace of mind". The credit reporting agencies are like Ticketmaster, a company set up to take the heat and misdirect the anger when some other entity is screwing you. Ticketmaster plays front man for the concert promoters/venues/bands whereas the credit agencies play front man for the banks.
- CupOfJava 9y ago
  Can you sue them for libel then?
- hammock 9y ago
  >I don't think most people feel it is unfair or immoral to release "unfavorable" information I feel your overall argument, and you should know your idea here is not exactly accurate. For instance, in Europe there are actually laws against unfavorable information. https://en.wikipedia.org/wiki/Right_to_be_forgotten https://en.wikipedia.org/wiki/Right_to_be_forgotten
  - njarboe 9y ago
    I'm in the US where these credit reporting companies are and "identity theft" is a big fear. Is there a similar problem in Europe? For example do you see ads on TV and the internet for insurance against "identity theft"? Things do drop off your credit report in the US, even bankruptcy after 7 or 10 years, so people do have a general idea that some past mistakes should not haunt you forever. But never get a felony in the US. You will truly discriminated against for life.
DontSueMeBro 9y ago
As an American currently in the middle of an EU-GDPR implementation I am envious of the level of protection EU citizens will receive. Fortunately, there will be some collateral benefits when companies (such as mine) decide to apply GDPR to all their customers, not just their EU customers. A 3 minute intro to GDPR for those unfamiliar: https://youtu.be/n5WJOncaHt4 https://youtu.be/n5WJOncaHt4
Shivetya 9y ago
it is not that someone has access to your credit history that is a problem nor who manages this information. the real issue is that agencies extending credit will lend without verification. it is not even credit agencies that do this, to many companies allow charges against all sorts of accounts; an example is spurious charges that sneak onto phone bills. any company extending credit or charging a customer should be required to reach a level of proof required by law, to the point I would think that above a certain level of credit it requires a notary or such.

230 points by petethomas 9y ago

> A credit report could be stored in an encrypted form so that it could be thawed only with a key held or managed by the consumer. This is a nice idea. In practice the keys would have to be accessible via some kind of password to make them usable to ordinary people. And then those passwords would need to be re-settable via email or phone. There are security issues with that I guess, but we'd probably be better-off than we are now.

breischl 9y ago
I guess it couldn't be worse than no key, even if most people's passwords are terrible and poorly handled. But presumably the credit agencies would need the key as well, to enable those resets and so they can add to the records, which probably negates much of the benefit.
- tylersmith 9y ago
  There should be (authenticated) differentiations between what the credit agency does, what you do, and what third parties do.
  - breischl 9y ago
    One could have a signed audit log, and that's fine. But no matter what you do the CRA has to be able to write to the data, and read from it to give it to third parties, and be able to reset passwords. AFAIK that requires that they have the keys to decrypt the data.
frahs 9y ago
Also, with 2FA it's not so bad.
ghthor 9y ago
This isn't true. Almost all "ordinary humans" manage to keep and use a pair of physical keys to there home, among other things. We only need a physical key with one simple piece of software that provides the key when asked for it, the user says yes by physically pressing a button on the key, and the key is "connected" (phy or wless). This isn't because ordinary humans can't use and manage protecting a key, it's a UX problem, and IMO a simple UX problem that hasn't been solved because it will destroy the major technological incumbents major source of revenue.
- chimeracoder 9y ago
  > Almost all "ordinary humans" manage to keep and use a pair of physical keys to there home, among other things And what happens when someone loses their encryption key? This happens often enough with house keys that there are entire businesses set up for emergency locksmith services.
  - athenot 9y ago
    > And what happens when someone loses their encryption key? DigitalLocksmith.io (YC S2018) Jokes aside, this is why combining accessible and strong cryptography is hard. Certainly not impossible but hard. And historically, not at all within the competency of companies like Equifax.
otakucode 9y ago
And when you fail to pay a debt to me, and I go to add it to your encrypted credit report, you provide the key at that point as well to facilitate this?

tylersmith 9y ago

This article completely fails to address the main issue: conflating identity and authentication. If credit reports required some sort of attestation of secret knowledge in order to apply for things the issue would be dramatically lessened. A social security number should be no more damaging to know than someone's email address.

semi-extrinsic 9y ago
What you really need is a standardised login portal for government and private services that deal with personal information. Then you can have multiple service providers for the actual login, e.g. your bank's proper 2FA login, YubiKeys etc. We've had this for years in my country (with ~2% of the population of the US) and it's working great. Typically the SS number is used for identification, and you have password + one-time code on top of that.
- tylersmith 9y ago
  I disagree. Centralizing the data and the access control would only create more issues. If somebody got into your account they'd have the keys to your life. We need to embrace decentralizing data and access control along with healthy security habits like proper secret generation and frequent rotation.
  - will_hughes 9y ago
    > along with healthy security habits like proper secret generation and frequent rotation. While having the populace in general be security aware would be a great thing, it's barely possible to get them to do even basic shit like not putting credit card numbers and other secret information into an email and sending it to anyone who asks nicely. Educating people on why 'healthy security habits' and 'key rotation' doesn't mean locking the front door and hanging their housekeys differently is pretty much a non-starter.
    - tylersmith 9y ago
      As people continue to get their money stolen they'll slowly come around to utilizing good security.

notgood 9y ago

DNA should be the only fully trusted proof of identity. To apply for a credit of any important amount (or any other important procedure) you should be required to be pinched to extract a drop of blood and determine if you are who you say you are according to the DNA database.

rcfox 9y ago
This would likely reduce the rate of bone marrow donation.
mkagenius 9y ago
Just the application or would you want to get pinched every time you would want to log in? Sounds really painful.
- tylersmith 9y ago
  Not to mention changing your DNA if it gets compromised will be difficult.
  - Spivak 9y ago
    I think it's actually could be a pretty good system. It's a piece of information that uniquely identifies you and even if it's totally public it doesn't help someone impersonate you. Sure someone could easily produce a sample of your DNA but they couldn't fake a fresh blood sample taken by the person authorizing you.
- ceejayoz 9y ago
  Cheek swabs are a thing, and the most common venue for collecting DNA.
dogecoinbase 9y ago
"Perfect for identical twins!"
- 9y ago

pgnas 9y ago

Looks like Equifax gets a junk bond rating in the personal information handling. This company should be shut down. 3.1B revenue and can't secure data, not even really trying. Greed.

tudorw 9y ago
Which company can secure data? Are we're just assuming it's viable and reasonable, there are a lot more examples of failure than success, Sony, Apple, AT&T, Snapchat the US Army, https://en.wikipedia.org/wiki/List_of_data_breaches https://en.wikipedia.org/wiki/List_of_data_breaches I'm not really sure the protocol is up to the job, while theoretically it would appear possible to secure data on the internet, the reality seems to be that the complexity of the systems involved means there is no reliable solution.
- jv22222 9y ago
  Holy crap, that list of data breaches is incredible. And by incredible, I mean really difficult to believe. If anything should be #1 on hacker news for an entire month it should be that page right there.
  - KGIII 9y ago
    What is remarkable, and it pains me to say this, is that Microsoft isn't on that list. With all the telemetry data they collect, they might have some good data stored. I'm sure people are trying to hack it, even right this minute. They seem pretty capable, so far, of keeping their own collected data secured.
    - tluyben2 9y ago
      Some of these breaches, for instance the Gmail/Google breach, might have not been a breach of there systems at all. So far for that example (but there are more), one could apply that to Outlook/MS and get identical results. Aka; hack some service that has millions of emails/password (accumulated), filter all gmail emails, try to login to gmail with that compbi and if it works, put them into the list of 'hacked gmail accounts'. Not trying to stick up for Google here, but, like MS, there seems to not be a real breach there.

Nanite 9y ago

Ok so: a third party (Equifax) has collected sensitive personal data on citizens without their consent and is asking a fee to prevent other third parties from accessing this information. isn't this technically blackmail?

KGIII 9y ago
Assuming you're serious, probably not. Intent matters and they aren't threatening to release the data, only monitoring if someone else uses the already released data. I am not a lawyer, this is not legal advice. Before deciding to blackmail, you should consult a qualified attorney in the appropriate jurisdiction.
- bogomipz 9y ago
  No, the fee they require you to pay to lock your credit profile has nothing to do with them monitoring anything. They require you to pay money in order to stop doing something you never authorized or asked them to do - releasing your credit profile to anyone who asks. While blackmail is a specific case of extortion where unfavorable information is released, what the agencies do by requiring you to pay for protection(the freezing of your credit)seems to qualify as extortion. "What Is Extortion? Most states define extortion as the gaining of property or money by almost any kind of force, or threat of 1) violence, 2) property damage, 3) harm to reputation, or 4) unfavorable government action." I think you could make a case for number 3 - gaining money for threat of harm to reputation. Your credit score is very much your financial reputation. source: http://criminal.findlaw.com/criminal-charges/extortion.html http://criminal.findlaw.com/criminal-charges/extortion.html
  - gm-conspiracy 9y ago
    Also, it seems like it could fall under RICO: https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corrupt_Organizations_Act https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corru... One could argue the disclosure timing and executive stock sales (pre-disclosure) could constitute investor/securities fraud, as well.

snarfy 9y ago

> In the wake of the Equifax breach, Congress should require stronger cybersecurity measures at credit reporting agencies, as well as for any company that stores large quantities of sensitive data about individuals, even if those individuals are not the company’s customers. Yes, they should, but that's not what they are doing. They are doing the opposite. [1] It doesn't matter what the majority want Congress to do when they don't listen or care and instead do what their special interests tell them. The 'bigger problem' the article mentions is not that the laws are tilted towards the corporations. It's that they will continue to be tilted towards them due to corruption. [1] http://www.latimes.com/business/lazarus/la-fi-lazarus-republican-credit-agency-bills-20170919-story.html http://www.latimes.com/business/lazarus/la-fi-lazarus-republ...

snsr 9y ago
What. the. fuck. http://www.latimes.com/business/lazarus/la-fi-lazarus-republican-credit-agency-bills-20170919-story.html http://www.latimes.com/business/lazarus/la-fi-lazarus-republ... > The FCRA Liability Harmonization Act is particularly noxious. Authored by Rep. Barry Loudermilk (R-Ga.), the bill would cap actual and statutory damages for class actions involving credit agencies at $500,000, and completely eliminate punitive damages. Loudermilk said Friday that his bill “is aimed at curbing frivolous class action lawsuits against businesses under the Fair Credit Reporting Act,” which contains many of the rules for credit agencies.
- revmoo 9y ago
  > Loudermilk said Friday that his bill “is aimed at curbing frivolous class action lawsuits against businesses under the Fair Credit Reporting Act,” Has this ever even happened?
  - ceejayoz 9y ago
    Sure, when you define "frivolous" as "anything aimed at one of my campaign contributors".
- pjc50 9y ago

AndyMcConachie 9y ago

Just as a point of reference, in The Netherlands there is a central agency for recording the debt of people who mostly have fallen behind on payments. They only record debts that last longer than 3 months and of those delete all record of them after 5 years after being paid off. It is forbidden for this agency to record that you have a mortgage unless you fall behind on payments. Only negative information is stored on borrowers. If you pay your loan down on time nothing will be stored about you. Also, it is forbidden for information in this agency to be used for identifying purposes by banks and the like. This means considerably less risk for me as a citizen, and it also means the information is less valuable for hackers. Mortgage interest rates are currently 1-2 points less in The Netherlands than they are in the USA, so there's no correlation I can see between America's vampire capitalism credit model and cheaper loans.

lettergram 9y ago
FYI historically we did away with many of the debt related laws and centralization, because that could / will likely lead to debters prison. That being said, obviously things need to change, but based on your description, it's not really a credit agency. If they can't determine how credit worthy you are (historic payments are the #1 indicator), then they really don't have any information besides current debt.
- bakhy 9y ago
  your ability to pay is better determined by looking at pay slips, which a bank can (and probably will) demand from you. the fact that you paid X dollars monthly for Y years is not sufficient to determine the upper limit of your paying ability. so, i think a combination of nice pay slips + lack of defaults in the past is quite sufficient.
bogomipz 9y ago
Yes that sounds like a sane system. It's worth nothing that though that this breach also affected some non-US citizens as well, most reports mentioned UK residents and Canadian residents as well.
9y ago

la6470 9y ago

They should at the minimum provide free credit monitoring for LIFE for all individuals affected by this breach.

featherverse 9y ago

Yeah, human beings en masse are stupid. And they are ruled by thieves, and they never do anything about it. That is the single _biggest_ problem facing the human species.

otakucode 9y ago

When the article got to mentioning encryption... I do not understand what they are proposing. How would it be possible for the customer to hold the key necessary to decrypt the credit record? Credit records are not read-only. Other parties have to be able to submit additions to your credit record, like if you fail to pay your water utility bill or something. So how exactly are they going to append to your locked credit record? Would creditors have to contact the customer and get them to provide the key in order to encrypt a new addition?

haikuginger 9y ago
Public-key encryption. The report item could be encrypted with the customer's public key, but to read the report after it's added, the customer would need to provide access to a private key.

njarboe 9y ago

I think the false "identity theft" idea that the banks have promoted has started to really get people confused. The idea that a person can own the facts about their behavior toward others, when you think about it, is very strange. In theory a credit report is just a report from people you have borrowed money from on how well you repaid the loan to them. I don't think anyone would feel that they should legally be able to prevent people from telling other people how they have truthfully interacted with them. I don't think most people feel it is unfair or immoral to release "unfavorable" information. If one didn't pay back a credit card, most reasonable people think, "OK that's true and on my report. My bad." What people think it is deeply wrong is for a fraudster to get a loan from a bank, the fraudster does not pay, and the bank libels them by sending a false report to the credit agency saying they defaulted on the loan. This agency and bank have no penalties for propagating the libel/slander and this libel will hurt the person in many ways. Everyone knows that getting this libel to stop is very difficult and the credit agencies and banks don't care about fixing the errors. The run-a-rounds people go through are legendary. People fear getting libeled by banks and other issuers of credit, so much so many buy insurance for "peace of mind". The credit reporting agencies are like Ticketmaster, a company set up to take the heat and misdirect the anger when some other entity is screwing you. Ticketmaster plays front man for the concert promoters/venues/bands whereas the credit agencies play front man for the banks.

CupOfJava 9y ago
Can you sue them for libel then?
hammock 9y ago
>I don't think most people feel it is unfair or immoral to release "unfavorable" information I feel your overall argument, and you should know your idea here is not exactly accurate. For instance, in Europe there are actually laws against unfavorable information. https://en.wikipedia.org/wiki/Right_to_be_forgotten https://en.wikipedia.org/wiki/Right_to_be_forgotten
- njarboe 9y ago
  I'm in the US where these credit reporting companies are and "identity theft" is a big fear. Is there a similar problem in Europe? For example do you see ads on TV and the internet for insurance against "identity theft"? Things do drop off your credit report in the US, even bankruptcy after 7 or 10 years, so people do have a general idea that some past mistakes should not haunt you forever. But never get a felony in the US. You will truly discriminated against for life.

DontSueMeBro 9y ago

As an American currently in the middle of an EU-GDPR implementation I am envious of the level of protection EU citizens will receive. Fortunately, there will be some collateral benefits when companies (such as mine) decide to apply GDPR to all their customers, not just their EU customers. A 3 minute intro to GDPR for those unfamiliar: https://youtu.be/n5WJOncaHt4 https://youtu.be/n5WJOncaHt4

Shivetya 9y ago

it is not that someone has access to your credit history that is a problem nor who manages this information. the real issue is that agencies extending credit will lend without verification. it is not even credit agencies that do this, to many companies allow charges against all sorts of accounts; an example is spurious charges that sneak onto phone bills. any company extending credit or charging a customer should be required to reach a level of proof required by law, to the point I would think that above a certain level of credit it requires a notary or such.