5 ms·

> A credit report could be stored in an encrypted form so that it could be thawed only with a key held or managed by the consumer. This is a nice idea. In prac

> A credit report could be stored in an encrypted form so that it could be thawed only with a key held or managed by the consumer. This is a nice idea. In practice the keys would have to be accessible via some kind of password to make them usable to ordinary people. And then those passwords would need to be re-settable via email or phone. There are security issues with that I guess, but we'd probably be better-off than we are now.

breischl 9y ago
I guess it couldn't be worse than no key, even if most people's passwords are terrible and poorly handled. But presumably the credit agencies would need the key as well, to enable those resets and so they can add to the records, which probably negates much of the benefit.
- tylersmith 9y ago
  There should be (authenticated) differentiations between what the credit agency does, what you do, and what third parties do.
  - breischl 9y ago
    One could have a signed audit log, and that's fine. But no matter what you do the CRA has to be able to write to the data, and read from it to give it to third parties, and be able to reset passwords. AFAIK that requires that they have the keys to decrypt the data.
frahs 9y ago
Also, with 2FA it's not so bad.
ghthor 9y ago
This isn't true. Almost all "ordinary humans" manage to keep and use a pair of physical keys to there home, among other things. We only need a physical key with one simple piece of software that provides the key when asked for it, the user says yes by physically pressing a button on the key, and the key is "connected" (phy or wless). This isn't because ordinary humans can't use and manage protecting a key, it's a UX problem, and IMO a simple UX problem that hasn't been solved because it will destroy the major technological incumbents major source of revenue.
- chimeracoder 9y ago
  > Almost all "ordinary humans" manage to keep and use a pair of physical keys to there home, among other things And what happens when someone loses their encryption key? This happens often enough with house keys that there are entire businesses set up for emergency locksmith services.
  - athenot 9y ago
    > And what happens when someone loses their encryption key? DigitalLocksmith.io (YC S2018) Jokes aside, this is why combining accessible and strong cryptography is hard. Certainly not impossible but hard. And historically, not at all within the competency of companies like Equifax.
otakucode 9y ago
And when you fail to pay a debt to me, and I go to add it to your encrypted credit report, you provide the key at that point as well to facilitate this?

breischl 9y ago

I guess it couldn't be worse than no key, even if most people's passwords are terrible and poorly handled. But presumably the credit agencies would need the key as well, to enable those resets and so they can add to the records, which probably negates much of the benefit.

tylersmith 9y ago
There should be (authenticated) differentiations between what the credit agency does, what you do, and what third parties do.
- breischl 9y ago
  One could have a signed audit log, and that's fine. But no matter what you do the CRA has to be able to write to the data, and read from it to give it to third parties, and be able to reset passwords. AFAIK that requires that they have the keys to decrypt the data.

frahs 9y ago

Also, with 2FA it's not so bad.

ghthor 9y ago

This isn't true. Almost all "ordinary humans" manage to keep and use a pair of physical keys to there home, among other things. We only need a physical key with one simple piece of software that provides the key when asked for it, the user says yes by physically pressing a button on the key, and the key is "connected" (phy or wless). This isn't because ordinary humans can't use and manage protecting a key, it's a UX problem, and IMO a simple UX problem that hasn't been solved because it will destroy the major technological incumbents major source of revenue.

chimeracoder 9y ago
> Almost all "ordinary humans" manage to keep and use a pair of physical keys to there home, among other things And what happens when someone loses their encryption key? This happens often enough with house keys that there are entire businesses set up for emergency locksmith services.
- athenot 9y ago
  > And what happens when someone loses their encryption key? DigitalLocksmith.io (YC S2018) Jokes aside, this is why combining accessible and strong cryptography is hard. Certainly not impossible but hard. And historically, not at all within the competency of companies like Equifax.

otakucode 9y ago

And when you fail to pay a debt to me, and I go to add it to your encrypted credit report, you provide the key at that point as well to facilitate this?