4 ms·

At the risk of speaking for OP: The point is that the data should be owned by me. Yeah, I get that it has value to other people, but I'm the one that has to dea

At the risk of speaking for OP: The point is that the data should be owned by me. Yeah, I get that it has value to other people, but I'm the one that has to deal with the fallout, not them. Just because something is useful to a business doesn't mean that they have the right to it. If they want information about me, they should be asking me, not some third party.

yjftsjthsd-h 9y ago
I don't disagree, but then how do we trust it? I suppose (thinking out loud) that we could have everyone on your credit report sign it, but then encrypt it to your public key? That way only you can let others see it, but it's still tamper-proof.
- ThrustVectoring 9y ago
  There's a legit need for tampering, though - to arbitrate disputes between creditors and debtors. Also to comply with the Fair Credit Reporting Act. So there's four parties that contribute to the document: 1. Credit applicants, who release all-or-none of their credit report information, and can see it at any point in time. Means it needs to be stored encrypted with their public key. 2. Creditors, who can add, edit, and remove information from someone's credit report. Presumably this adds a way to verify that the addition/edit/deletion is from them and not some other party (sign with private key). 3. Other creditors, who can - with approval - view an applicant's credit report and know it is complete and up-to-date. 4. Arbitrator, who resolves disputes and deletes or corrects inaccurate information from reports. And presumably you'd want some sort of additional safety mechanism to prevent dissemination of the unencrypted result? Like, if you gave an organization an unlock code, maybe it's possible to arrange things such that that organization's private key is able to create legit-looking data, so nobody else could trust third-party sharing of credit report data?
typomatic 9y ago
This is nonsensical--your interactions with other entities belong to them just as much as you. Chase gets to talk about their experience with you just as you may talk about your experience with Chase.
- CaptSpify 9y ago
  I never said they couldn't. But they don't need my personal, non-public info to do that. And if the interaction does also belong to them, why don't I get access to their data?

yjftsjthsd-h 9y ago

I don't disagree, but then how do we trust it? I suppose (thinking out loud) that we could have everyone on your credit report sign it, but then encrypt it to your public key? That way only you can let others see it, but it's still tamper-proof.

ThrustVectoring 9y ago
There's a legit need for tampering, though - to arbitrate disputes between creditors and debtors. Also to comply with the Fair Credit Reporting Act. So there's four parties that contribute to the document: 1. Credit applicants, who release all-or-none of their credit report information, and can see it at any point in time. Means it needs to be stored encrypted with their public key. 2. Creditors, who can add, edit, and remove information from someone's credit report. Presumably this adds a way to verify that the addition/edit/deletion is from them and not some other party (sign with private key). 3. Other creditors, who can - with approval - view an applicant's credit report and know it is complete and up-to-date. 4. Arbitrator, who resolves disputes and deletes or corrects inaccurate information from reports. And presumably you'd want some sort of additional safety mechanism to prevent dissemination of the unencrypted result? Like, if you gave an organization an unlock code, maybe it's possible to arrange things such that that organization's private key is able to create legit-looking data, so nobody else could trust third-party sharing of credit report data?

typomatic 9y ago

This is nonsensical--your interactions with other entities belong to them just as much as you. Chase gets to talk about their experience with you just as you may talk about your experience with Chase.

CaptSpify 9y ago
I never said they couldn't. But they don't need my personal, non-public info to do that. And if the interaction does also belong to them, why don't I get access to their data?