4 ms·

I bought EFX after the incident and made a bundle on it too, but I don't share your outrage. Does the breach call for some punitive response? Definitely. Does

I bought EFX after the incident and made a bundle on it too, but I don't share your outrage. Does the breach call for some punitive response? Definitely. Does it justify destroying a $14B company? No. That's an overly emotional, witch-hunting type of response. HN of all places should be sympathetic to what happened to Equifax; they neglected to update a framework which had a vulnerability granting full remote code execution. That's game over from an info sec standpoint, and how many developers here can state, with 100% confidence, that every library and every framework and piece of application code in their own work is totally bulletproof and will never fall victim to something similar? The breach should be used by everyone as a lesson, and as I stated earlier Equifax should receive some punitive action (arguably already delivered by the hit to their stock price and the public floggings from the congressional hearings). But saying that Equifax should be bankrupted by it, or that the executives or developers should be thrown in jail? Be careful what you wish for. Today Equifax, tomorrow you.

rectang 9y ago
Equifax should not exist because the credit system causes so much harm spread out over many individuals. That problem existed before the breach, and it is just as much a problem with Equifax's competitors as with Equifax. The breach only serves to highlight what malignant parasites the credit agencies are.
cwkoss 9y ago
I think the key part of the outrage against Equifax, and part of why it is more outrageous than most breaches, is not only was customer data revealed, but also data about people who want nothing to do with Equifax. There is no action victims could have taken to avoid this breach. In most serious breaches, there is a certain amount of "well, you have to be careful who you give your information to..." even though it's not the victims fault. This factor is not present in the Equifax situation. Equifax is allowed to hold and market a product based on data of individuals who never gave consent, but has no responsibility to protect that data or repercussions when they fail. Arguably this breach has put the final nail in the coffin for using SSN's as secure identifiers. Granted, it was a horrible and mostly-already-broken system to begin with. But I think that this flawed system was still worth in excess of $14B - and Equifax's negligence effectively destroyed that value. I agree bankrupting Equifax would be heavy-handed, but it would be nice to at least see some punitive action that would discourage such negligence in the future and provide an economic disincentive to possessing vast quantities of private data.
- PakG1 9y ago
  I'm not an American, so I don't know. How much of Equifax's business and value was driven by credit checks and anything else having to do with SSNs? Because if the whole SSN system had a $14 billion value, which was then destroyed by Equifax's negligence, and Equifax had the majority of its business doing this stuff, wouldn't that make Equifax bankrupt? So either Equifax makes a lot of money doing other stuff, or the $14 billion in value wasn't destroyed by Equifax's negligence. I imagine it's the latter, that SSN is still being used for everything because oil tankers can't change their momentum so quickly. If you meant that SSNs can safely be predicted to be not used for identification a decade or two from now, who's to say this was the catalyst? Any system eventually gets revamped, even government systems, especially if they were already broken in the first place. There are many examples worldwide of ID systems and laws changing all the time. In fact, I just read that majority of states are supposed to require Americans to use a passport for flying now. The Real ID Act? Just a bunch of states were too slow to get it done, so they've been given an extension, but even in the US, there's work being done to revamp identification in some areas. I'm not saying that it's good or bad, I'm saying that it seems to happen eventually. Why wouldn't SSN also change up even if Equifax never happened?
totalZero 9y ago
"It's ok for a long-haul bus driver to occasionally drive while sleepy, because people on HN occasionally drive their cars while sleepy."
benchaney 9y ago
This is a false dichotomy. Equifax was extremely negligent. I don't have to be 100% perfect myself to be outraged by that.
mikeash 9y ago
What hit to their stock price? It’s the same price it was a year ago. We’ve all made computer mistakes like this, but the stakes are different. If I forget to update a framework and as a result a bunch of cat pictures leak, that’s not a big deal. If I do the exact same thing and leak important private info with financial consequences for nearly every American, that’s a much bigger deal. They data they collected needed to be stored in a bulletproof fashion. You could argue that this is impossible, but that just means the data should not have been collected at all. The calls to destroy the company seem pretty reasonable to me. This is a classic case of an externality. Equifax cost a shitload of people a bunch of money, and they’re bearing very little of the cost. Arguably they’re actually profiting from it by selling fraud protection services. The only question to me is: just how much did they cost the American people? Whatever it is, they should bear the entire cost. And I bet that cost is more than the company is worth.
- ISL 9y ago
  GP implies that EFX was purchased sometime after the fall and before the present day, which would have yielded an apparent profit.
  - mikeash 9y ago
    Right, but they also said that they've already been punished by the hit to their stock price, which doesn't look like it's the case at all.
    - mikestew 9y ago
      We're deep enough in that I don't know who the parent of who anymore, but to be clear I bought in-the-money calls at around $93 (the hit to their stock price), and sold the contracts when it hit around $111 (seemed to have leveled off). But you're probably not talking about me, as I'm the one pissed off that those calls made money, not thinking they've been punished. It should have hit $93 and stayed there.
      - mikeash 9y ago
xkcd-sucks 9y ago
Right now it's "Today you, never Equifax." Too-big-to-fail institutions do fail do fulfill their obligations, and if they're not substantially gutted and rebuilt they will only fail to fulfill obligations to an even worse degree.
ImSkeptical 9y ago
Their stock price was temporarily damaged, and they had to have an awkward hearing in front of congress - that seems light when compared to their negligence which handed over financial and personal information for most of the country to hackers unknown. On top of this, they delayed telling the public, they admitted they only encrypt "some" of their data at rest, and a few of their executives sold stock between the time the company knew about the attack and the public didn't. Your argument is wise to consider the "let he who is without sin" perspective, but I don't find it that compelling. They had a hoard of valuable information which they carelessly stored and they paid essentially zero consequences. If I had to choose between this world, and the world where Equifax was just liquidated with the proceeds going to people affected, I'd prefer the latter. "Won't somebody think of the shareholders?" I have, but I've also contemplated the tens of millions harmed by their incompetence.
s73ver_ 9y ago
"HN of all places should be sympathetic to what happened to Equifax" Why should I be sympathetic to them, especially after how they handled it? And especially given that they make loads of money off MY DATA, and want to turn around and have the gall to charge me to see it, to make sure it's accurate?
mephitix 9y ago
This logic makes no sense to me. You have a company that stores, without consent, highly personal data for almost every American. There was an implied responsibility to protect that information. For such a company, security should be pretty high on the priority list. All of the following is negligence: 1) Store all this information, unencrypted 2) They were told of the vulnerability in March and had 2 months to update the software. 3) Afterwards, set up a broken website with a DV certificate to accept SSN numbers. 4) The website, even though was a vulnerability disclosure, tried to _sell_ an Equifax identity monitoring package. 5) Redirect your own customers to a phishing website set up by a white hat hacker 6) Allow employees to have usernames/pws like 'admin/admin' on edge servers The circumstances that led to the vulnerability, and the actions that Equifax took afterwards absolutely warrant outrage. And this is not even taking into account the original point - this is a pattern of incompetence and failure - but to add to the fire, Equifax was a company that was tasked with storing highly sensitive personal data for millions of Americans and did not take the appropriate security steps to do so; in fact, they ignored even the most basic security measures. They should have had at least bank-level security with such a responsibility. There is no excuse.
- coliveira 9y ago
  This shows how the USA is completely hostile to its own people: not only nothing has been done to punish Equifax, but the government will block any move to regulate the activity of this incompetent and borderline criminal company.

rectang 9y ago

Equifax should not exist because the credit system causes so much harm spread out over many individuals. That problem existed before the breach, and it is just as much a problem with Equifax's competitors as with Equifax. The breach only serves to highlight what malignant parasites the credit agencies are.

cwkoss 9y ago

I think the key part of the outrage against Equifax, and part of why it is more outrageous than most breaches, is not only was customer data revealed, but also data about people who want nothing to do with Equifax. There is no action victims could have taken to avoid this breach. In most serious breaches, there is a certain amount of "well, you have to be careful who you give your information to..." even though it's not the victims fault. This factor is not present in the Equifax situation. Equifax is allowed to hold and market a product based on data of individuals who never gave consent, but has no responsibility to protect that data or repercussions when they fail. Arguably this breach has put the final nail in the coffin for using SSN's as secure identifiers. Granted, it was a horrible and mostly-already-broken system to begin with. But I think that this flawed system was still worth in excess of $14B - and Equifax's negligence effectively destroyed that value. I agree bankrupting Equifax would be heavy-handed, but it would be nice to at least see some punitive action that would discourage such negligence in the future and provide an economic disincentive to possessing vast quantities of private data.

PakG1 9y ago
I'm not an American, so I don't know. How much of Equifax's business and value was driven by credit checks and anything else having to do with SSNs? Because if the whole SSN system had a $14 billion value, which was then destroyed by Equifax's negligence, and Equifax had the majority of its business doing this stuff, wouldn't that make Equifax bankrupt? So either Equifax makes a lot of money doing other stuff, or the $14 billion in value wasn't destroyed by Equifax's negligence. I imagine it's the latter, that SSN is still being used for everything because oil tankers can't change their momentum so quickly. If you meant that SSNs can safely be predicted to be not used for identification a decade or two from now, who's to say this was the catalyst? Any system eventually gets revamped, even government systems, especially if they were already broken in the first place. There are many examples worldwide of ID systems and laws changing all the time. In fact, I just read that majority of states are supposed to require Americans to use a passport for flying now. The Real ID Act? Just a bunch of states were too slow to get it done, so they've been given an extension, but even in the US, there's work being done to revamp identification in some areas. I'm not saying that it's good or bad, I'm saying that it seems to happen eventually. Why wouldn't SSN also change up even if Equifax never happened?

totalZero 9y ago

"It's ok for a long-haul bus driver to occasionally drive while sleepy, because people on HN occasionally drive their cars while sleepy."

benchaney 9y ago

This is a false dichotomy. Equifax was extremely negligent. I don't have to be 100% perfect myself to be outraged by that.

mikeash 9y ago

What hit to their stock price? It’s the same price it was a year ago. We’ve all made computer mistakes like this, but the stakes are different. If I forget to update a framework and as a result a bunch of cat pictures leak, that’s not a big deal. If I do the exact same thing and leak important private info with financial consequences for nearly every American, that’s a much bigger deal. They data they collected needed to be stored in a bulletproof fashion. You could argue that this is impossible, but that just means the data should not have been collected at all. The calls to destroy the company seem pretty reasonable to me. This is a classic case of an externality. Equifax cost a shitload of people a bunch of money, and they’re bearing very little of the cost. Arguably they’re actually profiting from it by selling fraud protection services. The only question to me is: just how much did they cost the American people? Whatever it is, they should bear the entire cost. And I bet that cost is more than the company is worth.

ISL 9y ago
GP implies that EFX was purchased sometime after the fall and before the present day, which would have yielded an apparent profit.
- mikeash 9y ago
  Right, but they also said that they've already been punished by the hit to their stock price, which doesn't look like it's the case at all.
  - mikestew 9y ago
    We're deep enough in that I don't know who the parent of who anymore, but to be clear I bought in-the-money calls at around $93 (the hit to their stock price), and sold the contracts when it hit around $111 (seemed to have leveled off). But you're probably not talking about me, as I'm the one pissed off that those calls made money, not thinking they've been punished. It should have hit $93 and stayed there.
    - mikeash 9y ago

xkcd-sucks 9y ago

Right now it's "Today you, never Equifax." Too-big-to-fail institutions do fail do fulfill their obligations, and if they're not substantially gutted and rebuilt they will only fail to fulfill obligations to an even worse degree.

ImSkeptical 9y ago

Their stock price was temporarily damaged, and they had to have an awkward hearing in front of congress - that seems light when compared to their negligence which handed over financial and personal information for most of the country to hackers unknown. On top of this, they delayed telling the public, they admitted they only encrypt "some" of their data at rest, and a few of their executives sold stock between the time the company knew about the attack and the public didn't. Your argument is wise to consider the "let he who is without sin" perspective, but I don't find it that compelling. They had a hoard of valuable information which they carelessly stored and they paid essentially zero consequences. If I had to choose between this world, and the world where Equifax was just liquidated with the proceeds going to people affected, I'd prefer the latter. "Won't somebody think of the shareholders?" I have, but I've also contemplated the tens of millions harmed by their incompetence.

s73ver_ 9y ago

"HN of all places should be sympathetic to what happened to Equifax" Why should I be sympathetic to them, especially after how they handled it? And especially given that they make loads of money off MY DATA, and want to turn around and have the gall to charge me to see it, to make sure it's accurate?

mephitix 9y ago

This logic makes no sense to me. You have a company that stores, without consent, highly personal data for almost every American. There was an implied responsibility to protect that information. For such a company, security should be pretty high on the priority list. All of the following is negligence: 1) Store all this information, unencrypted 2) They were told of the vulnerability in March and had 2 months to update the software. 3) Afterwards, set up a broken website with a DV certificate to accept SSN numbers. 4) The website, even though was a vulnerability disclosure, tried to _sell_ an Equifax identity monitoring package. 5) Redirect your own customers to a phishing website set up by a white hat hacker 6) Allow employees to have usernames/pws like 'admin/admin' on edge servers The circumstances that led to the vulnerability, and the actions that Equifax took afterwards absolutely warrant outrage. And this is not even taking into account the original point - this is a pattern of incompetence and failure - but to add to the fire, Equifax was a company that was tasked with storing highly sensitive personal data for millions of Americans and did not take the appropriate security steps to do so; in fact, they ignored even the most basic security measures. They should have had at least bank-level security with such a responsibility. There is no excuse.

coliveira 9y ago
This shows how the USA is completely hostile to its own people: not only nothing has been done to punish Equifax, but the government will block any move to regulate the activity of this incompetent and borderline criminal company.