9 ms·

Sadly, she seems to have a gross misunderstanding of the facts of the case, as well as cybersecurity in general. There's essentially no chance of this being pa

Sadly, she seems to have a gross misunderstanding of the facts of the case, as well as cybersecurity in general. There's essentially no chance of this being passed, she's just showboating. Key questions: 1. Does this apply to all data aggregators, or just CRAs? 2. Does it apply to government breaches, banks, individual businesses, etc? 3. What additional oversight is going to be applied by the FTC that isn't already happening as part of the vast amount of other regulations? How will it protect consumers?

scrollaway 9y ago
> she seems to have a gross misunderstanding of the facts of the case, as well as cybersecurity in general. Could you actually point to where the issues are rather than make such generic claims?
- g051051 9y ago
  > "Equifax allowed personal data on more than half the adults in the country to get stolen, and its legal liability is so limited that it may end up making money off the breach." "Allowed"? She phrases that to make it sound like Equifax just left the front door open. In truth, they were hacked by sophisticated criminals (possibly state sponsored), who pinpointed a flaw in their security and exploited it. There was a detailed Bloomberg article that covered the breach in depth. They found that Equifax had paid top dollar for solid tools, but they were misconfigured (or misused) in such a way as to actually not be working. They found that they had good written procedures. Equifax knew about this vulnerability, and thought they had patched it. So how is any of that "allowed"? In addition, Equifax stock took a huge dip and hasn't recovered (down 21 as of this morning). They're also going to provide features so that all consumers (whether they were potentially impacted by the breach or not) will be able to lock and unlock their credit file, for free, forever. So not only did they take a big hit in terms of stock price, they are giving away the revenue generating lock and unlock service. > If passed into law, the bill would give the US Federal Trade Commission the authority to inspect the companies that collect vast amounts of financial data on consumers to make sure they're protecting that information. In what way does this in any way actually help consumers? Does the FTC have some sort of magic wand to prevent breaches? Does this help out with the overall problem of identity theft? Will this add any security or confidence above and beyond the existing government and industry regulations that are already in effect? Will her new law address any of these? https://www.identityforce.com/blog/2017-data-breaches https://www.identityforce.com/blog/2017-data-breaches
  - maxerickson 9y ago
    So thinking you patched a vulnerability is the same thing as patching it now? I'm gonna run to the bank and tell them I think I'm a millionaire!
  - tssva 9y ago
    If their expensive tools were misconfigured in a manner to render them effectively useless than they didn't have good procedures and follow best practices. Best practices would have included testing and auditing procedures both at deployment and ongoing to verify that they were operating as intended. By not having the proper auditing in place Equifax did allow the breach to occur.
    - g051051 9y ago
      Who knows when the flaw in their process was introduced? Perhaps it passed all the audits and tests, but got misconfigured later. There's no doubt or question that the process was flawed (in that the tools were silently failing and that a single human failure could disrupt their security). The point is, that even with solid processes and procedures, it is impossible to have perfect security. No doubt they (and every other company) will have a much higher focus on security going forward, but at the time they thought they were adequately protected. Their policies were sound, but their execution was flawed, and they got burned.
  - 52-6F-62 9y ago
    > "Allowed"? She phrases that to make it sound like Equifax just left the front door open. In truth, they were hacked by sophisticated criminals (possibly state sponsored), who pinpointed a flaw in their security and exploited it. Maybe you haven't heard about one of the exploits, but leaving the front door open is what I would call using "admin" as both username and password. This also implies no further configuration was done past install and setup... https://www.cnbc.com/2017/09/14/equifax-used-admin-for-the-login-and-password-of-a-non-us-database.html https://www.cnbc.com/2017/09/14/equifax-used-admin-for-the-l...
    - g051051 9y ago
fortythirteen 9y ago
Question 4: Where does the money from the fines go? Her main regulatory creation was a whole new agency that is completely unaccountable to the people it was supposed to serve. She's the last politician I trust with these sorts of things.
- yostrovs 9y ago
  Similar to Al Gore, if passed, she will claim credit for inventing Internet security.
  - acdha 9y ago
    You mean similar as in “she also won’t make any such claim”, right? https://www.snopes.com/quotes/internet.asp https://www.snopes.com/quotes/internet.asp
- lgbr 9y ago
  > Her main regulatory creation was a whole new agency that is completely unaccountable to the people it was supposed to serve Honest question: Is that her fault? She was just chosen to run it, but she wasn't responsible for the legislation that created it and its lack of accountability, or is that wrong?
  - fortythirteen 9y ago
    It was her bill to create a consumer protection agency under the Federal Reserve, with lifetime appointees in charge of levying fines agains businesses. Word on the street is the reason Warren and other Democrats were fighting tooth and nail (with absolutely no legal standing) to keep Trump from appointing the new head of that agency, was because they've been redistributing the fines collected to left wing political action groups.
    - deleted 9y ago
      [deleted]
    - SauciestGNU 9y ago

scrollaway 9y ago

> she seems to have a gross misunderstanding of the facts of the case, as well as cybersecurity in general. Could you actually point to where the issues are rather than make such generic claims?

g051051 9y ago
> "Equifax allowed personal data on more than half the adults in the country to get stolen, and its legal liability is so limited that it may end up making money off the breach." "Allowed"? She phrases that to make it sound like Equifax just left the front door open. In truth, they were hacked by sophisticated criminals (possibly state sponsored), who pinpointed a flaw in their security and exploited it. There was a detailed Bloomberg article that covered the breach in depth. They found that Equifax had paid top dollar for solid tools, but they were misconfigured (or misused) in such a way as to actually not be working. They found that they had good written procedures. Equifax knew about this vulnerability, and thought they had patched it. So how is any of that "allowed"? In addition, Equifax stock took a huge dip and hasn't recovered (down 21 as of this morning). They're also going to provide features so that all consumers (whether they were potentially impacted by the breach or not) will be able to lock and unlock their credit file, for free, forever. So not only did they take a big hit in terms of stock price, they are giving away the revenue generating lock and unlock service. > If passed into law, the bill would give the US Federal Trade Commission the authority to inspect the companies that collect vast amounts of financial data on consumers to make sure they're protecting that information. In what way does this in any way actually help consumers? Does the FTC have some sort of magic wand to prevent breaches? Does this help out with the overall problem of identity theft? Will this add any security or confidence above and beyond the existing government and industry regulations that are already in effect? Will her new law address any of these? https://www.identityforce.com/blog/2017-data-breaches https://www.identityforce.com/blog/2017-data-breaches
- maxerickson 9y ago
  So thinking you patched a vulnerability is the same thing as patching it now? I'm gonna run to the bank and tell them I think I'm a millionaire!
- tssva 9y ago
  If their expensive tools were misconfigured in a manner to render them effectively useless than they didn't have good procedures and follow best practices. Best practices would have included testing and auditing procedures both at deployment and ongoing to verify that they were operating as intended. By not having the proper auditing in place Equifax did allow the breach to occur.
  - g051051 9y ago
    Who knows when the flaw in their process was introduced? Perhaps it passed all the audits and tests, but got misconfigured later. There's no doubt or question that the process was flawed (in that the tools were silently failing and that a single human failure could disrupt their security). The point is, that even with solid processes and procedures, it is impossible to have perfect security. No doubt they (and every other company) will have a much higher focus on security going forward, but at the time they thought they were adequately protected. Their policies were sound, but their execution was flawed, and they got burned.
- 52-6F-62 9y ago
  > "Allowed"? She phrases that to make it sound like Equifax just left the front door open. In truth, they were hacked by sophisticated criminals (possibly state sponsored), who pinpointed a flaw in their security and exploited it. Maybe you haven't heard about one of the exploits, but leaving the front door open is what I would call using "admin" as both username and password. This also implies no further configuration was done past install and setup... https://www.cnbc.com/2017/09/14/equifax-used-admin-for-the-login-and-password-of-a-non-us-database.html https://www.cnbc.com/2017/09/14/equifax-used-admin-for-the-l...
  - g051051 9y ago

fortythirteen 9y ago

Question 4: Where does the money from the fines go? Her main regulatory creation was a whole new agency that is completely unaccountable to the people it was supposed to serve. She's the last politician I trust with these sorts of things.

yostrovs 9y ago
Similar to Al Gore, if passed, she will claim credit for inventing Internet security.
- acdha 9y ago
  You mean similar as in “she also won’t make any such claim”, right? https://www.snopes.com/quotes/internet.asp https://www.snopes.com/quotes/internet.asp
lgbr 9y ago
> Her main regulatory creation was a whole new agency that is completely unaccountable to the people it was supposed to serve Honest question: Is that her fault? She was just chosen to run it, but she wasn't responsible for the legislation that created it and its lack of accountability, or is that wrong?
- fortythirteen 9y ago
  It was her bill to create a consumer protection agency under the Federal Reserve, with lifetime appointees in charge of levying fines agains businesses. Word on the street is the reason Warren and other Democrats were fighting tooth and nail (with absolutely no legal standing) to keep Trump from appointing the new head of that agency, was because they've been redistributing the fines collected to left wing political action groups.
  - deleted 9y ago
    [deleted]
  - SauciestGNU 9y ago