7 ms·

It's not "data which rightfully belongs to individuals". It's data that belongs to the institutions reporting to the CRAs. CRAs are data aggregators. Everyth

It's not "data which rightfully belongs to individuals". It's data that belongs to the institutions reporting to the CRAs. CRAs are data aggregators. Everything they have on you was either gathered from public records or was sent to them from an institution that you do business with. The real problem is that we use publicly available, non-secret data to establish identity. Instead, we need a secure, unique personal identification system, as well as tougher punishments for people that commit identity-based fraud and theft.

rectang 7y ago
> Everything they have on you was either gathered from public records or was sent to them from an institution that you do business with. That is precisely the data that rightfully belongs to individuals. It should be much, much harder for companies to collect it and sell it. "Data is a toxic asset." — Bruce Schneier Pretending that a "secure" system can be devised which will protect that data is irresponsible, because it is impossible. The data will leak eventually. When it does, under the current regime, the damage inflicted on individual victims is wildly disproportionate. Equifax is the analogue to a gross polluter dumping dioxin into a community's backyards. But getting damages proportionate to the harm out of Equifax is hopeless, because US laws do not acknowledge the toxicity of data. The US needs something like the GDPR in order to protect us from grotesquely harmful institutions like the CRAs. We are in the early days of the internet, akin to the early days of the industrial revolution — before the harm that toxic chemical pollution causes was recognized and regulated.
- g051051 7y ago
  > That is precisely the data that rightfully belongs to individuals. That is precisely what it's not. Your existence isn't a secret. Things like your address, phone number, and legal information are freely available from a variety of sources. When you do business with banks or other lending institutions, you are explicitly granting them the right to exchange your payment information with other institutions and CRAs. When you seek or attain employment, you are told if the company makes use of some service like The Work Number for previous employment and salary tracking. > Pretending that a "secure" system can be devised which will protect that data is irresponsible, because it is impossible. The data will leak eventually. This is sadly true. > grotesquely harmful institutions like the CRAs Without CRAs, how would companies judge your credit worthiness? Access to credit and loans would be much more difficult, and would be much more expensive, without them. Or some similar mechanism to share that sort of information. Again, the harm doesn't come from the CRAs. A CRA doesn't grant an identity thief access to your accounts, or open credit in your name. That's the banks, CC companies, utilities, etc. who will open accounts with insufficient proof of identity. It's not the data that's toxic, it's the misuse of it. Allowing accounts to be opened or accessed with easily searched or guessed information is where the real problem is.
  - avs733 7y ago
    I feel like there is a communication disconnect in this thread between is/isn't and should/shouldn't be
  - rectang 7y ago
    > It's not the _data_ that's toxic, it's the misuse of it. That's like saying strychnine is harmless unless you swallow it. The credit reporting system is built atop the tortured bodies of the victims of identity theft. Every time an individual's personal data is transmitted, that individual is put at risk. The CRAs profit from the profligate dissemination of sensitive data, but the individuals who were compelled to participate and then came to harm are systematically prevented from obtaining recompense.
    - g051051 7y ago
      > That's like saying strychnine is harmless unless you swallow it. Well, yeah... of course. > The CRAs profit from the profligate dissemination of sensitive data, Everyone profits. The CRAs who are the aggregators, the companies that share the information, and the consumers who get access to cheap and easy credit.
      - rectang 7y ago
        > Everyone profits. Victims of identity theft exist. Even if you are content to sacrifice them for the greater good, they are real people.
        g051051 7y ago
        Nice strawman you're knocking over there. I don't think any level of identity theft is acceptable. I think it should be easier for people who are victims of such crimes to have better tools for resolving it. I think we need a better system for establishing identity, and much tougher penalties for people that commit these crimes. All I'm saying is that the system we have now provides a great many benefits to people, and that we should look at how to fix it, rather than eliminate it. The CRAs are just 3 companies, out of the thousands that have had data stolen over the years, and will continue to do so forever, because it is impossible to have perfect security. People have cars. Sometimes they get stolen. Should we eliminate cars, so that we can eliminate car theft?
reaperducer 7y ago
Instead, we need a secure, unique personal identification system Secure. Unique. Personally identifiable. Pick any two.
noob_slayer 7y ago
It's data which belongs to the hacker(s) now, too, since Equifax made it publicly accessible.
- g051051 7y ago
  > since Equifax made it publicly accessible It was stolen, not made "publicly accessible". You or I could never have accessed it, it took a sophisticated team months to do it. Don't forget the Yahoo! and Marriott breaches, both of which were considerably larger than the data "Equifax made [...] publicly accessible".
  - noob_slayer 7y ago
    Stolen implies that Equifax lost possession of the data, which I don't think is the case. It takes teams months to get to the moon too, but that doesn't mean it's not out there for anyone to access.
    - g051051 7y ago
      Data is considered stolen when it's duplicated without consent. Hence, "made publicly accessible" is incorrect. It was never "public"...people browsing the web couldn't have stumbled upon it, any more than people riding a train could accidentally have wound up on the moon. The moon thing is a great analogy. Everyone knows the moon is there, but the process of getting to it is an enormous task beyond the reach of all but the most determined, skilled, and well-financed parties.
specialist 7y ago
My data is me, I own it. Any one using it for profit owes me my cut.
- g051051 7y ago
  Your "cut" is continued access to cheap credit.
  - specialist 7y ago
    Don't need it, didn't ask for it.
    - g051051 7y ago
      If that's true, then you aren't interacting with companies that participate in CRA information exchange and this doesn't affect you. All a CRA would have is public information that's already freely available.
      - specialist 7y ago
        I'm part of the breach. How is it not about me?
        g051051 7y ago
        You said "don't need it, didn't ask for it". For that to be true, you would have never asked for credit, applied for loans, etc. Then the only information a CRA would have had about you (if any) was public information that could be obtained elsewhere. So what information was disclosed that you should control and entitles you to a "cut" of anything, then?
        specialist 7y ago
        They profit from my data. I want my cut. There are alternatives to (economic) slavery and death. For personal credit scoring, in particular, I'd also accept either Sweden (https://en.wikipedia.org/wiki/Credit_score#Sweden https://en.wikipedia.org/wiki/Credit_score#Sweden) or Switzerland (https://en.wikipedia.org/wiki/Zentralstelle_für_Kreditinformation https://en.wikipedia.org/wiki/Zentralstelle_für_Kreditinform...) strategies. Both are civilized, transparent, accountable. Alas, sadly, no unnecessary corporate profiteering.

rectang 7y ago

> Everything they have on you was either gathered from public records or was sent to them from an institution that you do business with. That is precisely the data that rightfully belongs to individuals. It should be much, much harder for companies to collect it and sell it. "Data is a toxic asset." — Bruce Schneier Pretending that a "secure" system can be devised which will protect that data is irresponsible, because it is impossible. The data will leak eventually. When it does, under the current regime, the damage inflicted on individual victims is wildly disproportionate. Equifax is the analogue to a gross polluter dumping dioxin into a community's backyards. But getting damages proportionate to the harm out of Equifax is hopeless, because US laws do not acknowledge the toxicity of data. The US needs something like the GDPR in order to protect us from grotesquely harmful institutions like the CRAs. We are in the early days of the internet, akin to the early days of the industrial revolution — before the harm that toxic chemical pollution causes was recognized and regulated.

g051051 7y ago
> That is precisely the data that rightfully belongs to individuals. That is precisely what it's not. Your existence isn't a secret. Things like your address, phone number, and legal information are freely available from a variety of sources. When you do business with banks or other lending institutions, you are explicitly granting them the right to exchange your payment information with other institutions and CRAs. When you seek or attain employment, you are told if the company makes use of some service like The Work Number for previous employment and salary tracking. > Pretending that a "secure" system can be devised which will protect that data is irresponsible, because it is impossible. The data will leak eventually. This is sadly true. > grotesquely harmful institutions like the CRAs Without CRAs, how would companies judge your credit worthiness? Access to credit and loans would be much more difficult, and would be much more expensive, without them. Or some similar mechanism to share that sort of information. Again, the harm doesn't come from the CRAs. A CRA doesn't grant an identity thief access to your accounts, or open credit in your name. That's the banks, CC companies, utilities, etc. who will open accounts with insufficient proof of identity. It's not the data that's toxic, it's the misuse of it. Allowing accounts to be opened or accessed with easily searched or guessed information is where the real problem is.
- avs733 7y ago
  I feel like there is a communication disconnect in this thread between is/isn't and should/shouldn't be
- rectang 7y ago
  > It's not the _data_ that's toxic, it's the misuse of it. That's like saying strychnine is harmless unless you swallow it. The credit reporting system is built atop the tortured bodies of the victims of identity theft. Every time an individual's personal data is transmitted, that individual is put at risk. The CRAs profit from the profligate dissemination of sensitive data, but the individuals who were compelled to participate and then came to harm are systematically prevented from obtaining recompense.
  - g051051 7y ago
    > That's like saying strychnine is harmless unless you swallow it. Well, yeah... of course. > The CRAs profit from the profligate dissemination of sensitive data, Everyone profits. The CRAs who are the aggregators, the companies that share the information, and the consumers who get access to cheap and easy credit.
    - rectang 7y ago
      > Everyone profits. Victims of identity theft exist. Even if you are content to sacrifice them for the greater good, they are real people.
      - g051051 7y ago
        Nice strawman you're knocking over there. I don't think any level of identity theft is acceptable. I think it should be easier for people who are victims of such crimes to have better tools for resolving it. I think we need a better system for establishing identity, and much tougher penalties for people that commit these crimes. All I'm saying is that the system we have now provides a great many benefits to people, and that we should look at how to fix it, rather than eliminate it. The CRAs are just 3 companies, out of the thousands that have had data stolen over the years, and will continue to do so forever, because it is impossible to have perfect security. People have cars. Sometimes they get stolen. Should we eliminate cars, so that we can eliminate car theft?

reaperducer 7y ago

Instead, we need a secure, unique personal identification system Secure. Unique. Personally identifiable. Pick any two.

noob_slayer 7y ago

It's data which belongs to the hacker(s) now, too, since Equifax made it publicly accessible.

g051051 7y ago
> since Equifax made it publicly accessible It was stolen, not made "publicly accessible". You or I could never have accessed it, it took a sophisticated team months to do it. Don't forget the Yahoo! and Marriott breaches, both of which were considerably larger than the data "Equifax made [...] publicly accessible".
- noob_slayer 7y ago
  Stolen implies that Equifax lost possession of the data, which I don't think is the case. It takes teams months to get to the moon too, but that doesn't mean it's not out there for anyone to access.
  - g051051 7y ago
    Data is considered stolen when it's duplicated without consent. Hence, "made publicly accessible" is incorrect. It was never "public"...people browsing the web couldn't have stumbled upon it, any more than people riding a train could accidentally have wound up on the moon. The moon thing is a great analogy. Everyone knows the moon is there, but the process of getting to it is an enormous task beyond the reach of all but the most determined, skilled, and well-financed parties.

specialist 7y ago

My data is me, I own it. Any one using it for profit owes me my cut.

g051051 7y ago
Your "cut" is continued access to cheap credit.
- specialist 7y ago
  Don't need it, didn't ask for it.
  - g051051 7y ago
    If that's true, then you aren't interacting with companies that participate in CRA information exchange and this doesn't affect you. All a CRA would have is public information that's already freely available.
    - specialist 7y ago
      I'm part of the breach. How is it not about me?
      - g051051 7y ago
        You said "don't need it, didn't ask for it". For that to be true, you would have never asked for credit, applied for loans, etc. Then the only information a CRA would have had about you (if any) was public information that could be obtained elsewhere. So what information was disclosed that you should control and entitles you to a "cut" of anything, then?
        specialist 7y ago
        They profit from my data. I want my cut. There are alternatives to (economic) slavery and death. For personal credit scoring, in particular, I'd also accept either Sweden (https://en.wikipedia.org/wiki/Credit_score#Sweden https://en.wikipedia.org/wiki/Credit_score#Sweden) or Switzerland (https://en.wikipedia.org/wiki/Zentralstelle_für_Kreditinformation https://en.wikipedia.org/wiki/Zentralstelle_für_Kreditinform...) strategies. Both are civilized, transparent, accountable. Alas, sadly, no unnecessary corporate profiteering.