4 ms·

> Everything they have on you was either gathered from public records or was sent to them from an institution that you do business with. That is precisely the

> Everything they have on you was either gathered from public records or was sent to them from an institution that you do business with. That is precisely the data that rightfully belongs to individuals. It should be much, much harder for companies to collect it and sell it. "Data is a toxic asset." — Bruce Schneier Pretending that a "secure" system can be devised which will protect that data is irresponsible, because it is impossible. The data will leak eventually. When it does, under the current regime, the damage inflicted on individual victims is wildly disproportionate. Equifax is the analogue to a gross polluter dumping dioxin into a community's backyards. But getting damages proportionate to the harm out of Equifax is hopeless, because US laws do not acknowledge the toxicity of data. The US needs something like the GDPR in order to protect us from grotesquely harmful institutions like the CRAs. We are in the early days of the internet, akin to the early days of the industrial revolution — before the harm that toxic chemical pollution causes was recognized and regulated.

g051051 7y ago
> That is precisely the data that rightfully belongs to individuals. That is precisely what it's not. Your existence isn't a secret. Things like your address, phone number, and legal information are freely available from a variety of sources. When you do business with banks or other lending institutions, you are explicitly granting them the right to exchange your payment information with other institutions and CRAs. When you seek or attain employment, you are told if the company makes use of some service like The Work Number for previous employment and salary tracking. > Pretending that a "secure" system can be devised which will protect that data is irresponsible, because it is impossible. The data will leak eventually. This is sadly true. > grotesquely harmful institutions like the CRAs Without CRAs, how would companies judge your credit worthiness? Access to credit and loans would be much more difficult, and would be much more expensive, without them. Or some similar mechanism to share that sort of information. Again, the harm doesn't come from the CRAs. A CRA doesn't grant an identity thief access to your accounts, or open credit in your name. That's the banks, CC companies, utilities, etc. who will open accounts with insufficient proof of identity. It's not the data that's toxic, it's the misuse of it. Allowing accounts to be opened or accessed with easily searched or guessed information is where the real problem is.
- avs733 7y ago
  I feel like there is a communication disconnect in this thread between is/isn't and should/shouldn't be
- rectang 7y ago
  > It's not the _data_ that's toxic, it's the misuse of it. That's like saying strychnine is harmless unless you swallow it. The credit reporting system is built atop the tortured bodies of the victims of identity theft. Every time an individual's personal data is transmitted, that individual is put at risk. The CRAs profit from the profligate dissemination of sensitive data, but the individuals who were compelled to participate and then came to harm are systematically prevented from obtaining recompense.
  - g051051 7y ago
    > That's like saying strychnine is harmless unless you swallow it. Well, yeah... of course. > The CRAs profit from the profligate dissemination of sensitive data, Everyone profits. The CRAs who are the aggregators, the companies that share the information, and the consumers who get access to cheap and easy credit.
    - rectang 7y ago
      > Everyone profits. Victims of identity theft exist. Even if you are content to sacrifice them for the greater good, they are real people.
      - g051051 7y ago
        Nice strawman you're knocking over there. I don't think any level of identity theft is acceptable. I think it should be easier for people who are victims of such crimes to have better tools for resolving it. I think we need a better system for establishing identity, and much tougher penalties for people that commit these crimes. All I'm saying is that the system we have now provides a great many benefits to people, and that we should look at how to fix it, rather than eliminate it. The CRAs are just 3 companies, out of the thousands that have had data stolen over the years, and will continue to do so forever, because it is impossible to have perfect security. People have cars. Sometimes they get stolen. Should we eliminate cars, so that we can eliminate car theft?

g051051 7y ago

> That is precisely the data that rightfully belongs to individuals. That is precisely what it's not. Your existence isn't a secret. Things like your address, phone number, and legal information are freely available from a variety of sources. When you do business with banks or other lending institutions, you are explicitly granting them the right to exchange your payment information with other institutions and CRAs. When you seek or attain employment, you are told if the company makes use of some service like The Work Number for previous employment and salary tracking. > Pretending that a "secure" system can be devised which will protect that data is irresponsible, because it is impossible. The data will leak eventually. This is sadly true. > grotesquely harmful institutions like the CRAs Without CRAs, how would companies judge your credit worthiness? Access to credit and loans would be much more difficult, and would be much more expensive, without them. Or some similar mechanism to share that sort of information. Again, the harm doesn't come from the CRAs. A CRA doesn't grant an identity thief access to your accounts, or open credit in your name. That's the banks, CC companies, utilities, etc. who will open accounts with insufficient proof of identity. It's not the data that's toxic, it's the misuse of it. Allowing accounts to be opened or accessed with easily searched or guessed information is where the real problem is.

avs733 7y ago
I feel like there is a communication disconnect in this thread between is/isn't and should/shouldn't be
rectang 7y ago
> It's not the _data_ that's toxic, it's the misuse of it. That's like saying strychnine is harmless unless you swallow it. The credit reporting system is built atop the tortured bodies of the victims of identity theft. Every time an individual's personal data is transmitted, that individual is put at risk. The CRAs profit from the profligate dissemination of sensitive data, but the individuals who were compelled to participate and then came to harm are systematically prevented from obtaining recompense.
- g051051 7y ago
  > That's like saying strychnine is harmless unless you swallow it. Well, yeah... of course. > The CRAs profit from the profligate dissemination of sensitive data, Everyone profits. The CRAs who are the aggregators, the companies that share the information, and the consumers who get access to cheap and easy credit.
  - rectang 7y ago
    > Everyone profits. Victims of identity theft exist. Even if you are content to sacrifice them for the greater good, they are real people.
    - g051051 7y ago
      Nice strawman you're knocking over there. I don't think any level of identity theft is acceptable. I think it should be easier for people who are victims of such crimes to have better tools for resolving it. I think we need a better system for establishing identity, and much tougher penalties for people that commit these crimes. All I'm saying is that the system we have now provides a great many benefits to people, and that we should look at how to fix it, rather than eliminate it. The CRAs are just 3 companies, out of the thousands that have had data stolen over the years, and will continue to do so forever, because it is impossible to have perfect security. People have cars. Sometimes they get stolen. Should we eliminate cars, so that we can eliminate car theft?