6 ms·

> That is precisely the data that rightfully belongs to individuals. That is precisely what it's not. Your existence isn't a secret. Things like your address

> That is precisely the data that rightfully belongs to individuals. That is precisely what it's not. Your existence isn't a secret. Things like your address, phone number, and legal information are freely available from a variety of sources. When you do business with banks or other lending institutions, you are explicitly granting them the right to exchange your payment information with other institutions and CRAs. When you seek or attain employment, you are told if the company makes use of some service like The Work Number for previous employment and salary tracking. > Pretending that a "secure" system can be devised which will protect that data is irresponsible, because it is impossible. The data will leak eventually. This is sadly true. > grotesquely harmful institutions like the CRAs Without CRAs, how would companies judge your credit worthiness? Access to credit and loans would be much more difficult, and would be much more expensive, without them. Or some similar mechanism to share that sort of information. Again, the harm doesn't come from the CRAs. A CRA doesn't grant an identity thief access to your accounts, or open credit in your name. That's the banks, CC companies, utilities, etc. who will open accounts with insufficient proof of identity. It's not the data that's toxic, it's the misuse of it. Allowing accounts to be opened or accessed with easily searched or guessed information is where the real problem is.

avs733 7y ago
I feel like there is a communication disconnect in this thread between is/isn't and should/shouldn't be
rectang 7y ago
> It's not the _data_ that's toxic, it's the misuse of it. That's like saying strychnine is harmless unless you swallow it. The credit reporting system is built atop the tortured bodies of the victims of identity theft. Every time an individual's personal data is transmitted, that individual is put at risk. The CRAs profit from the profligate dissemination of sensitive data, but the individuals who were compelled to participate and then came to harm are systematically prevented from obtaining recompense.
- g051051 7y ago
  > That's like saying strychnine is harmless unless you swallow it. Well, yeah... of course. > The CRAs profit from the profligate dissemination of sensitive data, Everyone profits. The CRAs who are the aggregators, the companies that share the information, and the consumers who get access to cheap and easy credit.
  - rectang 7y ago
    > Everyone profits. Victims of identity theft exist. Even if you are content to sacrifice them for the greater good, they are real people.
    - g051051 7y ago
      Nice strawman you're knocking over there. I don't think any level of identity theft is acceptable. I think it should be easier for people who are victims of such crimes to have better tools for resolving it. I think we need a better system for establishing identity, and much tougher penalties for people that commit these crimes. All I'm saying is that the system we have now provides a great many benefits to people, and that we should look at how to fix it, rather than eliminate it. The CRAs are just 3 companies, out of the thousands that have had data stolen over the years, and will continue to do so forever, because it is impossible to have perfect security. People have cars. Sometimes they get stolen. Should we eliminate cars, so that we can eliminate car theft?
      - rectang 7y ago
        The Equifax data breach is itself just one among many data breaches, and small potatoes compared to some others. What distinguishes Equifax and the other CRAs is the crucial role they play in a system where data breaches everywhere cause harm to individuals. Counting on Equifax to solve this problem is absurd. Equifax doesn't care about individual consumers because those consumers are not their customers. Combating identity theft is a cost center; CRAs cannot differentiate themselves in the marketplace through better tools to prevent an externality. Consumers have to fight for their own interests because the CRAs will only be dragged along kicking and screaming.
mola 7y ago
Why do you take it as a fact that CRA help with the thing the claim to help with?
- g051051 7y ago
  Because that's what they do? What do you think they do, if not that?
mikeash 7y ago
“When you do business with banks or other lending institutions, you are explicitly granting them the right to exchange your payment information with other institutions and CRAs.” It’s not like we have a choice. Every such business participates. I suppose it’s possible to avoid credit reporting by not having a bank account or utilities or a job, but that’s not a very practical way for most people to live. I don’t see the point in blaming banks instead of credit reporting agencies. They’re all part of one big system that works together. All parts of the system make it the way it is. It’s no more sensible to try to blame an individual component of the system than it is to debate whether to blame a murderer’s hands or his legs.
- g051051 7y ago
  You need to put the blame where it lies. CRAs simply aggregate data. They aren't the ones that grant credit. If someone opens a CC in your name, it wasn't the CRA that did it. So blame the bank or CC company for not sufficiently verifying identity. Think about how the process works. A criminal goes online and applies for a CC, using your personal information. The CC company goes to a CRA to check credit worthiness. The CRA says "Sure, mikeash is a responsible person who pays his debts on time". The CC company says "Great!" and hands the criminal an account in your name. It's the CC company that didn't do the due diligence to verify that it was really you. However, since the Equifax hack and the resulting backlash, the CRAs have started offering much greater consumer control to consumers. Equifax has a free service that allows you to keep your information locked and actually notify you in real time when a request is made, that you can block or allow as you wish. Basically 2FA for credit. If the other CRAs don't have that service, they soon will.
  - mikeash 7y ago
    CRAs could insist on positive verification of identity before they tell anyone about my credit history. If they did, they’d fix the problem. Because they don’t, they assis in abuses. Why would I not consider them to share the blame?
    - g051051 7y ago
wstuartcl 7y ago
Its not a problem with Data, it is a problem with "The Data" that happens to be misused for authentication. Who cares if people know person X's firstname is Mark. When you start combining that data with address, phone number, age, SS#, employment history, mothers maiden name etc and that set of data also happens to be globally misused by the industry as auth basis data it becomes dangerous. If they can't secure the combined data set (and you seem to agree that they can't) they certainly should not both be proposing its use for authentication (which they offer as many costly services for business and govt) and also creating the huge data store against the population. The net here is that this data is unsuitable for auth -- but at the same time it IS USED for auth -- finally it is gathered and stored as if it is not credential material. I also agree that this review/investigation is barking up the wrong tree -- the most serious crime here is that this information (even without any major mental gymnastics) can and will be easily used to identify likely covert government employees easily by and adversary that has access to it.

avs733 7y ago

I feel like there is a communication disconnect in this thread between is/isn't and should/shouldn't be

rectang 7y ago

> It's not the _data_ that's toxic, it's the misuse of it. That's like saying strychnine is harmless unless you swallow it. The credit reporting system is built atop the tortured bodies of the victims of identity theft. Every time an individual's personal data is transmitted, that individual is put at risk. The CRAs profit from the profligate dissemination of sensitive data, but the individuals who were compelled to participate and then came to harm are systematically prevented from obtaining recompense.

g051051 7y ago
> That's like saying strychnine is harmless unless you swallow it. Well, yeah... of course. > The CRAs profit from the profligate dissemination of sensitive data, Everyone profits. The CRAs who are the aggregators, the companies that share the information, and the consumers who get access to cheap and easy credit.
- rectang 7y ago
  > Everyone profits. Victims of identity theft exist. Even if you are content to sacrifice them for the greater good, they are real people.
  - g051051 7y ago
    Nice strawman you're knocking over there. I don't think any level of identity theft is acceptable. I think it should be easier for people who are victims of such crimes to have better tools for resolving it. I think we need a better system for establishing identity, and much tougher penalties for people that commit these crimes. All I'm saying is that the system we have now provides a great many benefits to people, and that we should look at how to fix it, rather than eliminate it. The CRAs are just 3 companies, out of the thousands that have had data stolen over the years, and will continue to do so forever, because it is impossible to have perfect security. People have cars. Sometimes they get stolen. Should we eliminate cars, so that we can eliminate car theft?
    - rectang 7y ago
      The Equifax data breach is itself just one among many data breaches, and small potatoes compared to some others. What distinguishes Equifax and the other CRAs is the crucial role they play in a system where data breaches everywhere cause harm to individuals. Counting on Equifax to solve this problem is absurd. Equifax doesn't care about individual consumers because those consumers are not their customers. Combating identity theft is a cost center; CRAs cannot differentiate themselves in the marketplace through better tools to prevent an externality. Consumers have to fight for their own interests because the CRAs will only be dragged along kicking and screaming.

mola 7y ago

Why do you take it as a fact that CRA help with the thing the claim to help with?

g051051 7y ago
Because that's what they do? What do you think they do, if not that?

mikeash 7y ago

“When you do business with banks or other lending institutions, you are explicitly granting them the right to exchange your payment information with other institutions and CRAs.” It’s not like we have a choice. Every such business participates. I suppose it’s possible to avoid credit reporting by not having a bank account or utilities or a job, but that’s not a very practical way for most people to live. I don’t see the point in blaming banks instead of credit reporting agencies. They’re all part of one big system that works together. All parts of the system make it the way it is. It’s no more sensible to try to blame an individual component of the system than it is to debate whether to blame a murderer’s hands or his legs.

g051051 7y ago
You need to put the blame where it lies. CRAs simply aggregate data. They aren't the ones that grant credit. If someone opens a CC in your name, it wasn't the CRA that did it. So blame the bank or CC company for not sufficiently verifying identity. Think about how the process works. A criminal goes online and applies for a CC, using your personal information. The CC company goes to a CRA to check credit worthiness. The CRA says "Sure, mikeash is a responsible person who pays his debts on time". The CC company says "Great!" and hands the criminal an account in your name. It's the CC company that didn't do the due diligence to verify that it was really you. However, since the Equifax hack and the resulting backlash, the CRAs have started offering much greater consumer control to consumers. Equifax has a free service that allows you to keep your information locked and actually notify you in real time when a request is made, that you can block or allow as you wish. Basically 2FA for credit. If the other CRAs don't have that service, they soon will.
- mikeash 7y ago
  CRAs could insist on positive verification of identity before they tell anyone about my credit history. If they did, they’d fix the problem. Because they don’t, they assis in abuses. Why would I not consider them to share the blame?
  - g051051 7y ago

wstuartcl 7y ago

Its not a problem with Data, it is a problem with "The Data" that happens to be misused for authentication. Who cares if people know person X's firstname is Mark. When you start combining that data with address, phone number, age, SS#, employment history, mothers maiden name etc and that set of data also happens to be globally misused by the industry as auth basis data it becomes dangerous. If they can't secure the combined data set (and you seem to agree that they can't) they certainly should not both be proposing its use for authentication (which they offer as many costly services for business and govt) and also creating the huge data store against the population. The net here is that this data is unsuitable for auth -- but at the same time it IS USED for auth -- finally it is gathered and stored as if it is not credential material. I also agree that this review/investigation is barking up the wrong tree -- the most serious crime here is that this information (even without any major mental gymnastics) can and will be easily used to identify likely covert government employees easily by and adversary that has access to it.