5 ms·

My insurance company. And NICE! they are offering me free credit monitoring. Only I still have free credit monitoring from the OPM breach where the federal go

My insurance company. And NICE! they are offering me free credit monitoring. Only I still have free credit monitoring from the OPM breach where the federal government lost all my personal information to what is probably nation-state level hackers. No consequences, the trend will continue. Consider all of your information compromised, always.

snapetom 5y ago
With so many data breaches occurring, we all probably have free credit report monitoring for life. It's completely ridiculous. There's zero consequences for bad security. All companies need to do is report the breach to the government, buy "credit monitoring" for the victims which costs pennies, and deal with half a day of bad press on Twitter. Meanwhile, consumers have to deal with identity theft consequences, which in a court of law, is nearly impossible to tie back to a specific incident. Until governments impose serious fines, even to mom and pop businesses scaled up to massive corporations, this will not change.
- kylehotchkiss 5y ago
  Since everybody already has free credit monitoring, it seems like maybe they should be paid cash for breaches in the future.
  - lotsofpulp 5y ago
    I bet a lot of people would sign up to pay lower premiums in exchange for not having their data be private. I probably would too depending on how much cheaper. People already use GoodRx discount cards at pharmacies.
  - jlmorton 5y ago
    There's was an option to accept $50 in lieu of credit monitoring last time.
- b9a2cab5 5y ago
  Good IT and engineering staff is a lot more expensive than even a fine for 10% of your annual revenue. Hiring a single good security engineer might cost 400k or more. Good luck getting your insurance company that pays $100k to senior engineers to do that.
  - snapetom 5y ago
    That is definitely a key problem. Why pay for even one security professional when the consequences are just a few grand in credit monitoring for your customers?
  - perl4ever 5y ago
    I applied for a programming job with an insurance company once and then the first screening test involved interpreting flowcharts, looked like they were photocopied from a 1970s textbook. I decided then and there it wasn't worth it. >$100k to senior engineers Could be half that and no technical screening whatsoever.
    - pettycashstash2 5y ago
      Most technical operations are outsourced. They even have a separate company in india for obvious cost savings reasons.
      - perl4ever 5y ago
        Anthem specifically? Maybe, but insurance and other mundane companies in general hire Americans for IT jobs, only in places like Indiana, upstate NY, or the southeastern US. Often working with people who are in, say, New Delhi, but not being replaced by them. Outsourcing frequently means outsourcing to people in the US who are paid enough less to be a logical option.
- kingcharles 5y ago
  I need to buy shares in credit monitoring companies. It's the industry of the future!
- disabled 5y ago
  A lot of countries have solved this problem. I am a dual US|EU (Croatian) citizen. On the EU side, we have smart chip national ID cards that are being adopted EU-wide. In Croatia, you can use those smart chip national ID cards for governmental affairs with a USB smart chip reader (for authentication) on the e-citizens portal.
- philwelch 5y ago
  There’s a requirement that buildings need to have building plans that are personally approved and vouched for by a credentialed Professional Engineer, who takes personal liability—up to and including criminal liability for negligent homicide—if the building collapses and harms people due to a design flaw. I think that’s a good model for this type of problem.
  - EricE 5y ago
    Yes - computer "science" is a joke. I'm certainly not one for rampant regulation, but this is an area that needs to get seriously beefed up. Especially with the right systems far more people can be harmed than by a building collapse :p
    - hereforphone 5y ago
      Computer science is a real science and is fine. It is not however engineering. Anyway, the problems lie in the information security industry, which is amateur in comparison.
      - throwawayboise 5y ago
        Yes, corporate IT is basically equivalent to 1800's era factory technology. It works, but there are massive safety issues.
        hulitu 5y ago
        The technology is there. You just have to use it. It does not help however, that the most popular mobile and desktop OSs make money with your data which leads to absymal security practices.
  - maccolgan 5y ago
    Perhaps it's indeed time for serious companies (these are definitely not MVPs) to have security insurance and they'd mandate some standard.
- perl4ever 5y ago
  >identity theft consequences >Until governments impose serious fines Or maybe change the language? It's not possible to steal an identity; it's a fiction that is convenient for corporations handling personal information in ways that cost society.

snapetom 5y ago

With so many data breaches occurring, we all probably have free credit report monitoring for life. It's completely ridiculous. There's zero consequences for bad security. All companies need to do is report the breach to the government, buy "credit monitoring" for the victims which costs pennies, and deal with half a day of bad press on Twitter. Meanwhile, consumers have to deal with identity theft consequences, which in a court of law, is nearly impossible to tie back to a specific incident. Until governments impose serious fines, even to mom and pop businesses scaled up to massive corporations, this will not change.

kylehotchkiss 5y ago
Since everybody already has free credit monitoring, it seems like maybe they should be paid cash for breaches in the future.
- lotsofpulp 5y ago
  I bet a lot of people would sign up to pay lower premiums in exchange for not having their data be private. I probably would too depending on how much cheaper. People already use GoodRx discount cards at pharmacies.
- jlmorton 5y ago
  There's was an option to accept $50 in lieu of credit monitoring last time.
b9a2cab5 5y ago
Good IT and engineering staff is a lot more expensive than even a fine for 10% of your annual revenue. Hiring a single good security engineer might cost 400k or more. Good luck getting your insurance company that pays $100k to senior engineers to do that.
- snapetom 5y ago
  That is definitely a key problem. Why pay for even one security professional when the consequences are just a few grand in credit monitoring for your customers?
- perl4ever 5y ago
  I applied for a programming job with an insurance company once and then the first screening test involved interpreting flowcharts, looked like they were photocopied from a 1970s textbook. I decided then and there it wasn't worth it. >$100k to senior engineers Could be half that and no technical screening whatsoever.
  - pettycashstash2 5y ago
    Most technical operations are outsourced. They even have a separate company in india for obvious cost savings reasons.
    - perl4ever 5y ago
      Anthem specifically? Maybe, but insurance and other mundane companies in general hire Americans for IT jobs, only in places like Indiana, upstate NY, or the southeastern US. Often working with people who are in, say, New Delhi, but not being replaced by them. Outsourcing frequently means outsourcing to people in the US who are paid enough less to be a logical option.
kingcharles 5y ago
I need to buy shares in credit monitoring companies. It's the industry of the future!
disabled 5y ago
A lot of countries have solved this problem. I am a dual US|EU (Croatian) citizen. On the EU side, we have smart chip national ID cards that are being adopted EU-wide. In Croatia, you can use those smart chip national ID cards for governmental affairs with a USB smart chip reader (for authentication) on the e-citizens portal.
philwelch 5y ago
There’s a requirement that buildings need to have building plans that are personally approved and vouched for by a credentialed Professional Engineer, who takes personal liability—up to and including criminal liability for negligent homicide—if the building collapses and harms people due to a design flaw. I think that’s a good model for this type of problem.
- EricE 5y ago
  Yes - computer "science" is a joke. I'm certainly not one for rampant regulation, but this is an area that needs to get seriously beefed up. Especially with the right systems far more people can be harmed than by a building collapse :p
  - hereforphone 5y ago
    Computer science is a real science and is fine. It is not however engineering. Anyway, the problems lie in the information security industry, which is amateur in comparison.
    - throwawayboise 5y ago
      Yes, corporate IT is basically equivalent to 1800's era factory technology. It works, but there are massive safety issues.
      - hulitu 5y ago
        The technology is there. You just have to use it. It does not help however, that the most popular mobile and desktop OSs make money with your data which leads to absymal security practices.
- maccolgan 5y ago
  Perhaps it's indeed time for serious companies (these are definitely not MVPs) to have security insurance and they'd mandate some standard.
perl4ever 5y ago
>identity theft consequences >Until governments impose serious fines Or maybe change the language? It's not possible to steal an identity; it's a fiction that is convenient for corporations handling personal information in ways that cost society.