4 ms·

The fact that this was even being considered shows how pitifully little anyone learned from the Equifax breach.

imglorp 5y ago
Forget Equifax ... how about the Office of Personnel Management? People may well have lost their lives as a result. We may not know for decades. https://www.lawfareblog.com/why-opm-hack-far-worse-you-imagine https://www.lawfareblog.com/why-opm-hack-far-worse-you-imagi... Oh, and the IRS has already been breached at least once. I'm not wild about waiting for the next one. Maybe government is not the best group to be holding your personal data. https://www.nytimes.com/2015/05/27/business/breach-exposes-irs-tax-returns.html https://www.nytimes.com/2015/05/27/business/breach-exposes-i...
- woodruffw 5y ago
  All things being equal, the US government is simultaneously (1) the single most legitimate non-medical third party that needs to access my personal data, and (2) the single best entity to hold my data in terms of personal recourse. That's not saying much, but it is better than the open scorn and disrespect for my privacy that corporations offer. The solution to government breaches is what it's always been: to make the breached data less valuable. Hacking the IRS would be significantly less appealing if we criminalized corporate use of SSNs as credentials.
  - imglorp 5y ago
    Good point, gov has less reason to sell your data
    - dylan604 5y ago
      Yeah, that federal deficit surely doesn't need any help getting paid down /s However, this isn't to say that someone doesn't get the bright idea that they could fund some sort of slush fund with this.
    - jakeogh 5y ago
      Personal data sold to model and modify behavior. It's even more valuable to gov agencies, which spend spend drastically more than the private sector to get it.
    - naveen99 5y ago
      Doesn’t stop usps for making money from spam, or from speed traps from being primarily dedicated to revenue from out of towners.
  - gruez 5y ago
    >the single best entity to hold my data in terms of personal recourse what type of recourse are you talking about? Voting your representatives out?
    - woodruffw 5y ago
      That’s the slow way, but sure. I was referring to the fact that the government does occasionally react to negative press and roll back plans, as is evidenced by this case. I’ve yet to see Equifax change its security policies based on negative press.
      - psychlops 5y ago
        I'm still not clear on what personal recourse you believe you have against a government. I wouldn't consider negative press a personal recourse.
mLuby 5y ago
What lesson do you think organizations learned from that breach? (As it relates to this article.) The pattern I see is: 1. Company collects and stores private consumer info. 2. Company gets hacked. 3. Company share price unaffected. 4. Company sued in class-action lawsuit. 5. Company settles by offering discounted/free products to victims of the hack. ("A $50 value!") Lawyers make a few million. Result: company gets more users' info as they sign up to claim the discounted products. Sounds like a good deal if the company is too big to fail.
- scotuswroteus 5y ago
  Do you notice a pattern of state legislatures who sponsor privacy legislation not having online political support or donations from people who track patterns like this? If you're following it this closely, you should be following the political careers of the folks who work hard to pass laws that have teeth and laud them, no?
- HWR_14 5y ago
  > Sounds like a good deal if the company is too big to fail. I don't know why Equifax is too big to fail. But then again, I don't know why Goldman Sachs was too big to fail either.
  - NaturalPhallacy 5y ago
    Because they're our de facto fascist rulers. America is a republic only on paper.
    - HWR_14 5y ago
      How is Equifax a "de facto fascist ruler"?
  - knowaveragejoe 5y ago
  - vkou 5y ago
    Because our society would fall apart without a social credit system. How else are we going to judge flight risk, loan risk, apartment lease risk, employment risk, etc?
throwhauser 5y ago
It's not just the potential for a breach. I didn't want id.me itself to have my information. It's ridiculous to have a private company, not accountable to the public, gatekeeping government services, regardless of how many certifications they have. Hopefully id.me will get booted from other government agencies as well.

Forget Equifax ... how about the Office of Personnel Management? People may well have lost their lives as a result. We may not know for decades. https://www.lawfareblog.com/why-opm-hack-far-worse-you-imagine https://www.lawfareblog.com/why-opm-hack-far-worse-you-imagi... Oh, and the IRS has already been breached at least once. I'm not wild about waiting for the next one. Maybe government is not the best group to be holding your personal data. https://www.nytimes.com/2015/05/27/business/breach-exposes-irs-tax-returns.html https://www.nytimes.com/2015/05/27/business/breach-exposes-i...

woodruffw 5y ago
All things being equal, the US government is simultaneously (1) the single most legitimate non-medical third party that needs to access my personal data, and (2) the single best entity to hold my data in terms of personal recourse. That's not saying much, but it is better than the open scorn and disrespect for my privacy that corporations offer. The solution to government breaches is what it's always been: to make the breached data less valuable. Hacking the IRS would be significantly less appealing if we criminalized corporate use of SSNs as credentials.
- imglorp 5y ago
  Good point, gov has less reason to sell your data
  - dylan604 5y ago
    Yeah, that federal deficit surely doesn't need any help getting paid down /s However, this isn't to say that someone doesn't get the bright idea that they could fund some sort of slush fund with this.
  - jakeogh 5y ago
    Personal data sold to model and modify behavior. It's even more valuable to gov agencies, which spend spend drastically more than the private sector to get it.
  - naveen99 5y ago
    Doesn’t stop usps for making money from spam, or from speed traps from being primarily dedicated to revenue from out of towners.
- gruez 5y ago
  >the single best entity to hold my data in terms of personal recourse what type of recourse are you talking about? Voting your representatives out?
  - woodruffw 5y ago
    That’s the slow way, but sure. I was referring to the fact that the government does occasionally react to negative press and roll back plans, as is evidenced by this case. I’ve yet to see Equifax change its security policies based on negative press.
    - psychlops 5y ago
      I'm still not clear on what personal recourse you believe you have against a government. I wouldn't consider negative press a personal recourse.

mLuby 5y ago

What lesson do you think organizations learned from that breach? (As it relates to this article.) The pattern I see is: 1. Company collects and stores private consumer info. 2. Company gets hacked. 3. Company share price unaffected. 4. Company sued in class-action lawsuit. 5. Company settles by offering discounted/free products to victims of the hack. ("A $50 value!") Lawyers make a few million. Result: company gets more users' info as they sign up to claim the discounted products. Sounds like a good deal if the company is too big to fail.

scotuswroteus 5y ago
Do you notice a pattern of state legislatures who sponsor privacy legislation not having online political support or donations from people who track patterns like this? If you're following it this closely, you should be following the political careers of the folks who work hard to pass laws that have teeth and laud them, no?
HWR_14 5y ago
> Sounds like a good deal if the company is too big to fail. I don't know why Equifax is too big to fail. But then again, I don't know why Goldman Sachs was too big to fail either.
- NaturalPhallacy 5y ago
  Because they're our de facto fascist rulers. America is a republic only on paper.
  - HWR_14 5y ago
    How is Equifax a "de facto fascist ruler"?
- knowaveragejoe 5y ago
- vkou 5y ago
  Because our society would fall apart without a social credit system. How else are we going to judge flight risk, loan risk, apartment lease risk, employment risk, etc?

throwhauser 5y ago

It's not just the potential for a breach. I didn't want id.me itself to have my information. It's ridiculous to have a private company, not accountable to the public, gatekeeping government services, regardless of how many certifications they have. Hopefully id.me will get booted from other government agencies as well.