3 ms·

While I agree with the article that it is embarrassing that Experian doesn't support 2 factor authentication, I'm not sure it would have helped in this case sin

While I agree with the article that it is embarrassing that Experian doesn't support 2 factor authentication, I'm not sure it would have helped in this case since the account was migrated without ever authenticating to it. Normally a security breach this egregious would require the attacker to call the help desk, but for some reason Experian has it baked right into the signup process. That is an impressive level of negligence. Someone had to put some serious effort into opening up that security hole.

deleted 4y ago
[deleted]
adrr 4y ago
There are cases when people lose access to emails. They should require snail mail as additional factor to recover an account and change emails.
- jandrese 4y ago
  Losing access to email isn't a problem if the mail sent to the old address is just "this account was migrated to X, click here if this was in error to have the change reverted". If the email account has been lost then it is no problem, if the attacker has access to your email too then you're up a creek either way.
lbriner 4y ago
At a minimum, a good system would email both old and new email addresses saying, "someone has changed the email address, click here if that is wrong". This kind of slapdash approach to security needs to become criminal because companies are clearly not following best-practices and to be honest, as someone who has implemented these sorts of things on a number of legacy systems, it really isn't hard to do.
- richrichardsson 4y ago
  > slapdash approach to security needs to become criminal 100% this. If there were serious consequences to not taking (customer) account security seriously, perhaps it wouldn't be such a common occurrence.
- rocqua 4y ago
  If you start mandating companies do proper authentication, then you kinda need proper authentication to be possible. Really, the way to do that is through a government-issued ID, but the US does not like that idea. Without government-issued ID as a base, doing authentication right is difficult. Especially account recovery simply becomes a mess. Having high fines might cause certain users to be permanently locked out 'because we cannot properly authenticate you'. It would light a nice fire under efforts to properly handle authentication, but that fire would burn a lot of people first.
  - lotsofpulp 4y ago
    This is at the root of the problem. No entity wants to take liability and responsibility for quick and easy identify verification, and only the federal government is in a position to do that. There is no reason they could not use USPS to provide a passport type identify verification service and API for other organizations to use. It should be a utility.
    - Philadelphia 4y ago
      The problem is that US Christian conservatives believe a government ID is the “the mark of the beast.” Seriously. http://archive.boston.com/news/local/maine/articles/2007/03/11/biblical_prophecy_finds_way_to_legislators_in_battle_over_id_plan/ http://archive.boston.com/news/local/maine/articles/2007/03/...
      - lotsofpulp 4y ago
        The crazy thing is no one needs to be forced to get. We already have passports, and they are initially applied for at USPS. All the feds need to do is set up an online verification system with an API to plug into.

deleted 4y ago

[deleted]

adrr 4y ago

There are cases when people lose access to emails. They should require snail mail as additional factor to recover an account and change emails.

jandrese 4y ago
Losing access to email isn't a problem if the mail sent to the old address is just "this account was migrated to X, click here if this was in error to have the change reverted". If the email account has been lost then it is no problem, if the attacker has access to your email too then you're up a creek either way.

lbriner 4y ago

At a minimum, a good system would email both old and new email addresses saying, "someone has changed the email address, click here if that is wrong". This kind of slapdash approach to security needs to become criminal because companies are clearly not following best-practices and to be honest, as someone who has implemented these sorts of things on a number of legacy systems, it really isn't hard to do.

richrichardsson 4y ago
> slapdash approach to security needs to become criminal 100% this. If there were serious consequences to not taking (customer) account security seriously, perhaps it wouldn't be such a common occurrence.
rocqua 4y ago
If you start mandating companies do proper authentication, then you kinda need proper authentication to be possible. Really, the way to do that is through a government-issued ID, but the US does not like that idea. Without government-issued ID as a base, doing authentication right is difficult. Especially account recovery simply becomes a mess. Having high fines might cause certain users to be permanently locked out 'because we cannot properly authenticate you'. It would light a nice fire under efforts to properly handle authentication, but that fire would burn a lot of people first.
- lotsofpulp 4y ago
  This is at the root of the problem. No entity wants to take liability and responsibility for quick and easy identify verification, and only the federal government is in a position to do that. There is no reason they could not use USPS to provide a passport type identify verification service and API for other organizations to use. It should be a utility.
  - Philadelphia 4y ago
    The problem is that US Christian conservatives believe a government ID is the “the mark of the beast.” Seriously. http://archive.boston.com/news/local/maine/articles/2007/03/11/biblical_prophecy_finds_way_to_legislators_in_battle_over_id_plan/ http://archive.boston.com/news/local/maine/articles/2007/03/...
    - lotsofpulp 4y ago
      The crazy thing is no one needs to be forced to get. We already have passports, and they are initially applied for at USPS. All the feds need to do is set up an online verification system with an API to plug into.