2 ms·

> Your grievance is misguided. I'm not sure what makes you think that, given you don't know any of the details involved. In my case, TransUnion received credi

> Your grievance is misguided. I'm not sure what makes you think that, given you don't know any of the details involved. In my case, TransUnion received credit checks for me with dates of birth 1 Jan, 2 Jan, 3 Jan, 4 Jan and so on until they hit upon my date of birth, then a credit account was opened that same day, then later in the day a third party credit monitoring agency accessed my credit report and they were allowed to pass 'knowledge based authentication' using their knowledge of that credit account. I am completely sure TransUnion could have detected and foiled this incredibly obvious attack. I'm also completely sure they could have identified other victims of the same attackers and informed them, but they chose not to.

cognaitiv 3y ago
KBA must die.
ajmurmann 3y ago
TransUnion also has full control over what authentication mechanism they use. On the extreme end, they could require a Yubikey to be used. However, they deem the hassle to implement better auth not to be worth it while it's users who carry the cost of TransUnion's inability to properly authenticate people.
- mrguyorama 3y ago
  They also see zero reason to spend even a dime on better security of processes when they saw that the entire company could be pwned and distributed on the dark web and you end up losing zero revenue, maybe a million bucks in a class action suit.
- NoZebra120vClip 3y ago
  Are they vulnerable to SSPR Abuse? I'm having great fun reporting to Very Large Services and being rebuffed because they don't understand or care.
gopher_space 3y ago
> I am completely sure TransUnion could have detected and foiled this incredibly obvious attack. I'm also completely sure they could have identified other victims of the same attackers and informed them, but they chose not to. It's entirely possible that nobody at TransUnion knows how to achieve this given the state of their databases' and/or staff. For example, maybe their system was set up before constraints were a thing and they stopped development once it started printing money, so the only person "working" on it does light maintenance as a portion of their other duties.

cognaitiv 3y ago

KBA must die.

ajmurmann 3y ago

TransUnion also has full control over what authentication mechanism they use. On the extreme end, they could require a Yubikey to be used. However, they deem the hassle to implement better auth not to be worth it while it's users who carry the cost of TransUnion's inability to properly authenticate people.

mrguyorama 3y ago
They also see zero reason to spend even a dime on better security of processes when they saw that the entire company could be pwned and distributed on the dark web and you end up losing zero revenue, maybe a million bucks in a class action suit.
NoZebra120vClip 3y ago
Are they vulnerable to SSPR Abuse? I'm having great fun reporting to Very Large Services and being rebuffed because they don't understand or care.

gopher_space 3y ago

> I am completely sure TransUnion could have detected and foiled this incredibly obvious attack. I'm also completely sure they could have identified other victims of the same attackers and informed them, but they chose not to. It's entirely possible that nobody at TransUnion knows how to achieve this given the state of their databases' and/or staff. For example, maybe their system was set up before constraints were a thing and they stopped development once it started printing money, so the only person "working" on it does light maintenance as a portion of their other duties.