Hacker News Reader

Comment by andirk | Hacker News Reader

Oddly, on their website equifax.com , they offer a solution to see if your identity is stolen by using a website created today called equifaxsecurity2017.com , which then offers the solution to 'enroll' which sends you to a website created a week ago called trustedidpremier.com . At which point you are to enter your identity information.

Um.

View on HN

By enrolling in the free "Identity Theft Protection" you waive your right to "PARTICIPATE IN A CLASS ACTION, CLASS ARBITRATION, OR OTHER REPRESENTATIVE ACTION" https://trustedidpremier.com/static/terms

It is a scam to get people to sign away their rights to sue the bastards.

IANAL, but I'm not sure that you are correct. The agreement refers to claims "arising from or relating to the subject matter of this Agreement or the Products", and the title of the agreement is "TrustedID Premier Terms of Use".

Doesn't that mean you're waiving your right to sue TrustedID, Inc. in a class action for grievances related to the TrustedID monitoring product, not your right to sue Equifax for the data breach?

Can anyone with a legal background or have connections to news outlets validate this? I read through the terms and this really does seem to be the case. However, I am certainly not in a position to decide this. It would alleviate my concerns if a trusted source could publicly report on how the impacted (pretty much everyone in the US) should respond to leak.

Aha, that explains why the site works so hard to gather your info and then suddenly loses interest in doing anything much else!

Shit I hope I don't miss out on like $3.37 of class-action BOUNTY!

Shit. I already submitted and should've read the fine print. I need to un-enroll.

If you look at the site ToS you can send an opt out to arbitration by mail to them within 30 days, at least for the Equifax general ToS

And trustedidpremier.com was registered a week ago. https://whois.domaintools.com/trustedidpremier.com

TrustedID is an identity protection company that's been around for awhile (many companies use them as the contracted company to do credit monitoring after a breach). TrustedID is actually owned by Equifax (who were just hacked.. irony), and so my guess is that "TrustedID Premiere" is a newly created offering from Equifax/TrustedID to deal specifically with this major breach.

Well, yes, this was in response to this incident. While they're just making a public statement now, we know from their own press release that the breach occurred in May.

Regardless, it's certainly prudent to be wary of these sites since they're pretty indistinguishable from phishing sites.

According to them it occured through July. That means it probably took them a month to figure out exactly what happened and how to disclose it.

Why must the consumer enroll in this? Why is it not automatic? They already pull all the strings with regard to keeping the consumer from taking out and keeping track of legitimate loans. Why must we go out of our way to prevent them from certifying and tracking illegitimate ones?

Most likely because Equifax is not providing the service and the actual provider will need to engage with each customer directly, despite the service being free.

I've now been enrolled in one or more "identity monitoring" services going back at least five years offered in recompense for various breaches.... at some point it becomes ridiculous.

Same. Starting with the PlayStation hack a few years ago. If it makes you feel any better, I get notified by that service every time I do anything that accesses my credit at all, usually within minutes, so, I guess it works as designed.

I also noted that it asked for the last 6 digits of your social. Could be they need more digits to avoid duplicates, but I've never heard anyone ask for 6 digits. Usually it's just the 4.

Honestly, they should have used a subdomain off of Equifax.com.

The bad thing about that is the first 3 digits are the location digits, so someone that has the last 6 digits can easily guess your full SSN if they know where you were born (or where you lived when you got your SSN).

https://en.wikipedia.org/wiki/List_of_Social_Security_Area_N...

This only works for social security numbers issued before June 25 2011. See https://www.ssa.gov/employer/randomization.html

Of course, this is cold comfort for adults today whose SSNs were issued around the time of their birth.

So, everyone above the age of 16 that wasn't a naturalized citizen/resident? I feel like most of them would have credit scores.

And not only do I have to give them personal information to check, I have to use google's sign-reading I'm-not-a-robot captcha - feeding a little of my intellectual capability to their self-driving car companies.

They keep taking...

Unverified cert too -_-

The plain domain yields a 404. Cert for me seems to be signed by amazon.

https://trustedidpremier.com/

What I mean to say is it's not validated* They should have hosted this on a domain associated with the company and validated the cert with the business

Reply on news.ycombinator.com