Hacker News Reader

Comment by arikr | Hacker News Reader

Hm, I tried using their tool to see if I've been impacted:

https://www.equifaxsecurity2017.com/potential-impact/

Which says it would tell me if I'm likely impacted, but instead it just gives a date where I can enroll in some free product, but no info on whether I'm likely compromised.

Anyone have a workaround? This is important to anyone that wants to identify if they've been "pwned."

View on HN

I got the same page, but then I tried putting in a fake name and got:

> Thank You

> Based on the information provided, we believe that your personal information was not impacted by this incident.

So if you just get the enrollment date, I think that means you’re affected.

From the r/personalfinance thread, the site kicks back 3 different JSON status messages:

  "message-deferred": "Thank You -- Your enrollment date for TrustedID Premier is: xxxxxx Please be sure to mark your calendar as you will not receive additional reminders. On or after your enrollment date, please return to faq.trustedidpremier.com and click the link to continue through the enrollment process."

  "message-success": "Thank You -- Based on the information provided, we believe that your personal information may have been impacted by this incident. Click the button below to continue your enrollment in TrustedID Premier."

  "message-not-impacted": "Thank You -- Based on the information provided, we believe that your personal information was not impacted by this incident. Click the button below to continue your enrollment in TrustedID Premier"

So... later date means they don't know yet? Or you have been impacted and you're only eligible to enroll later?

I really don't know. If we take it at face value, I think it means they're unsure and will hopefully know more later (whatever date it kicks back). At least, that's what I hope, because I gave in and punched in my information and I received the deferred message.

You can proceed with the enrollment anyway, even if you receive that message, with any set of six digits and any set of characters for the last name and receive a message indicating that you're enrolled.

I watched the video of the CEO describing what Equifax was doing in response to the incident and he does not specifically name "equifaxsecurity2017.com" or "trustedidpremier.com" as the sites they've set up, only that they've set up a special website.

To that end: if you're an HN user with the last name "HHHHHH" and with a Social Security number ending in 000000, don't worry about enrolling. I very helpfully took care of it for you!

I don't think so:

"Regardless of whether your information may have been impacted, we will provide you the option to enroll in TrustedID Premier. You will receive an enrollment date."

This site seems shady as hell. As well is the trustedidpartner.com which has no homepage that it refers you to. Seems like a phishing scam.

It is linked from the banner up top of https://www.equifax.com/personal/

"Equifax Cybersecurity Incident: To learn more about the cybersecurity incident, including whether your personal information was potentially impacted, or to sign up for complimentary identity theft protection and credit file monitoring, click here"

and that "click here" goes to http://www.equifaxsecurity2017.com/

So it'd seem legit, if rather silly to have its own domain.

I did the same - they are offering free identity theft protection to all US Consumers starting on some kind of rolling enrollment date beginning 2017-09-14.

A website registed a month ago with a simple DV certificate. Either the gentlemen at equifax are grossly incompetent, either this is a phishing website.

Reply on news.ycombinator.com