Hacker News Reader

Comment by blowski | Hacker News Reader

If we start screaming "something must be done!", we'll be very unhappy with what actually gets done.

There are so many people who are at least partly to blame when something like this happens. Bob the engineering manager who committed a quick but insecure fix years ago, Shirley the intern who didn't know what she was doing, Joe the manager who hired Bob and Shirley in the first place, Mike the manager at the company supplying third party software that ends up being exploited, etc.

The worst outcome is that companies outsource all their IT security and therefore responsibility to companies that disappear as soon as there is a problem. But if we rush too quickly to impose criminal sanctions, that will be the likely outcome.

The better solution is to work this one out as a society. Stop relying on things like SSNs and maiden name as "security", and stop building enormous silos of unnecessary data.

View on HN

Equifax must be dismantled and driven into bankruptcy.

You present a fallacy. No, a rational company with accountability for its data doesn't outsource their IT security or let the intern access production. They take their job seriously and prevent something like this from happening by building security into their architecture.

I have worked for companies that recognize they are liable for protecting the data they hold, and that it only takes one breach for trust to be destroyed. We spent countless hours hardening, compartmentalizing, and monitoring our infrastructure. The nihilistic implication that nothing can be done is maddening.

Companies that take this sort of thing seriously ALSO have breaches occur. They just do a better job of mitigating them, and messaging them.

Breaches occur. Negligent security, networking, and auditing missed or ignored network segmentation. I can forgive a small company dealing with my email when they lose it. Equifax is't a small company. They didn't just lose my email. They should be disbanded and their CTO, CIO, and CEO should be held personally responsible.

And Equifax's handling and messaging was truly abysmal. Security professionals are going to write songs about this and pass the knowledge on to their (older) children as scary camp fire stories.

Correct, all companies face breaches, it's the management and response that should determine the course of action. This is where an independent investigation is crucial for determining basic failures vs systemic disregard. The harder part would be weighing it.

Then perhaps the risk of allowing this kind of business - period - is too great.

The alternative is higher interest rates, reduced unsecured credit, pay-in-advance for housing, and shutting "the masses" out of access to capital.

I agree that seeing Equifax go bankrupt over this would be great. But do you honestly believe your data will be safe? All that time you spent hardening your architecture makes it safer, but not 100% safe. If it's hacked because of one mistake that one person made, would it be right to hold you criminally responsible?

There should be no avenue for single points of failure to result in catastrophic data breach. Neither architecture nor procedures should allow a single person to compromise the system, willingly or accidentally.

If you can't guarantee that the data can be kept safe, then you shouldn't rely your business on it.

>"Equifax must be dismantled and driven into bankruptcy."

I don't disagree with that sentiment but you have to deal with the whole triumvirate - Equifax, Experian and Transunion.

As well as ChexSystems which contains just as must personal data about deposit accounts instead of credit accounts. Also Lexis which collects from a wide range of private sources and has exclusive special arrangements with public sources.

I guess I am not as familiar with CheckSystems, is that pay roll data?

Does Lexis Nexus collect financial data on individuals? I thought it's focus was research

ChexSystems does not have salary information. They contain information on bank accounts that have been overdrawn, bad checks, and checkbook orders. They also contain information on accounts in good standing, and the usual information like aliases, addresses, SSNs, and driver license numbers.

Lexis Nexis long since moved beyond newspaper and courthouse archiving. They have dozens of intelligence products and databases aimed at marketing, debt collection, private investigators, and law enforcement. They collect massive personal consumer (and business) data, including retail purchases and returns, and salaries, and associate it in a Facebook-style graph, loosely associated with SSN and DL#.

Interesting about both, thanks. I suppose it's just a matter of time before both of these are compromised. In fact is surprising that they haven't. I wonder if this is just because they aren't as well known as the big 3?

Lexis sells access to everything although some of the databases are pricey. I have not heard of a ChexSystems breach yet. They are integrated with most banks.

Even with normal use and no breaches, all these cross-referenced databases are hell for those of us who went through a gender transition. It is practically impossible to get rid of references to my old name. It outs me anytime I open a bank/credit account or arrange new insurance.

Lexis Nexis suffered a breach in 2013.

ChexSystem is bank accounts and contains very, very little information compared to credit bureaus. Just accounts you've opened (and attempted to open) recently and any negative information. You can (and should) request your report here: https://www.chexsystems.com/web/chexsystems/consumerdebit/pa...

Early Warning, however, contains way, way more information about bank accounts. It lists most of your accounts plus dates opened, dates closed, and other stuff. (I don't have my report on hand, so I'm going from memory) You can (and should) request your report here: https://www.earlywarning.com/consumer-information.html#instr...

I request both every year. (Because I churn bank account bonuses)

LexisNexis has a whole crapload of consumer reports. The big one is the CLUE report on insurance claims. They have employment databases as well and probably others, I'm not as familiar with them. You can request a copy of your CLUE report here: https://personalreports.lexisnexis.com/fact_act_disclosure.j...

I have to admit, I've never requested my CLUE report.

I've mentioned this in another comment but there's actually two more credit bureaus, SageStream (request report here: https://www.sagestreamllc.com/consumer-report/) and Innovis (request report here: https://www.innovis.com/personal/creditReport) I've never requested either myself but I am in the process of requesting both right now.

I have requested my CLUE report from LN. It contained basically no information.

It wouldn't unless you've had recent (<5 years) insurance claims.

That's a good thing to know that people aren't making insurance claims in your name.

The report I got had inaccurate information. Mostly about previous residents at this address.

Innovis as well.

Interesting. I was unfamiliar with Innovis until last week where an article I read mentioned freezing your credit profile with the big 3 agencies and mentioned that it wouldn't hurt to contact Innovis as well.

Are they a distant 4th then?

If you put a security alert on on your profile with one of the big 3 agencies it automatically propagates to the other 2. I wonder why it doesn't propagate to this agency as well.

FWIW, the only major company that I know of that uses Innovis is US Bank.

Interesting, it's tempting to not be concerned about them then although if we've learned anything there is zero correlation between doing business with someone and them collecting data about you.

Sagestream is another (rarely used) credit bureau: https://www.sagestreamllc.com

Notably it's used by Bank of America

More information: http://www.latimes.com/business/lazarus/la-fi-lazarus-credit...

I only learned last week that there is also Innovis. I'd bet there are smaller firms doing the same thing, as well.

I don't disagree, either, but whatever data Equifax has collected would be part of the bankruptcy sale.

Equifax needs to wipe its data and all extant backups. Then it can be sold (for maybe ten dollars).

Were the companies you worked for dealing with data at the scale of Equifax? Were they under the kind of unceasing attack that the Equifax systems are? Do you think you could have withstood that kind of assault on your systems?

All the CRAs endure attacks at a scale that are difficult to comprehend. It's frankly a surprise that something like this hasn't happened before to any one of the big 3.

It's only surprising because we now know how terribly fast and loose Equifax was operating. I certainly assumed they knew their job and were operating more akin to a bank in terms of data protection.

Then again, I once did work for a bank, and witnessed an event where user PINs were discovered to be publicly available if one happened to know the magic URL. This discovery was made through the process of a pen-test team sharing their findings back to development, who in turn extended their findings based on what developers knew about the system. Forensics done after the discovery revealed no cases of anyone actually finding the magic URL, which was a big relief for the company. So maybe the banks aren't as strong as we think, either. We have quite a few payment breaches to look back to as evidence.

> It's only surprising because we now know how terribly fast and loose Equifax was operating. I certainly assumed they knew their job and were operating more akin to a bank in terms of data protection.

Can you cite a source for how we "now know how terribly fast and loose Equifax was operating"?

Equifax is a CRA and is treated as a financial institution under the applicable laws, like banks are.

> Then again, I once did work for a bank, and witnessed an event where user PINs were discovered to be publicly available

Then you should know better than to simply claim that a company that suffers a breach is somehow inherently incompetent or uncaring about security.

> Equifax was negligent to spill all that data, but a business model that requires all that data in one place is itself a form of negligence. - Matt Blaze

http://thehill.com/opinion/technology/350197-equifax-breach-...

I'm not sure how this opinion piece figures in to anything. He's entitled to his opinion like anyone else, but his saying it's negligence, without any legal basis for the claim, is just puffery.

You disagree that the business model itself is a form of negligence?

Of course. You don't?

A banking company operating in 1999 is an entirely different context than Equifax operating in 2017. The web and its risks aren't new any more. Equifax's database being one webapp away from disclosure is entirely irresponsible - and if there is no alternative, then they'd need a kick-ass pen-testing, bug bounty, patching, WAF deploying, internal security program. If they had such a program, it would have caught this issue in multiple ways. If they weren't going to deploy the patch, they could have asserted rules in the WAF, for example. We can only assume, then, that this effort was either underfunded, poorly managed, or both.

Furthering their incompetence by linking to phishing sites in the aftermath, not offering data protection automatically, and suggesting US persons should pay them for protection (!) all point to the deeper corporate problem that is at the root of this issue, which is that they see US persons as suckers and don't really care about data privacy or information security. Otherwise, they'd have staff trained on response and they'd have social outreach folks validating URLs before posting as the company representatives.

It's totally appropriate for the CEO to resign.

> We can only assume, then, that this effort was either underfunded, poorly managed, or both.

Pure conjecture on your part. You have no insight into their security program. The only thing you can accurately infer is that they missed this one.

The phishing site thing was pretty stupid, though, I agree.

> No, a rational company with accountability for its data doesn't outsource their IT security

There are a lot of irrational companies in the world by that standard.

> The nihilistic implication that nothing can be done is maddening.

THIS. And in this case we have blatant evidence of negligence- There is absolutely zero excuse in this day and age to not keep operating systems patched up with security patches. There is no financial excuse, there is no logistical excuse, and given the sensitivity of the data, there is no ethical excuse. Take the responsibility seriously, or please just go off and die in a fire. (Or, if you're an Equifax executive, retire at the height of your incompetence.)

Which is why I shamelessly say: Fuck Richard Smith, fuck Equifax, fuck Susan Mauldin, and fuck their entire IT management staff. What the fuck is wrong with you people?

Disclaimer: I was recently hacked/had my identity stolen, and although I was fortunate to only have to wait 2 weeks to get back access to everything, I may be a little sore about stuff like this.

>Bob the engineering manager who committed a quick but insecure fix years ago

Unacceptable. Software development needs to be treated as engineering. We need to finally rid ourselves of the concept of "quick and dirty". If that means all the people who live off of that style of development leave the industry, fantastic! It would be great if every manager who told his devs "I don't need it to be perfect, it just needs to kind of function and be ready by EOB today" could end up financially liable.

>Shirley the intern who didn't know what she was doing

What was she doing working on a production system unsupervised? A plumber-in-training may get to work with the pipes on his own a bit but you can be sure the certified plumber will inspect everything before signing off.

The IT industry needs a shakeup and if it takes something like this to accomplish it, good.

I think it's rarely that straightforward. Think about how all the different ways software evolves: one way is, code is written when the company is first getting going, and before you have users or revenue or any kind of product/market fit, it really makes very little sense to be writing bulletproof code. "Quick and dirty" is a rational decision at the early stages of a company.

A small subset of these kinds of systems end up at big companies, because they're acquired, or because the company grows, etc etc. How do you draw a line in the sand where everyone stops the world and re-implements all the "quick and dirty" stuff?

I briefly worked in construction and I've seen plenty of "quick and dirty" there, also, particularly in suburban renovations. Time is money in these projects, and corners are often cut. I'm not saying all engineering works this way, clearly building bridges is a different matter, but I am pointing out that there is a spectrum.

> A small subset of these kinds of systems end up at big companies, because they're acquired, or because the company grows, etc etc. How do you draw a line in the sand where everyone stops the world and re-implements all the "quick and dirty" stuff?

Quite frankly, it seems like you nailed the point when someone should be re-implementing the quick and dirty stuff; the moment it gets acquired and integrated. I do understand what you're saying, but I cannot agreed that just because something is difficult to do means that one can hand-wave responsibility. In the case of large companies that have been subject to breaches recently, the only reason they get by after the fact is because they can afford to; if it were to happen to any of the small shops running in "Quick and Dirty" mode and something happened, the shop would more or less take a hit it could not recover from.

I see this in action and hear the same excuse every single day with my clients, and it doesn't matter if they're a multi-national whose infrastructure spans continents or some dude with a pirated hyper v host in his room, the excuse is always the same: "Oh we had to do it that way, and didn't have time to fix it."

Quite frankly, it's non-sense, infinitely moreso in virtual environments. The workflow and technology available for patch-testing, deployment, and rollback has never been faster, safer, or easier than it currently is; companies just aren't doing it, and no one is holding people accountable for negligence. If the aforementioned construction workers who did a quick and dirty job cause major damage to the house as a result, they would be liable for damages due to their negligence. I'm not sure why we in the Tech community somehow think we're above responsibility for our negligence.

I understand that money is on the line - I deal with clients where every minute of down-time has a substantial dollar figure attached, and there's always the attitude of "we'll deal with it later"; and yet, this attitude always ends up causing more trouble in the end, and naturally costing far more.

Edit: Changed "...responsibility for our own negligence" to remove "own"

> The IT industry needs a shakeup and if it takes something like this to accomplish it, good.

How would you propose doing this, though?

In other branches of engineering, there's licensing and certification processes - but only after you have gone thru and passed an accredited course (ie - university engineering degree).

This is fine for the majority of engineering, because most of it is fairly settled knowledge, and doesn't change on a nearly weekly or faster basis; unlike what we call "software engineering".

We could say that current university computer science or similar degrees could be the initial thing to allow you to get certified and/or licensed - but how would that translate into the testing for certification/licensing?

Especially when "best practices" might (will) change almost literally overnight? How could any company know that Bob Jones MSE (Masters in Software Engineering) has and knows everything there is to know and is 100% up-to-date with the latest software engineering, security, database, etc practices needed for his craft (especially those items that changed last week)?

With other engineering fields, such change doesn't happen anywhere near as quickly (and in some, it may be years or decades between new updates).

Also - how would propose "grandfathering" in existing software engineers and other similar professionals? While on the surface I would like to see such a change to a more professional attitude, I don't want to see myself personally "left out in the cold": I don't have a degree in the field; my knowledge is self-taught and/or learned on the job over the past 25+ years.

I don't know anywhere near everything, and in many cases I am always learning something new (or learning the name of some "pattern" that was something I had been taught years or decades ago before it had a name). I honestly find the learning aspect to be one of the things I immensely enjoy about my software engineering career.

But I don't want to find myself tossed aside because I don't have a degree, or find that I have to go back to school just to keep my career (indeed, going back to school for this reason would likely leave me without a job in the end because of many businesses balking at hiring older developers like myself - which is also why I tend to always stay abreast in my skills and knowledge).

I'm not expecting any answers - just wanting to throw out some food for thought.

I also don't have a degree. One thing that could be done would be something closer to how doctors are handled in most (?) countries: you need to pass some kind of certification and you need to recertify on a regular basis. A doctor, additionally, needs a PhD but I don't think that's needed for software development. We just need proof that the person produces safe systems, based on the most recent understandings of how to do that.

And I wouldn't expect someone to need this certification before a compiler would run. I would envision something more along the lines of: a company cannot have a "badge of software engineering" or some such unless all the developers working on their production systems have these certifications. If it's a small company running a PHP website then they probably don't need certified people and probably their clients won't (initially) care that they're missing the saftey badge.

The idea that the only possible solution is to start over is unrealistic, unhelpful and also wrong, and is so despite your attempt to caricature anyone thinking otherwise. With proper policies, technical measures can be taken to greatly improve security over the clusterfuck that is Equifax (and probably the other agencies as well.) With proper regulation, the company (and so, indirectly, its shareholders) and its officers could be held responsible, whether or not they choose to outsource the implementation. For a start, every regulation that Equifax was lobbying to be weakened could be strengthened.

In the 18th and 19th century, Britain transported many petty criminals to penal colonies in Australia. Putting aside the brutality of that policy, there was at least some concern over the number of deaths on the voyage. After other attempts failed, one simple policy brought about considerable improvement: shipowners were paid by the number of live transportees arriving. They complained mightily that it would not work, but it did.

Frankly, your post looks like a self-serving defense of business-as-usual mediocrity in IT.

In a previous discussion on HN, a pretty convincing argument was made that all the government needs to do is legislate any loss of information that includes a SSN is an automatic $100 penalty per SSN. Companies will need to buy insurance to cover this and the insurers will take care of the rest.

Who pays the $100? The parent company or the subsidiary that can go bankrupt, and transfer its assets to another subsidiary for $1?

The insurer.

That's not how bankruptcy works. Assets are used to pay debts including legal debts.

Hiding behind bankruptcy only works if the subsidiary has no assets. Patent trolls work this to their advantage by creating a company whose only asset is the patent. If they lose / the patent is invalidated the company's only asset is worthless. They therefore have no assets to pay their debts.

Hold the directors and/or executive team personally responsible if the company folds without paying?

Whichever party the consumer gave the info too. If X gets fined then it's their job to sue someone else if they think that someone else is responsible.

For the big credit agencies, how do you tell where the info came from? If you pay your rent and you make payments on a credit card both entities may file a credit report including your SSN, name, address, etc... If the credit agency loses track of their database, how do you determine which submitter should be responsible?

It makes more sense to assign all the blame on whatever entity lost control of the data. They get a big fine and as long as they were following best practices (as outlined by their insurance company), then their insurance company will pay the fine and the business keeps chugging along.

If the company was negligent, the fine is likely a death sentence.

That might move the needle forward a bit. But if the lawsuit for the fine can be tied up in court, delaying penalty long enough for the executive bonuses to hit, it would not be very effective, I think.

Your describing an unfortunate series of events. Were talking about a company who had "admin" as a user name and password on a database with consumer data on it.

> The better solution is to work this one out as a society. Stop relying on things like SSNs and maiden name as "security", and stop building enormous silos of unnecessary data.

This doesn't stop aggregators from forming, the data has value someone will collect and sell it.

The only place this issue ends up, if pushed hard enough in the Congress, is mandatory licensing (with fees, of course) for software engineers. Best case: you limit such licensing requirements to certain domains.

I agree. It's very difficult to get a government to pass a 'common sense law' given the myriad influences of different alliances, lobbyists, special interests, etc. that seem to corrupt just about any bill that goes before Congress, no matter how well-founded it may be at the very beginning.

I'd also much rather have government under-react than over-react. (The former has a lot more flexibility)

EDIT: Fixed words

This is only an issue because everyone has the "not my problem, it will never come back to me" attitude. Ideally by the time this case is fully fleshed out the blame will trickle down from the top and many people will be implicated. Either their reputation in the industry being tarnished or contracting companies getting sued by Equifax for making them liable.

I'd add that the vitriol against Equifax partly arises from everyone's distaste of CRA's (credit reporting agencies) owing to their magic 8 ball scheme of ranking credit. There may also be some reserved anti-sub-prime sentiment that lingers from 2008.

At the very least, I hope this will cause lenders and credit reporters to take data security very seriously.

"There's plenty of blame to go around" and its equivalents are semantically null.

Reply on news.ycombinator.com