Hacker News Reader

Burglary victims should be your first consultation, because most people who weren't burgled were probably just lucky, or were burgled but haven't realized it yet.

If there are 10 houses, a burglar tries to get into all 10 but only succeeds on 2, then you should talk to the 8 owners who successfully protected their houses. If there are 1000 houses, a burglar tries to get into 10 but doesn't tell you which 10, and succeeds on 2, you should talk to those 2 owners because they know for a fact what can fail. 990 owners will just say "do what I do" without having any evidence that their strategy is actually safe.

Maybe a bad analogy, but I do think that it doesn't make sense to ask "burglary victims" for computer security at least.

They know what parts of their system were compromised, at least partially.

Yes, without Equifax, how could anyone know they should apply security patches to their systems? No one knew this until Equifax.

Technically, it is still only one data point: we should probably run some kind of controlled study to verify that this is actually a problem before we go overboard.

Ok, so why didn't they? Should we ask TransUnion what went wrong at Equifax, and what laws and regulations are needed, if any? Or should we ask Equifax?

>> Ok, so why didn't they?

The parent post was sarcasm. Equifax did not follow security practices that are common and widespread in the industry. And by industry I don't mean credit reporting companies, but companies that have systems connected to the internet.

I understand that. Why didn't they follow those practices? What can we do to force companies to follow them in the future?

Make the liability for data safe keeping in the company that holds the data. You don't see medical records have issues like this, because the laws surrounding it is quite fierce.

You force companies to secure data by giving out enormous fines to the company and criminally charging the negligent or incompetent corporate officers.

I will actually answer your question, because Equifax has already explained:

One guy was supposed to install the update, but forgot for some reason. Everything was his fault.

Did you expect anything else from a company so incompetent? With a paltry $3b/year, they can't be expected to pay for more than one person to install updates.

Sure, but just because you got sent to the hospital doesn't make you a doctor.

They aren't burglary victims but the guards that sleep (drunken) in their night shift.

Or, you know, maybe stop talking to homeowners, victims or not, and start talking to people who make locks and safes. Actual subject matter experts rather than targets.

CEOs, at best, will be proxies for whatever security personnel they have on staff and we have no way of evaluating the credentials of those security staff. At worst, they'll be advocating for policies that reduce their exposure/costs at the expense of greater overall fraud costs.

The senate should use their own knowledgeable proxy in this case. NIST has already shown itself capable of creating security standards of a reasonable quality. Run another public competition for a national ID system capable of replacing SSN and let real security professionals propose (and then debate) a way out of the current mess. Senators can then codify the results of that process into law.

> Or, you know, maybe stop talking to homeowners, victims or not, and start talking to people who make locks and safes. Actual subject matter experts rather than targets.

You want to talk to the burglars. They already know the locks and safes and likely know even better how to break them than the creators. In this case, you want to talk to hackers.

The reason Congressional panels do things like this, is to put on a good show. They like to be seen dealing with higher level matters/people as a demonstration of stature.

> In this case, you want to talk to hackers.

No - the problem here isn’t hacking, it’s allowing a fixed, easily learned number be a sole proof of ‘identity’. SSNs were used in identity theft long before hackers.

> Karen Zacharia may well be a subject matter expert here, it's a little unfair to group her in with my rant.

"Millions of Verizon customer records exposed in security lapse - Customer records for at least 14 million subscribers, including phone numbers and account PINs, were exposed." http://www.zdnet.com/article/millions-verizon-customer-recor...

"1.5M customers of Verizon anti-hacker unit hacked" https://www.usatoday.com/story/tech/news/2016/03/25/15-milli...

It's 2008 all over again. The US/International shit show we call a media tried to make Occupy seem like lost-goalless hippies. It was the ghost of Nixson. You know why people were mad? All those executives at the highest levels committed fraud, perpetuated fraud, created a culture from top to bottom of fraud where people who issued loans were encourage to forge documents, make up incomes and sell people on terrible mortgages. Then the media blamed those people instead of the people who put that system into place.

None of those executives went to jail. None of them faced any real fines. None of them faced any real consequences. Many of them walked away with millions. PNC bought National City Bank for $5 billion and got a $5b tax credit (National City wasn't allowed any TARP funding). Big banks knew 2008 would happen, and when it did, they used it to buy all their competition at the expense of millions of Americans who lost their homes, retirement savings, etc.

It doesn't matter if it was Bush or Obama or Hillary or Trump, because no matter which puppet is on stage, no one in the 1% who either allowed such terrible things to happen or made them intentionally happen or profited from things that happened to have fallen into their laps; none of them face any real consequences. The executives who sold off Equifax shares getting off without any wrongdoing is a perfect example. It's obvious they knew. They made money and they will never and can never be held accountable in today's world because they control, to various levels, all the world leaders and banks.

Um, what does any of that have to do with the Congressional hearing?

Is there a transcript of what kind of questions were asked? I can imagine useful information being gleaned by questions like, "what was the nature of the attack, how were people able to get in, what exactly happened here, how did you store the data, why were you confident it was secure, etc?" That gives you a starting point of what the facts are, what was really experienced. When you are working from a ground zero of zero knowledge (and I bet most of these committee members have zero knowledge, if not all of them), it's good to establish facts of what happened before figuring out solutions.

I haven't seen a transcript anywhere but presume it may end up in the Congressional Record.

The archived webcast is available https://www.commerce.senate.gov/public/index.cfm/hearings?ID...

The prepared statements from the witnesses are available to view at the bottom of that link as well.

I was burglarized by someone who kicked my front door down. Everyone who hasn't experienced that thinks it's important to fully gate off your back yard. My first-hand experience tells me that that advice wouldn't be sufficient to secure my home. Why would you prefer speculation over experience?

One of the houses I lived in had a really strong lock on the front door. The lock wasn't really the problem, though: the door is made up of four float glass panels. Of course, even if it was a solid wood door, there's another problem: the bit the lock slides into is held onto the frame by two screws.

It's crazy some door knob/dead bolt kits come with screws that just screw into the jamb. Little 3/4" screws. You really need those 3"+ screws that go into the studs. I'm sure you do this now given your experience but if you ever get a kit that doesn't come with screws like that they should definitely be purchased separately.

It truly is crazy. Every door frame to the outside in my house used to have these tiny screws. It's so trivial that even I who massively struggles with the simplest home improvement tasks was easily able to replace the screws with much larger screws that go into the studs. Yet it seems to be standard practice to use these tiny screws. The other thing I recommend is getting security film for your windows and have it anchored to the window frame. It doesn't prevent anyone from breaking them but it makes the process take much longer and be much noisier.

Another pro tip: good deadbolt kits have a lock cup with one or two holes inside as well so you can secure it even further.

Second pro tip: replace your door hinge screws (on the jamb and door) with larger 3-4” screws.

Third tip: outside doors should be solid wood or metal, not hollow.

Politicians need to look like they are doing something. It doesn't matter if they actually do anything. If they look busy, they are busy and are obviously working hard and should be kept in that position.

> So, ask [the people who lost billions of accounts and SSNs] how to protect against data breaches?

It's worse than that. These are the very people who profit on trading in data linked to identity information. It's like asking the fox how to secure the henhouse, after he ate all the hens.

Any new identity scheme has to be something that does not rely on security practices of any third parties. The public component of the identifier must be useless as an identifier without the private part held only by the individual.

I suppose Karen Zacharia is the token black hat? Verizon aggressively breaks people’s expectations of privacy by MITM rewriting HTTP connections.

(Or, maybe she was at Yahoo! during the breaches...)

Verizon isn't breaking people's expectation of privacy implicitly by MitM-rewriting unencrypted HTTP.

They are breaking this expectation by using the MitM-rewriting of unencrypted HTTP to inject tracking identifier headers for third parties.

Comcast also MitM-rewrites requests and occasionally leaves extra fingerprinting entropy, but they don't intentionally kill your privacy like Verizon.

They aren't asking them for security advice. They are trying to find out the specific ways that they fucked up their security.

There could be numerous other companies that are messing things up in exactly the same way, they just have had the misfortune of being breached yet.

You can keep the SSN as primary key for identity, you just need a different mechanism for authenticating as that identity.

This is a solved problem in most countries, the U.S. can just pick any from a long list of countries to copy the model of wholesale.