Hacker News Reader

Comment by g051051 | Hacker News Reader

Sadly, she seems to have a gross misunderstanding of the facts of the case, as well as cybersecurity in general. There's essentially no chance of this being passed, she's just showboating.

Key questions:

1. Does this apply to all data aggregators, or just CRAs?

2. Does it apply to government breaches, banks, individual businesses, etc?

3. What additional oversight is going to be applied by the FTC that isn't already happening as part of the vast amount of other regulations? How will it protect consumers?

View on HN

> she seems to have a gross misunderstanding of the facts of the case, as well as cybersecurity in general.

Could you actually point to where the issues are rather than make such generic claims?

> "Equifax allowed personal data on more than half the adults in the country to get stolen, and its legal liability is so limited that it may end up making money off the breach."

"Allowed"? She phrases that to make it sound like Equifax just left the front door open. In truth, they were hacked by sophisticated criminals (possibly state sponsored), who pinpointed a flaw in their security and exploited it. There was a detailed Bloomberg article that covered the breach in depth. They found that Equifax had paid top dollar for solid tools, but they were misconfigured (or misused) in such a way as to actually not be working. They found that they had good written procedures. Equifax knew about this vulnerability, and thought they had patched it. So how is any of that "allowed"?

In addition, Equifax stock took a huge dip and hasn't recovered (down 21 as of this morning). They're also going to provide features so that all consumers (whether they were potentially impacted by the breach or not) will be able to lock and unlock their credit file, for free, forever. So not only did they take a big hit in terms of stock price, they are giving away the revenue generating lock and unlock service.

> If passed into law, the bill would give the US Federal Trade Commission the authority to inspect the companies that collect vast amounts of financial data on consumers to make sure they're protecting that information.

In what way does this in any way actually help consumers? Does the FTC have some sort of magic wand to prevent breaches? Does this help out with the overall problem of identity theft? Will this add any security or confidence above and beyond the existing government and industry regulations that are already in effect?

Will her new law address any of these? https://www.identityforce.com/blog/2017-data-breaches

If their expensive tools were misconfigured in a manner to render them effectively useless than they didn't have good procedures and follow best practices. Best practices would have included testing and auditing procedures both at deployment and ongoing to verify that they were operating as intended. By not having the proper auditing in place Equifax did allow the breach to occur.

Who knows when the flaw in their process was introduced? Perhaps it passed all the audits and tests, but got misconfigured later. There's no doubt or question that the process was flawed (in that the tools were silently failing and that a single human failure could disrupt their security). The point is, that even with solid processes and procedures, it is impossible to have perfect security. No doubt they (and every other company) will have a much higher focus on security going forward, but at the time they thought they were adequately protected. Their policies were sound, but their execution was flawed, and they got burned.

> "Allowed"? She phrases that to make it sound like Equifax just left the front door open. In truth, they were hacked by sophisticated criminals (possibly state sponsored), who pinpointed a flaw in their security and exploited it.

Maybe you haven't heard about one of the exploits, but leaving the front door open is what I would call using "admin" as both username and password. This also implies no further configuration was done past install and setup...

https://www.cnbc.com/2017/09/14/equifax-used-admin-for-the-l...

That was a totally different site in another country, not even in current use, and had no exposure of PII. Yes, it was a dumb thing, but it was completely unrelated to the breach.

* not in current use according to Equifax. I'm hesitant to take their word at face value, as they've tried to mitigate the entire situation via PR already and claim many users [who were affected] were not affected. However the site was still live, and exposed to the public web. It's only unrelated to the specific event in the United States, but clearly indicative of a pattern of negligence.

I also wanted to add that the software in question that was compromised was a free and open source solution[0], not some top-dollar security program. And it was breached by relative simple XSS attack that even may have been carried out automatically. Beyond that it could just as likely have been a script kiddie who caught wind of the vulnerability on a message board somewhere and went hunting. I wouldn't call that highly sophisticated. XSS protection is the very baseline of internet data security...

I'd also like to point to a video posted by another user upthread (willfarvar):

https://www.youtube.com/watch?v=vsMydMDi3rI

FBI's Frank Abagnale speaks to the Equifax breach at ~37m (as willfarvar says, though, the entire video/talk is great)

---

[0] https://struts.apache.org/announce.html#a20170707

> I'm hesitant to take their word at face value

Can you document a lie they've told?

> as they've tried to mitigate the entire situation via PR already

Of course, any company would do the same. But did they lie?

> claim many users [who were affected] were not affected.

Can you back up this claim? They claim 147 million potentially affected...and you think that was under representing it?

> I also wanted to add that the software in question that was compromised was a free and open source solution[0], not some top-dollar security program.

The code in question is heavily used in the industry, from the highly respected Apache Foundation. I.E. it wasn't some college project they found on github. Many other companies were affected by this vulnerability...they just either did a better job of patching it or weren't sufficiently interesting targets to make it worth going after. Or didn't report it...

As far as the sophistication, you should read this: https://www.bloomberg.com/news/features/2017-09-29/the-equif...

Assuming you trust Bloomberg, they report that there was an initial intrusion that didn't get anywhere, but appeared to get handed off to a much more sophisticated team that did the real breach.

Re: Frank Abagnale...he's exactly right on one point. The breach was tracked back to an employee who failed to follow the procedures and left a system vulnerable. In my view, the real problem is that their procedures were brittle enough that one person failing to do their part was enough to leave them vulnerable. Not enough redundancy. Even that isn't enough for perfect security, but having multiple people required to certify something like this would greatly reduce the odds of a breach.

However, his claim of negligence is complete bunk and supposition on his part. Equifax followed their procedures...they received the vulnerability report, processed it, applied patches, and ran scans to verify. However, one employee failed to do as required, and the scans were faulty and they didn't know. How is that negligence? It's a broken process, for sure, and they didn't have the ability to detect that it had failed. But negligence would be if they knew about the vulnerability and ignored it, and it's simply not true.

I didn't claim they lied. As far as the sophistication, it was the critical lapse in maintaining the front-line defenses that is at the root of the problem. Without entering through the front door, any attacker would have had a monumentally more difficult time installing any kind of back door access, let alone a series of shells as redundancies. Keeping the logs clean probably kept them nearly invisible for all that time to be able to pass off or sell off the access to a more capable group.

Negligence in their case is evidenced in the larger picture. One isolated incident can be just a dramatically terrible mistake. When there are obvious and foolish mistakes being made when the stakes are millions of peoples' personal and irreplaceable identification, then I think negligence is a fair term.

Re: not telling users they were affected https://www.marketwatch.com/story/after-huge-data-breach-equ...

Re: continued negligence in the response https://www.wired.com/story/equifax-breach-response/

Re: signalling of Equifax's possible intentions through the fallout https://techcrunch.com/2017/09/08/psa-no-matter-what-you-wri...

> I didn't claim they lied.

Then why did you say you were "hesitant to take their word at face value"?

> Without entering through the front door, any attacker would have had a monumentally more difficult time installing any kind of back door access.

Again, read the Bloomberg article for more details...your version doesn't match the facts as reported.

> When there are obvious and foolish mistakes being made when the stakes are millions of peoples' personal and irreplaceable identification, then I think negligence is a fair term.

What "obvious and foolish mistakes"? A single failure to patch a single vulnerability? Equifax receives a vulnerability report. They do their process to apply the fix. They get the messages back from the project teams that it's done. They run the scan to verify, and it comes back green. Where's the negligence? I know the process didn't work, but that's a hindsight thing...how can you tell something like that is broken unless it breaks?

> Re: not telling users they were affected

Per the article, they weren't "not telling people" as in, withholding information. The messaging was poor, but they weren't intentionally misleading anyone.

> Re: continued negligence in the response

Incompetent, maybe. But that article doesn't reference any negligent behavior.

> Re: signalling of Equifax's possible intentions through the fallout

And idiot opinion piece with no basis in fact. It's clear that none of the B.S. predicted there has come true in the 4 months since it was written.

Allowed. They left the back door open for two months. If "good written procedures" weren't followed, what good is that? When carelessness is systemic, where does the buck stop? https://www.wired.com/story/equifax-breach-no-excuse/

I agree that a federal agency barreling into this space is likely to be ineffective, but I'd rather nudge them to build policy with security experts than continue allowing every freaking company to police itself. The latter has proven to be ineffective.

> They left the back door open for two months.

There's a difference between "left the back door open for two months" and "the back door was open for two months because the person assigned to verify it was closed told everyone it was".

> If "good written procedures" weren't followed, what good is that?

How do you know they aren't being followed? How many layers are enough? If a process breaks down, what's your first signal?

> allowing every freaking company to police itself.

CRAs don't police themselves, they're audited and regulated already.

Question 4: Where does the money from the fines go?

Her main regulatory creation was a whole new agency that is completely unaccountable to the people it was supposed to serve. She's the last politician I trust with these sorts of things.

Similar to Al Gore, if passed, she will claim credit for inventing Internet security.

You mean similar as in “she also won’t make any such claim”, right?

https://www.snopes.com/quotes/internet.asp

> Her main regulatory creation was a whole new agency that is completely unaccountable to the people it was supposed to serve

Honest question: Is that her fault? She was just chosen to run it, but she wasn't responsible for the legislation that created it and its lack of accountability, or is that wrong?

50% to the new Office of Cybertechnology, 50% to the victims of the breach.[0]

I don't think Ms. Warren really understands most of the issues in finance she's often cited as a champion for, and dislike much about the CFPB, but this new effort to put dedicated personnel around setting minimum security standards and imposing civil penalties isn't too bad, as long as it doesn't indemnify the bad actors for victims seeking individual damages.

[0]https://www.scribd.com/document/368838846/Data-Breach-Preven...

> the new Office of Cybertechnology

Wow, so Consumer Finance Protection Bureau 2.0. Unbelievable.

That's a bit more cynical than I think the situation merits. Is it really so bad to have at least a defined lower bound and enforcement mechanism for prosecuting negligence in information security? Also, it will be under the FTC, not a newly defined agency.

Why must Democrats' answer to every problem be to create a wholly new bureaucratic body, that will create its own regulations separate of the legislative branch, and most likely get so bloated that it'll stifle innovation within a few years?

Because when said innovation takes the form of defrauding or otherwise harming the population (reminder that people are involuntarily tracked by credit agencies and all manner of other actors), that "innovation" ought to be stifled.

Of course I would prefer legislative action so that the regulatory environment doesn't change at the whim of the executive, but when basic harm prevention seems to be a partisan issue, I see little chance of legislative action being successful.

> reminder that people are involuntarily tracked by credit agencies and all manner of other actors

That's a gross misunderstanding of how CRAs function. You explicitly give permission for whatever businesses you interact with to forward your credit info to a CRA, and you explicitly give permission for them to reference the data held by CRAs.

If I want to have power or water or heat in my residence, hell if I want to have a residence at all, I have to do business with an entity that will report me to a credit agency. When the alternative is homelessness, dropping out of society, or dying of exposure then no, that is absolutely and emphatically not voluntary.

Additionally, other actors that collect information about me without my permission are advertisement and social media companies.

That is the choice made by the company you're doing business with, not the CRA. It's up to them whether or not they feel the need to use CRA info.

> other actors that collect information about me without my permission are advertisement and social media companies.

So those notices from web sites about cookie tracking, or the Terms of Use from social media companies, aren't enough to warn you about information collection? They can't collect it if you don't visit their (or affiliate) sites.

It may have been true in the past, but nowadays pretty much any reputable company has explicit terms and policies related to collection and use of personal data, and you have agreed to those policies by using their services. And non-reputable companies wouldn't care what you wanted one way or another.

>That is the choice made by the company you're doing business with, not the CRA. It's up to them whether or not they feel the need to use CRA info.

This is true, but the CRA is the beneficiary of this behavior and I would be surprised if they don't encourage it. But yes, the CRAs are not solely responsible. They just benefit from the widespread practice of making housing availability contingent on credit score.

>So those notices from web sites about cookie tracking, or the Terms of Use from social media companies, aren't enough to warn you about information collection? They can't collect it if you don't visit their (or affiliate) sites.

I don't use social media (aside from here and Reddit). That doesn't stop Facebook et al from placing tracking beacons all around the web and building shadow profiles on people. Regarding the cookie notices, by the time one has been displayed you've already landed on the site that uses them so it's presumably too late to avoid.

I go to great lengths to not be tracked. I generally browse without js enabled, I block ads and third party tracking requests. I do my best to not consent to bring surveiled. But should not these things be opt-in rather than "desperately struggle and still probably fail to opt out"?

> That doesn't stop Facebook et al from placing tracking beacons all around the web and building shadow profiles on people.

All done through agreements with the sites you do visit and which spell it out in their ToS.

> I go to great lengths to not be tracked. I generally browse without js enabled, I block ads and third party tracking requests. I do my best to not consent to bring surveiled.

So do I. I have 3 ad blockers on my browser and use a custom hosts file to deny as much of this stuff at the network level as possible.

> But should not these things be opt-in rather than "desperately struggle and still probably fail to opt out"?

I agree with this 100%.

My one nit:

>All done through agreements with the sites you do visit and which spell it out in their ToS.

By the time I visit their ToS, more often than not I've landed on the page with tracking beacons and the damage is done.

I wouldn't call that a nitpick. It's a glaring Catch 22.

That’s only how it works in right-wing propaganda. In the real world, regulatory agencies closely follow the rules which Congress gives them. When something is delegated to a regulator it’s because Congress didn’t want to deal with it — fast changing, requires a lot of specialist research, etc.

That last is why you need an office in the first place: for problems which are important enough to care, you need experts who are familiar with the field and aren’t working for a party with an interest in the outcome. Experts like having health insurance, paying their mortgages, etc. so you need to be able to offer them jobs, somewhere for them to sit, funding to support research and analysis, etc.

In terms more familiar to HN, your question is like asking why your company needs an IT department when you can hire consultants. I mean, yes, you could just let Gartner and Oracle tell the CEO what to do but it wouldn’t be cheaper.

> That’s only how it works in right-wing propaganda.

No, it's not. That's how it looks to everyone who has ever been on the receiving end of a bureaucratic nightmare. I believe part of the reason the Democrats have done so poorly in the last few years is because middle class America wound up on the wrong side of Obamacare and it woke them up.

> In terms more familiar to HN, your question is like asking why your company needs an IT department when you can hire consultants.

No, it's like your company hiring an whole new, separate IT department, with minimal oversight, every time they hire a new contractor, instead of training up the existing IT team.

That's weird, polling data shows a +12 point spread on favorability numbers for the ACA[1].

What's interesting to me is that the ACA never had majority favorability until repeal was legitimately on the table. And then all of a sudden people "woke...up" as you put it to the idea that their 20-something year old children could lose health insurance, or a person who had cancer years ago could be denied coverage, or that an underemployed person in Kentucky could lose their Medicaid-based health insurance.

Let's be clear: the ACA has a lot of problems. Some of these, like spiking premiums this year, are due to the actions of the current Congress and President. Some of these are due to a lack of real competition, which may have been addressed if the law had included a public option buy-in[2]. Some of these, like shitty exchange websites, are a real problem.

[1] https://www.realclearpolitics.com/epolls/other/obama_and_dem...

[2] Blame Joe Lieberman for this: https://www.publicintegrity.org/2015/02/16/16766/elimination...

> polling data shows a +12 point spread on favorability numbers for the ACA

Here's the page where they show all the polls used to collect this "summary"[0]. Interesting that the vast majority of them show "against" strongly winning.

The PPD poll giving +18 for ACA shows that 49% want to impeach Trump, but conspicuously doesn't ask party affiliation. That's a huge red flag of a stacked poll.

[0] https://www.realclearpolitics.com/epolls/other/obama_and_dem...

Here, let me quote myself: What's interesting to me is that the ACA never had majority favorability until repeal was legitimately on the table.

Also, best of luck with your poll unskewing. I had thought that the legitimacy of that ship had sailed all the way back in 2012. Guess not.

So you actually believe that 49% of Americans actively want Trump impeached now?

Why are you fixated on PPP? You're better off looking at aggregate polling data. That's what I'm talking about with the ACA.

> Why are you fixated on PPP?

For one, it's the latest poll, and you're fixated on a recent change in opinion on ACA.

Secondly, an aggregate of what? Once you have bad data in the mix, especially one that skews +18 in one direction, your aggregate is skewed as well. And that aggregate has half a dozen PDP polls in it alone.

Again: What's interesting to me is that the ACA never had majority favorability until repeal was legitimately on the table.

Have a nice day.

And again: your supposition that it has majority favorability is based on polls that are suspect.

Have a good one.

Right? It is hard to believe government in the 21st century taking a countervailing position protecting consumers against powerful interests running roughshod over consumers. The Credit Reporting Agencies in particular have statutory protections that make snowflakes jealous.

> It would also let the agency fine them in the event of a data breach, to the tune of $100 per affected consumer as a minimum. Half of that money would be redistributed to the consumers caught up in the data breach.

Reply on news.ycombinator.com