Hacker News Reader

Comment by _huayra_ | Hacker News Reader

Just for clarity and equanimity about this stuff:

- If you sign up to see your TWN data (which is just the usual KYC-type sign-up), you can generate a report and will likely see that no employer has pulled your data in the past 24 months (the most they give). Most people who work in tech don't seem to have any inquiries registered for TWN when they check their report after hiring (from the handful of anecdata I have at hand).

- You don't have to mail anything in. They have some hokey secure email thing that is basically a link to a webform upload. Is it a weird process? Yeah, but it'll work just give it time.

- Opting out won't prevent partners that "subscribe" to TWN from sharing your data with them; it will only prevent partners from having access to your data until you unfreeze it. My current employer has been dutifully reporting my comp every month despite it having been frozen.

View on HN

> They have some hokey secure email thing that is basically a link to a webform upload.

Not Equifax per se, but my understanding from dealing with background checking companies is that this pattern is to discourage people from sending sensitive information over email. 99% of people won't have a clue about how to encrypt email, nor will they think twice about sending an unencrypted attachment. Whereas a sanely coded web portal can enforce this.

The irony here is that its done for "security". But if the app itself has an unpatched vulnerability...

Ps I once did try sending an encrypted PDF to such a company, and instructed them to phone me for the password. This was apparently way over the heads of the person assigned to my case.

> instructed them to phone me for the password. This was apparently way over the heads of the person assigned to my case.

They probably knew exactly how to make a phone call, but the company may not have provided them with a means to do so.

And no, "Just use your personal phone" isn't an answer. I keep my personal stuff and my work stuff strictly separate from each other. If my company wants me to do something business-related, they provide me with all of the equipment and services necessary for me to do it, or it doesn't get done, plain and simple. When I'm out of the office after hours or on vacation, I'm not working. So no way in hell some random client is going to get my personal contact information via caller ID.

I see your point, and that is indeed the case in some companies (or even roles within companies). I also advocate for keeping a separate work/personal phone.

However, being a background checking company, making phone calls is absolutely in their BAU remit. Upon submission of documents, they even state in their automated email response that they may call you for further information. Plus, they regularly call companies to verify employment information.

I got the distinct impression that they have a certain process, and they pay certain ranks not very much to simply follow that process. Any minor deviation from that playbook needs to be handled by a "senior", who is "empowered" to think and handle things like a regular human.

Yes, this pattern is far better than attaching passport_scan.pdf over email! I used to send links to a fileshare that is password protected (hooray pcloud!), but it seems like most companies have really locked down that avenue of sharing (understandably so).

Reply on news.ycombinator.com