Apache Struts Statement on Equifax Security Breach [LWN.net]

Apache Struts Statement on Equifax Security Breach

Posted Sep 11, 2017 20:49 UTC (Mon) by ssmith32 (subscriber, #72404)
In reply to: Apache Struts Statement on Equifax Security Breach by tialaramex
Parent article: Apache Struts Statement on Equifax Security Breach

Yeah, but how do you identify the "you" part of "record of plain facts about you".

Even a government-mandated biometric database is just a collection of plain facts about you. But once someone has those facts they can impersonate you. Game over.

Any other neat ideas for identification that I don't know about? I haven't really kept up like I should...

to post comments

Apache Struts Statement on Equifax Security Breach

Posted Sep 11, 2017 22:12 UTC (Mon) by dskoll (subscriber, #1630) [Link] (2 responses)

Credit agencies should be required to keep at least one phone number and one email address in your record. If someone wants to do a credit check on you, they should be required to email, text or call you to let you know (1) who is doing the check, (2) what the purpose of the check is and (3) a random PIN that's good for 24 hours.

If you consent to the check, you phone a number or go to a web site, enter the PIN, and the check goes through. If not, you phone the number or go to the web site, indicate that you don't want the check to go through, and it doesn't.

Can that be hacked? Undoubtedly. But it would raise the difficulty substantially. It would also make it much slower for credit agencies to sell credit checks about you, which is why it'll never happen, even though Google, Yahoo, etc. have used similar schemes for much lower stakes for years.

Apache Struts Statement on Equifax Security Breach

Posted Sep 13, 2017 1:50 UTC (Wed) by ssmith32 (subscriber, #72404) [Link]

A) Stealing phone numbers via (your provider's) website is getting more common. So unless they start offering 2fa for that. Bad idea.

B) Coz most ppl's email is secure? What?

Apache Struts Statement on Equifax Security Breach

Posted Sep 13, 2017 1:58 UTC (Wed) by ssmith32 (subscriber, #72404) [Link]

And you prolly already know (guessing it's where you got the idea from), but for anyone else reading.

Phone + pin = credit freeze, which is already available today.

As for how you deliver a random pin daily, at scale, securely (and that means no UX muck ups) to lower income people most dependent on good credit... I have no idea.

The biggest problem is all these ideas are hardest on people who depend on credit the most. E.g. couldn't make your phone payment? Congrats, your fsck!

Apache Struts Statement on Equifax Security Breach

Posted Sep 12, 2017 8:07 UTC (Tue) by tialaramex (subscriber, #21167) [Link] (8 responses)

Sure, in the 1970s a bunch of people starting with Clifford Cox and eventually including more recognisable names like Ron Rivest came up with Public Key Cryptography. In a public key system we can know a bunch of plain facts (a Public Key) which are enough to recognise a key holder without also knowing their Private Key, stealing these facts does not allow you to impersonate them. Only stealing their key, which they have no reason to let out of their possession, can do that.

Here's how silly this is: If you build a crappy PHP application and "secure" it using a plain password field in your MySQL database with the user's chosen password in it, other PHP developers will know to ridicule you for this design because when inevitably the database gets stolen you lost all the passwords. They all read not to do that and "know better". But if you build a bank, and "secure" it using records of when each customer applied for an account, how much their mortgage payments are each month and what they get paid, industry experts will nod their heads sagely at your brilliant use of data to protect your business.

Bad guys stealing data on this scale don't care about "you". This is a numbers game. Use some stolen records to fill out a thousand loan applications for $5000 each, fifty get approved, ten send the "loan" money abroad to be cashed before the accounts are closed as fraudulent, you now have $50 000 for the trouble of pasting data from one document into another. They're relying on the fact that all the "security" consists of just comparing what was filled in on a form in one place with what's kept in a database in another place. There hasn't been any need to do this for _decades_ but it's what the financial industry is used to, and nobody shows any signs of telling them to knock it off.

Apache Struts Statement on Equifax Security Breach

Posted Sep 12, 2017 23:45 UTC (Tue) by ssmith32 (subscriber, #72404) [Link] (7 responses)

I'm aware of pgp. It does not solve the identity issue without a side channel. Key distribution at any non-trivial scale is hard.

I believe the kernel team does it by having "key parties" where people show up with... wait for it... driver's license and/or passports.

Exactly those things that are the "plain facts" you reject.

Apache Struts Statement on Equifax Security Breach

Posted Sep 13, 2017 14:26 UTC (Wed) by nybble41 (subscriber, #55106) [Link] (6 responses)

> I'm aware of pgp. It does not solve the identity issue without a side channel. Key distribution at any non-trivial scale is hard.

In this case you don't need secure key distribution. You aren't actually trying to associate a particular public key with a real-world identity. You just need to show that the person applying for this loan is the same person who has a history of on-time payments on previous loans, utility bills, etc. The key itself is all the identity you need. When you first start out you just generate a fresh key and are treated as someone with no prior credit history; perhaps others with established credit who trust you (or institutions which know your real-life identity and are willing to back you) co-sign your key to give you a head start. Over time you build up a history of payments associated with your key. When you need a loan you sign the application with your private key to prove to the lender that the person submitting the application has an established credit history.

Apache Struts Statement on Equifax Security Breach

Posted Sep 13, 2017 15:03 UTC (Wed) by farnz (subscriber, #17727) [Link] (5 responses)

The problem with the model you outline is that some people have a bad credit history - the "baseline" of no history is higher than the credit record associated with someone who's taken loans and refused to repay. Without this, you have a bootstrapping issue for people who are credit-worthy but who have no history yet (e.g. homosexuals who've run away from a bigoted home situation) - how do I get credit to prove that I'm trustworthy when no-one will vouch for me because the people who could refuse to do so until I acknowledge that I was "wrong" to be gay?

Thus, you also need some mechanism to either prevent people from creating new identities to defraud the banks with, or some mechanism to demonstrate to a high standard that I've never had credit before - otherwise, the baseline inevitably reduces to "not credit worthy".

And, FWIW, the introduction standard is how credit worked in the dim and distant past - one effect was to limit credit to people from "good" families, as you needed an introduction from someone credit-worthy to yourself be eligible to get credit, and you needed to have credit to become credit-worthy.

Apache Struts Statement on Equifax Security Breach

Posted Sep 13, 2017 18:27 UTC (Wed) by raven667 (subscriber, #5198) [Link]

> And, FWIW, the introduction standard is how credit worked in the dim and distant past - one effect was to limit credit to people from "good" families, as you needed an introduction from someone credit-worthy to yourself be eligible to get credit, and you needed to have credit to become credit-worthy.

In that time if your reputation was questioned in any way this was death sentence as you cannot operate a business like a farm/plantation without credit, leading to the rise of duels as a way to settle questions of reputation.

Apache Struts Statement on Equifax Security Breach

Posted Sep 13, 2017 19:08 UTC (Wed) by nybble41 (subscriber, #55106) [Link] (3 responses)

> some people have a bad credit history - the "baseline" of no history is higher than the credit record associated with someone who's taken loans and refused to repay

This is a flaw in the current system. You can't presume the ability to identify all bad actors; it's too easy to change one's identity and start over. Someone with no known history _could_ have failed to repay prior debts under another name. The only sane default is to trust no one, and extend significant credit only when there is someone with an established credit history at stake.

I addressed your concerns about the "introduction standard" already, in the form of "institutions which know your real-life identity and are willing to back you". To qualify for a significant loan with no prior history you'll need to find someone willing to cosign, or at least stake their own credit score on your good behavior. That may be someone you know personally, but it could also be a business offering "loan insurance" for a minor fee following a more traditional background check. Alternately, you can start with small amounts of credit, such as utility payments. The utility company already knows where you live and takes on little risk by extending a month's worth of services on credit, making this a simple (and already commonplace) way to bootstrap your credit history.

Apache Struts Statement on Equifax Security Breach

Posted Sep 14, 2017 16:34 UTC (Thu) by farnz (subscriber, #17727) [Link] (2 responses)

But the same flaw exists in your system, and is made worse by the requirement to cope with people having lots of legitimate IDs. At least in the current system, it's a criminal offence (not just civil) to create a second ID for the purpose of fraud; in your system, multiple IDs are expected, as I can legally create a new ID at the drop of a hat.

And no, you didn't address my concerns - you completely ignored them. I asked how someone with no prior history (so no institutions that are willing to back you, albeit they know your real-life identity) would get on the credit ladder; your description of "loan insurance" is basically how the current system works. Utilities are no use to someone who's on the bottom of the ladder - they generally don't have utility bills, as those are taken care of as part of their rent on a room in someone else's property; they do pay towards utilities, but they pay a roommate, not a utility firm.

At least in the current system, these people show up as a previously unknown borrower - no added risk from failed credit, but no evidence of good risk either; in your system, such a person ends up in the same pool as people who've refused to pay their debts, making it even harder for someone in a bad situation to get minimal credit to establish their credit-worthiness. Unless, of course, I add in the current system, but described as "loan insurance" and "guarantors" instead...

Ultimately, you're not fixing the issues with the current system, you're just adding a new system on top that adds more issues but doesn't fix the core issues in the current system.

Apache Struts Statement on Equifax Security Breach

Posted Sep 14, 2017 17:38 UTC (Thu) by nybble41 (subscriber, #55106) [Link] (1 responses)

> someone with no prior history ... so no institutions that are willing to back you

Non sequitur. A lack of history does not imply that no institution would be willing to back you. It implies that you are higher-risk, but that risk is easily manageable.

> Utilities are no use to someone who's on the bottom of the ladder - they generally don't have utility bills, as those are taken care of as part of their rent on a room in someone else's property...

For this purpose rent would count as a utility. Anything you have to make regular payments on would serve to establish history.

> At least in the current system, these people show up as a previously unknown borrower - no added risk from failed credit, but no evidence of good risk either...

Which is an error. An unknown borrower should be considered maximum risk, on par with someone who has refused to pay. You know nothing about them, including whether they care about their credit score. As far as you know they have nothing at stake.

Anyway, there are any number of ways to handle the bootstrapping issue and this is getting quite far off-topic. The original point was simply that public key cryptography can be used to establish identity far more securely than the current system of asking you for slightly obscure—but not truly private—information about yourself, such as previous addresses and your Social Security number. If you want a system linked to real-world identity that's not so difficult to do; just have some authority figure endorse the key after running a thorough background check to verify that you are who you say you are. Doing that in one place, once per person, would certainly be an improvement over every lender verifying your identity separately using their own insecure, ad-hoc procedures based on knowledge just about anyone could collect with a bit of effort.

Apache Struts Statement on Equifax Security Breach

Posted Sep 14, 2017 18:03 UTC (Thu) by farnz (subscriber, #17727) [Link]

Note that a lack of history in your system is not distinguishable from bad history - it could be that I have no history, or it could be that I've run away from debts and created a new key. There's no way to distinguish the two situations.

And if rent counts, then what stops me lying and reporting that my kids pay me $10,000 per month in rent reliably? In general, if arbitrary private actors can report, what stops me falsely claiming "good" behaviour for friends - bearing in mind that I can establish new identities as quickly as you can blacklist them? If you whitelist, how do I as head tenant on a flatshare get on the whitelist?

And no, an unknown borrower is not maximum risk - there are legal penalties for trying to disguise your identity to get money, which mean that unknown is lower risk than known bad, since known bad puts you at risk of having to sue, while unknown but with history of not paying lets you get the police forces involved. This is, however, only possible because you are only permitted to have a single identity - as soon as you're allowed to create multiple identities, the system breaks down.