Apache Struts Statement on Equifax Security Breach [LWN.net]

Apache Struts Statement on Equifax Security Breach

Posted Sep 11, 2017 22:12 UTC (Mon) by dskoll (subscriber, #1630)
In reply to: Apache Struts Statement on Equifax Security Breach by ssmith32
Parent article: Apache Struts Statement on Equifax Security Breach

Credit agencies should be required to keep at least one phone number and one email address in your record. If someone wants to do a credit check on you, they should be required to email, text or call you to let you know (1) who is doing the check, (2) what the purpose of the check is and (3) a random PIN that's good for 24 hours.

If you consent to the check, you phone a number or go to a web site, enter the PIN, and the check goes through. If not, you phone the number or go to the web site, indicate that you don't want the check to go through, and it doesn't.

Can that be hacked? Undoubtedly. But it would raise the difficulty substantially. It would also make it much slower for credit agencies to sell credit checks about you, which is why it'll never happen, even though Google, Yahoo, etc. have used similar schemes for much lower stakes for years.

Apache Struts Statement on Equifax Security Breach

Posted Sep 13, 2017 1:58 UTC (Wed) by ssmith32 (subscriber, #72404) [Link]

And you prolly already know (guessing it's where you got the idea from), but for anyone else reading.

Phone + pin = credit freeze, which is already available today.

As for how you deliver a random pin daily, at scale, securely (and that means no UX muck ups) to lower income people most dependent on good credit... I have no idea.

The biggest problem is all these ideas are hardest on people who depend on credit the most. E.g. couldn't make your phone payment? Congrats, your fsck!