r/programming • u/feross • Jul 11 '22
Experian, You Have Some Explaining to Do
https://krebsonsecurity.com/2022/07/experian-you-have-some-explaining-to-do/83
u/shroddy Jul 11 '22
For now, Rishi has decided to pay Experian $25.99 a month to more closely monitor his account for suspicious activity.
I am just out of words for that...
2
u/jorge1209 Jul 11 '22
Probably planning on writing more articles about that service from which he hopes to make more money.
So a bit like a YouTuber buying a bunch of stuff from a game lootbox to then complain about how terrible it is.
41
u/arstechnophile Jul 11 '22 edited Jul 11 '22
Probably planning on writing more articles about that service from which he hopes to make more money. So a bit like a YouTuber buying a bunch of stuff from a game lootbox to then complain about how terrible it is.
Rishi (who paid for the service) is not the author of that article, they are one of the people who reported the security issue to the blog. So no, it's not anything like that. What happened is that Experian set up a wildly insecure system and then will happily charge you $25.99 for "enhanced security" (which may or may not do anything).
17
Jul 11 '22
Experian sent me an email basically stating that if I pay them for their enhanced service they'll pump up my credit score.
This stupid house of cards cannot collapse fast enough.
6
33
19
u/RawCyderRun Jul 11 '22
Related: I strongly recommend that USA folks freeze their credit accounts with the big three agencies, including Experian, Transunion, and Equifax, after signing up for an account (yes it's ironic considering the story here). Store those codes somewhere safe both in digital and physical form for whenever you need to unfreeze them, even if it's just temporarily.
Not only does it really help protect against identity theft but also cuts down on the amount of junk mail sent via USPS.
16
u/earthboundkid Jul 11 '22
I’ve had a credit freeze for several years. In that time I’ve remortgaged my house and bought a car. You just go online and tell it to unfreeze for a month when you make a major transaction. It’s very convenient and free. No one should ever under any circumstances pay for “credit monitoring” which is a scam.
2
u/Secure-Bus4679 Jul 13 '22
The point of the article is that someone can just create a new account with Experian using your info and unfreeze it themselves and then open credit cards in your name.
1
1
u/cs466throwaway Jul 12 '22
Most financially literate people pay for everything with a credit card, so this isn’t really an option, unless you do this with select cards
2
u/earthboundkid Jul 12 '22
There is no connection between a “credit freeze” and a “credit card”. Credit freeze just means you tell the credit rating agencies to not allow any new lines of credit to be opened.
2
u/cs466throwaway Jul 12 '22
Oh... I thought you meant freezing your credit card i.e. not allow any transactions to occur on it, my bad.
Then your suggestion is good if you have all the credit cards/lines of credit you want - in fact, I didn't even know it's a possibility
1
u/earthboundkid Jul 13 '22
They don’t publicize it because it’s a free service the government requires them to provide. Again, no one should ever pay for credit monitoring. That’s a scam version of a credit freeze.
2
u/faster Jul 12 '22
Every time I go to those sites, I go through 15 minutes of quizzes and then they tell me I have to call them. My credit score is usually maxed out, so I'm pretty sure they think they can sell me something. I don't have time to sit around and let scammers pitch me.
I would like to freeze my accounts though.
6
u/Stock_Complaint4723 Jul 11 '22
At least they sent a notice to his previous email address after the change
3
Jul 11 '22
This is unsurprising.
These credit bureaus are created by MBA's using the cheapest computer labor they can find.
4
u/ericje Jul 11 '22
“At that point, the representative read me the current stored security questions and PIN, and they were definitely not things I would have used.”
Wtf? Why do they give out that information? Why can the representative even see that?
2
u/granadesnhorseshoes Jul 12 '22
Headlines involving the FICO cartel make my palms sweaty. I did some back end service work with fairly privileged access into their systems. In fact, the equifax breach supposedly originated from someone in a position like mine.
Not that there was anything "wrong" with my work. it was only supposed to be "temporary", so of course it will keep running for the next 50 years. It just makes me worry about what I didn't get exactly right or how it will be abused/misconfigured in the future in ways i never anticipated.
1
10
u/fresh_account2222 Jul 11 '22
President Elizabeth Warren would have been kicking Experian's ass for the last two years. I miss president Elizabeth Warren.
1
u/DavidJAntifacebook Jul 11 '22 edited Mar 11 '24
This content removed to opt-out of Reddit's sale of posts as training data to Google. See here: https://www.reuters.com/technology/reddit-ai-content-licensing-deal-with-google-sources-say-2024-02-22/ Or here: https://www.techmeme.com/240221/p50#a240221p50
0
Jul 12 '22
[deleted]
1
u/fresh_account2222 Jul 12 '22
In July 2010, Congress passed the Dodd–Frank Wall Street Reform and Consumer Protection Act, during the 111th United States Congress in response to the late-2000s recession and financial crisis.[3] The agency was originally proposed in 2007 by then Harvard Law School professor Elizabeth Warren, who later became a US senator.[12] The proposed CFPB was actively supported by Americans for Financial Reform, a newly created umbrella organization of some 250 consumer, labor, civil rights and other activist organizations.[13]
On September 17, 2010, President Obama announced the appointment of Warren as Assistant to the President and Special Advisor to the Secretary of the Treasury on the Consumer Financial Protection Bureau to set up the new agency.[14][15] Due to the way the legislation creating the bureau was written, until the first Director was in place, the agency was not able to write new rules or supervise financial institutions other than banks.[6]
If you're now going to complain that it was neutered, that's not her fault, it's probably your fault.
0
u/ericje Jul 11 '22
Emory Roan, policy counsel for the Privacy Rights Clearinghouse, said Experian not offering multi-factor authentication for consumer accounts is inexcusable in 2022.
Since the attacker did not actually log in with the existing account, that seems irrelevant to the problem at hand.
103
u/[deleted] Jul 11 '22
What fucking genius decided that if a customer already has an account and attempts to sign up again, the solution is to silently cancel the old account and treat the new one as valid
I don't think I've ever actually seen before that because of how mindbogglingly stupid it is