News for hackers. Stuff that matters.
Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by mankash666 on Thursday September 07, 2017 @07:09PM (#15196623)
Credit reporting agencies are the cancer of the modern economy. They are rife with inaccuracies, and on top of that, highly vulnerable to hacking , as software engineering is just a cost for them, not their focus.

Their entire function needs to move to the blockchain. Their only value is that of a distributed, trust less ledger, and they charge horrible fees and sit in the middle for doing that terribly

Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by wpietri on Thursday September 07, 2017 @08:56PM (#15197142)
This strikes me as sadly typical of so many "just use a blockchain" plans: it has a hopelessly naive understanding of the topic.

Credit reporting agencies aren't just a big ledger. They collect a lot of information from a variety of sources, verifying and evaluating them. They contextualize, evaluate, and summarize the information. They comply with extensive laws that regulate the use of the information. And then they, with obviously varying levels of success, control who has access to that information.

This work all costs money. It could surely cost less. But dumping terabytes of ungroomed personal data into a public database and then crossing our collective fingers is a startling bad idea. (If you disagree, then please put your last 5 years of financial statements, bills, and receipts unredacted in a GitHub repo and put the link here.)

Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by mankash666 on Friday September 08, 2017 @01:41AM (#15198120)
This is a naïve interpretation of my comment. Here's a real product [1] that considers all the pitfalls you enumerated, and achieves what I had in mind. [1]: https://hellobloom.io
Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by wpietri on Friday September 08, 2017 @07:46AM (#15199490)
It's a pretty straightforward reading of your comment.

Bloom is a fancier but also naive attempt. Nobody on that team has experience with loan origination, loan underwriting, loan rating, loan syndication, credit reporting, credit scoring, credit cards, debit cards, or debt collection. Having read the white paper, it is weirdly specific on record formats, and weirdly hazy on almost any important issue. It seems a fine example of the XKCD cartoon about physics majors. [1]

Remember when somebody who built a Magic the Gathering card exchange and then decided they could build a currency exchange? I'm not an expert [2], but that's what the Bloom.io stuff reads like to me. People joke that Bitcoin is basically the Dunning-Krugerrand, and things like Bloom don't do much to challenge that view.

[1] https://xkcd.com/793/

[2] Although I have build financial trading software, worked on a loan accounting system focused on the underbanked, and am currently consulting for a commercial lender, so I'm not entirely ignorant.

Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by mankash666 on Friday September 08, 2017 @12:17PM (#15201496)
Again, your response is typical of incumbents in any sector. AirBnb founders weren't hoteliers, Uber founders weren't taxi industry veterans. Everything you know can be learnt from a book, or obtained by hiring someone like you - and there are PLENTY of your kind to hire.

Now, for every successful Uber, there have been 100 failed attempts at the same. Will HelloBloom be the Uber of credit reporting- can't say. But will credit reporting be disrupted by someone like Hello Bloom, definitely.

Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by wpietri on Friday September 08, 2017 @03:54PM (#15203442)
I'm not an incumbent in the industry. Nice try, though.

My issue here isn't with industry disruption, which I generally like. It's with hallucinatory blockchain-based hype. For years I've been hearing that Bitcoin or some other blockchain technology will disrupt money transfer and online purchasing. But Bitcoin never got any foothold in international remittances and is actually in retreat in e-commerce. Now the Bitcoin hype had metastasized into blockchain and ICO hype, but I don't think there's any more meat to it.

But if you're so sure, let's put money down. I have $500 that says no blockchain-based startup will get even 1% of the US credit reporting market in the next 5 years. We can put the bet up here: http://longbets.org

You in?

Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by wpietri on Monday September 11, 2017 @08:27AM (#15217982)
You reply:

>

Yeah, that's what I thought you'd say.

Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by redm on Thursday September 07, 2017 @07:21PM (#15196684)
Perhaps I am misunderstanding what you're proposing, but If you moved all credit info to a blockchain, then everyone's info would be public. That seems to be opposite of the goal, so how is that better?

Also, the credit agencies, for better or worse, weigh the different factors in a credit profile, to provide an approximation of an individual's credit worthiness. This information from a credit bureau is solicited by many lenders who are providing the credit.

Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by bigdubs on Thursday September 07, 2017 @07:24PM (#15196698)
The point is to have verifiable identity that is tied to something more secure than a (not random) 9 digit [0-9] string and an address.

Your name is on the chain, the assertion you're you is done with your private key.

Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by wsxcde on Thursday September 07, 2017 @07:26PM (#15196705)
And are we expecting normal people to do key management?
Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by ISL on Thursday September 07, 2017 @07:31PM (#15196725)
I'm a normal person. My first attempt at key management was an utter failure, accidentally broadcasting a private key instead of the public one.
Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by wsxcde on Thursday September 07, 2017 @10:45PM (#15197539)
I'm a computer security researcher. At some point I posted a public key for people to send me encrypted email. Nobody ever did and at some point I lost that private key.

Point is, key management is hard problem for big corporations with dedicated IT staff. Relying on normal people to be able to do that is just insane.

Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by shelbyfinally on Friday September 08, 2017 @05:40AM (#15198967)
I'll give another example. My medical practice tried to do GPG encryption in a shared DropBox folder. Within the first week, someone decrypted half the files into the same shared folder...

It was all just a test with non-critical data, but the test was a total failure. And that didn't even get into key-related issues.

Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by bigdubs on Thursday September 07, 2017 @07:27PM (#15196711)
Works fine in estonia.
Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by c22 on Thursday September 07, 2017 @07:39PM (#15196778)
Perhaps Equifax could transition to a key escrow service for those who trust giant corporations more than themselves.
Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by chrsstrm on Thursday September 07, 2017 @07:46PM (#15196812)
Sure, because of their stellar record protecting PII?
Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by Teever on Thursday September 07, 2017 @07:33PM (#15196743)
How else do you expect them to start the cars and open the doors to the houses they bought on credit?
Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by secfirstmd on Thursday September 07, 2017 @07:29PM (#15196719)
Just applying for a mortgage in the UK. Got three different reports from three different companies. Took about 8 hours total to do it and each of them had big issues. One with wrong addresses, another with credit problems because of a company I had no idea about and the other didn't even have the correct spelling of my name...Banks were making decisions on the back of that. Anything is better than that.
Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by twblalock on Thursday September 07, 2017 @08:20PM (#15196981)
If inaccurate information made its way into the blockchain, how could it be removed?

At least credit agencies can remove inaccurate information from your report. They don't make it easy, but they can do it. In a blockchain, how would that be possible?

Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by thephyber on Thursday September 07, 2017 @08:38PM (#15197063)
Just because something is immutable doesn't mean you can't amend an old record to flag it as inaccurate / irrelevant / outdated.

That said, I don't know how I feel about replacing credit bureaus with a distributed database. The issue still revolves around verifying identity and reputation. The blockchain doesn't solve identity. Perhaps it could solve the reputation problem... of a cryptocurrency wallet. How does a merchant know that their current customer doesn't just burn the reputation of a wallet and create another wallet?

I see BitCoin has being a masterful synergy of several existing algorithms and theories. But it's a lot like a 4-legged chair. I've yet to hear a great use of blockchain (other than a cryptocurrency) which supports the chair with all 4 legs. Some proposals would be better served as just a distributed database, others don't benefit at all from being distributed. Some simply don't have an incentive for miners to spend on the electricity needed for Proof of Work and will inevitably suffer from one company consolidating a majority of the network -- thereby compromising the value of the consensus algorithm.

Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by brndnmtthws on Thursday September 07, 2017 @08:56PM (#15197143)
Ask and ye shall receive: https://hellobloom.io/
Re:Three Equifax Managers Sold Stock Before Cyber Hack Was R... by maxerickson on Thursday September 07, 2017 @07:37PM (#15196767)
They actually sell trust.

Perhaps they are overcharging, but they aren't serving a trustless function.