News for hackers. Stuff that matters.

A comment on The Equifax breach may be the worst leak of personal info ever. Parent comment

Re:The Equifax breach may be the worst leak of personal info... by ceejayoz on Friday September 08, 2017 @11:06AM (#15200744)
They've almost certainly got a "forgot my PIN" flow, too. Otherwise a forgotten PIN would mean a lifetime loss of access to credit.

What do you want to bet it uses stuff like your SSN to verify?

[ Parent | on HN ]
Re:The Equifax breach may be the worst leak of personal info... by lightbyte on Friday September 08, 2017 @11:18AM (#15200848)
For Equifax, you are exactly right [1]. If you lose your pin you just ask for a new one and provide some basic form of id.

[1] https://help.equifax.com/s/article/ka137000000DS9XAAW/What-d...

[ Parent | on HN ]
Re:The Equifax breach may be the worst leak of personal info... by ceejayoz on Friday September 08, 2017 @11:21AM (#15200875)
Yeesh.

> Please provide proof of identification, such as a copy of your driver's license, passport, birth certificate or other proper identification forms.

Given that the hack included name, SSN, date of birth, and address, a fake copy of one of these should be incredibly easy to generate.

edit: Driver's license numbers were also leaked in some cases. Fun.

[ Parent | on HN ]
Re:The Equifax breach may be the worst leak of personal info... by 3JPLW on Friday September 08, 2017 @11:35AM (#15201000)
Even worse: In a number of states, the DL number is deterministic based upon name and DOB.

http://www.highprogrammer.com/alan/numbers/dl_us_shared.html

[ Parent | on HN ]
Re:The Equifax breach may be the worst leak of personal info... by ConceptJunkie on Friday September 08, 2017 @12:14PM (#15201445)
I don't know if it's still the case, but Virginia used to your SSN as an ID. There was an opt-out for that, which I exercised about 25-30 years ago, so I don't know if that policy is still in place.
[ Parent | on HN ]