News for hackers. Stuff that matters.
Re:No matter what, Equifax may tell you you’ve been impacted... by Kiro on Saturday September 09, 2017 @05:19PM (#15209206)
In Sweden you use a special authentication method you install on your phone through your bank to prove your identity. It's basically a national 2FA. So when you for example declare your taxes you enter your social security number and authenticate the action with your phone each time.

So no, I don't think there's any Equifax equivalent where a data leakage would enable stuff like this.

Re:No matter what, Equifax may tell you you’ve been impacted... by Avshalom on Saturday September 09, 2017 @05:23PM (#15209224)
How does the bank know it is you or your phone when you open an account?
Re:No matter what, Equifax may tell you you’ve been impacted... by scient on Sunday September 10, 2017 @04:52AM (#15211399)
You open the account in person, by showing them your ID card. The bank has access to the central national database of IDs, so they can compare if the ID card shown by the person matches the information coming from the central db, matching the person showing it on the picture. Hence you have strong in-person proofing, that is now the basis for the 2FA.

Thats how it should be done, except in the US there is no way to check against a national database of IDs, not even on the state level with DMVs. You literally trust the plastic card the person shows you and thats where the problems start. Online its even worse.

Re:No matter what, Equifax may tell you you’ve been impacted... by Kluny on Sunday September 10, 2017 @05:09AM (#15211438)
@EGreg below me - no, the national database has biometric information including finger and retina prints as well (definitely fingerprints, not sure of retina prints). The bank is able to check that too.
Re:No matter what, Equifax may tell you you’ve been impacted... by EGreg on Sunday September 10, 2017 @05:02AM (#15211426)
I see, so if you temporarily steal a card from a person who looks like you, you can open acccounts in their name?
Re:No matter what, Equifax may tell you you’ve been impacted... by alkonaut on Sunday September 10, 2017 @06:15AM (#15211573)
Yes if you forge a drivers license or passport with my name and id number, and you put your own photo on it (or happen to look like me) you could probably do something bad like get a phone contract or request a credit card in my name.

However, most of those scenarios have the added security that the CC or some necessary confirmation letter to sign is sent to the registered address of that id. So you'd also have to stalk my mailbox to actually get the credit card. This actually happens - so people use locked mail boxes to protect against this.

That is, even for this "manual" id method, there is 2fa in the form of regular mail, made possible by the fact that you can't use my id and give them your street address. When you show my id - they immediately know what address belongs to that id.

Re:No matter what, Equifax may tell you you’ve been impacted... by ProblemFactory on Sunday September 10, 2017 @06:08AM (#15211561)
Yes. If you steal the ID card or passport of a person who looks like you, you can do most things in life in their name. Take out a loan, travel the world, get married, etc.

The major benefits compared to SSN authentication still are:

* It's a physical object, you have to be physically present to steal each one instead of getting a hundred million at a time.

* Most people would quickly notice that their card is gone, report it, and get it revoked. You only have between a few hours to a week to use it, not the next 50 years.