News for hackers. Stuff that matters.
Re:Equifax Releases Details on Cybersecurity Incident, Annou... by sillysaurus3 on Friday September 15, 2017 @10:55PM (#15262578)
Yes, but the elephant in the room is that a credit bureau possesses that information in usable form. This can be taken care of by key management, where the individual owns the key and only one key is able to exist per individual at a time. Then, only those credit grantors who have been authorized by the individual are able to update or view the data.

This is what I mean by not meeting business goals. It is clearly a bad idea to give Grandma an irreplaceable key. But that's what this proposal is.

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by IncRnd on Friday September 15, 2017 @11:43PM (#15262724)
Wrong. It is your interpretation that this is an irreplaceable key. You are trying to say that a design is wrong, because you believe that your implementation would be wrong.

Uniqueness is a different property from replaceability. And, replaceability is not necessarily the correct property to design for, key rotation and recovery from loss are the properties. What you want is the ability to rotate keys and recover from the loss of keys.

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by sillysaurus3 on Saturday September 16, 2017 @01:08AM (#15263000)
The moment you ask users to manage keys, you've lost. They can barely handle passwords that aren't abcabcabc.