Quest Diagnostics says nearly 12M patients may have had data breached

Re:Quest Diagnostics says nearly 12M patients may have had d... by DebtDeflation on Monday June 03, 2019 @05:03PM (#20088746)

But that is THE FUNDAMENTAL problem. No one should be able to impersonate you and open up credit cards in your name simply by knowing your Name, Address, DOB, and SSN. Just as no one should be able to purchase things using your credit card account by knowing your name, credit card number, and expiration date (all of which are printed on the card, which you give to people for B&M purchases). The system is fundamentally broken, and that fact gets ignored by all the focus on "data breaches". At a minimum, we need to move to multifactor authentication and one time use "credit card numbers" generated at the time of the transaction.

[ Parent | on HN ]

Re:Quest Diagnostics says nearly 12M patients may have had d... by nkrisc on Monday June 03, 2019 @07:27PM (#20090069)

And this is a function of power asymmetry. Why is it my problem that a bank issued a credit card to some guy in Romania or Russia who said they were me? It should be their problem unless they can prove it was me who opened the account. But they make it my problem through the enormous power they wield over our ability to participate in society.

If they come looking for the money I supposedly owe them on that account, I should be able to tell them to fuck off and collect from whoever they sent the card to of their own volition.

If they can't figure out whose business they took, maybe they need to reconsider their practices, otherwise they're just giving away money.

[ Parent | on HN ]

Re:Quest Diagnostics says nearly 12M patients may have had d... by ravenstine on Monday June 03, 2019 @05:13PM (#20088853)

> one time use "credit card numbers" generated at the time of the transaction

PayPal used to have that feature but got rid of it for some reason.

[ Parent | on HN ]

Re:Quest Diagnostics says nearly 12M patients may have had d... by Consultant32452 on Monday June 03, 2019 @11:55PM (#20091736)

Google Pay still offers this. I have a virtual card number that is given to merchants instead of my real CC number. I don't know if this is a feature for all of Google Pay or requires special integration with my particular CC/bank.

[ Parent | on HN ]

Re:Quest Diagnostics says nearly 12M patients may have had d... by u801e on Monday June 03, 2019 @05:49PM (#20089229)

Capital One still has this feature for online transactions.

[ Parent | on HN ]

Re:Quest Diagnostics says nearly 12M patients may have had d... by bifrost on Monday June 03, 2019 @05:42PM (#20089160)

AMEX did too, I think the problem is the keyspace is small enough that it would be a serious problem.

[ Parent | on HN ]

Re:Quest Diagnostics says nearly 12M patients may have had d... by beamatronic on Monday June 03, 2019 @05:46PM (#20089205)

Discover had that for a while, many years ago.

[ Parent | on HN ]

Re:Quest Diagnostics says nearly 12M patients may have had d... by burfog on Tuesday June 04, 2019 @05:54AM (#20093481)

We're not solving this unless we can teach all people, even newborns and coma patients, to do 8192-bit RSA in their heads and to generate and remember suitable private keys all in their heads.

We're not solving this.

[ Parent | on HN ]

Re:Quest Diagnostics says nearly 12M patients may have had d... by Gibbon1 on Monday June 03, 2019 @07:01PM (#20089867)

If the healthcare industry used medical id numbers instead of SSN's that would help. Better banks should be forced to stop using SSN's completely. And forced to use 2factor. Preferably both.

[ Parent | on HN ]