Hacker News Reader

Comment by mrrsm | Hacker News Reader

This link [0] tells you if they think you are affected (you probably are) and then asks if you want to sign up for protection which you don't have to do.

[0] https://trustedidpremier.com/eligibility/eligibility.html

View on HN

Why should I trust trustedidpremier dot com? Their whois info is a PO box, which isn't encouraging. And asking for the last 6 digits of my SS# is super-suspicious [Added:] because the remaining (first 3) digits, called the "area number", are generally discoverable, because they are more or less determined by the zip code of where you were born (if you're older than 6).

Equifax.com links to EquifaxSecurity2017.com, which links to TrustedIDPremier.com, but yeah, it looks like a phishing scam. OpenDNS even flagged it as such this morning.

Why they didn't go with a subdomain of Equifax.com is beyond me.

That in itself is indicative of how they really don't understand security.

<tin-hat>How do I know you're not working with "mrrsm" to steal my info?</tin-hat>

You can follow the chain from Equifax.com, at least.

Phishers are going to have a field day with this, though.

Incompetence?

I registered. I figured my data is already exposed, so this is not incremental. I got a date in mid September, so I will see what to do next then. I figure I am already exposed anyway, and the protection will be needed.

Now, I wonder if it's best to DIY on the credit freeze thing. The only thing is that it appears that a freeze needs to be redone every few months.

A "fraud alert" is valid for only 90 days. A "security freeze" remains in place until you lift it with your PIN code, which is provided when you place the freeze.

FTC: https://www.consumer.ftc.gov/articles/0497-credit-freeze-faq...

Experian: https://www.experian.com/freeze/center.html

TransUnion: https://freeze.transunion.com/sf/securityFreeze/landingPage....

it is really important to be aware that the duration of the freeze varies based on your state - it isn't always "until you lift it". I believe pennsylvania is an example where it is a 7 year term.

I just froze mine yesterday. Seems like the only way to stay somewhat proactive on your SSN being misused.

From what I read this morning, there are two types of freezes: one needs renewed, the other doesn't.

Warning: You waive your right to sue Equifax if you sign up for protection using this site.

This is crucial. I am concerned that #4 of the Terms of Use for this site does state that you give up your right to sue Equifax or join a class action lawsuit:

http://www.equifax.com/terms/

I clicked on the "Enroll" button before reading this (after giving my last name and six-digit social), and it told me to come back in a week to enroll. Now I'm wondering, did I just give up my rights?

If the hackers have any sense of humor they'll sign everyone up on their behalf.

Maybe. The TOS requires arbitration for disputes over the credit monitoring solution, but I don't read it as affecting suits over the breach itself. That said, IANAL.

It doesn't seem that way to me.

> As used in this arbitration provision, the term "Claim" or "Claims" means any claim, dispute, or controversy between You and Us relating in any way to Your relationship with Equifax, including but not limited to any Claim arising from or relating to this Agreement, the Products or this Site, or any information You receive from Us, whether based on contract, statute, common law, regulation, ordinance, tort, or any other legal or equitable theory, regardless of what remedy is sought. This arbitration obligation extends to claims You may assert against Equifax’s parents, subsidiaries, affiliates, successors, assigns, employees, and agents. The term "Claim" shall have the broadest possible construction, except that it does not include any claim, dispute or controversy in which You contend that EIS violated the FCRA. Any claim, dispute, or controversy in which You contend that EIS violated the FCRA is not subject to this provision and shall not be resolved by arbitration.

That is not the right Terms and Conditions. See this: https://trustedidpremier.com/static/terms

Note the retroactive nature of the terms. Open question: does this indemnify the parent company? (A CNN story says it may not, but is not definite: money.cnn.com/2017/09/08/technology/equifax-monitoring-services/index.html)

Whoops. I stand corrected.

No, you don't. Please point out where you think it says that.

I mean, let's think this through. You're not the only one that can read a contract and figure out this "scam". You think a NYT reporter can't do the same? And are you assuming Equifax thinks no one will figure it out? Because catching them pulling a stunt like that would probably make the front page.

Regardless, I may not be a lawyer, but the agreement doesn't say that.

Where's it say that? I read carefully, not carefully enough perhaps, but I just went back and I see no such mention. My enrollment date isn't until mid Sept anyway so is this something that comes up later?

Is that something equifax set up in response to this breach? Like an idiot, I punched in my info and it said "yep, you're probably affected" but did I just give my information to equifax or some scammer who's going to use that to scam me?

It's legit (you can follow the chain from the announcement on Equifax.com) but horrible practice. Should've been a subdomain - they're just training folks to fall for phishing scams this way.

That link didn't actually answer in the affirmative for me. It just dumped me into the enrollment workflow. It followed that with a message that my enrollment date would be next week and that I would receive no further reminders but I have to return on that day to complete enrollment.

For my spouse, your link answered that they weren't affected.

Being given an enrollment date is one of the "yep, you were affected" responses.

I would bet that someone told the engineers responsible for that site to avoid telling the user that Equifax might be liable for anything.

Reply on news.ycombinator.com