Hacker News Reader

Comment by stanleydrew | Hacker News Reader

> A credit report could be stored in an encrypted form so that it could be thawed only with a key held or managed by the consumer.

This is a nice idea. In practice the keys would have to be accessible via some kind of password to make them usable to ordinary people. And then those passwords would need to be re-settable via email or phone. There are security issues with that I guess, but we'd probably be better-off than we are now.

View on HN

This isn't true. Almost all "ordinary humans" manage to keep and use a pair of physical keys to there home, among other things. We only need a physical key with one simple piece of software that provides the key when asked for it, the user says yes by physically pressing a button on the key, and the key is "connected" (phy or wless). This isn't because ordinary humans can't use and manage protecting a key, it's a UX problem, and IMO a simple UX problem that hasn't been solved because it will destroy the major technological incumbents major source of revenue.

> Almost all "ordinary humans" manage to keep and use a pair of physical keys to there home, among other things

And what happens when someone loses their encryption key? This happens often enough with house keys that there are entire businesses set up for emergency locksmith services.

> And what happens when someone loses their encryption key?

DigitalLocksmith.io (YC S2018)

Jokes aside, this is why combining accessible and strong cryptography is hard. Certainly not impossible but hard. And historically, not at all within the competency of companies like Equifax.

I guess it couldn't be worse than no key, even if most people's passwords are terrible and poorly handled.

But presumably the credit agencies would need the key as well, to enable those resets and so they can add to the records, which probably negates much of the benefit.

There should be (authenticated) differentiations between what the credit agency does, what you do, and what third parties do.

One could have a signed audit log, and that's fine.

But no matter what you do the CRA has to be able to write to the data, and read from it to give it to third parties, and be able to reset passwords. AFAIK that requires that they have the keys to decrypt the data.

And when you fail to pay a debt to me, and I go to add it to your encrypted credit report, you provide the key at that point as well to facilitate this?

Also, with 2FA it's not so bad.

Reply on news.ycombinator.com