Hacker News Reader

Comment by AdmiralAsshat | Hacker News Reader

The fact that this was even being considered shows how pitifully little anyone learned from the Equifax breach.

Forget Equifax ... how about the Office of Personnel Management? People may well have lost their lives as a result. We may not know for decades.

https://www.lawfareblog.com/why-opm-hack-far-worse-you-imagi...

Oh, and the IRS has already been breached at least once. I'm not wild about waiting for the next one. Maybe government is not the best group to be holding your personal data.

https://www.nytimes.com/2015/05/27/business/breach-exposes-i...

All things being equal, the US government is simultaneously (1) the single most legitimate non-medical third party that needs to access my personal data, and (2) the single best entity to hold my data in terms of personal recourse. That's not saying much, but it is better than the open scorn and disrespect for my privacy that corporations offer.

The solution to government breaches is what it's always been: to make the breached data less valuable. Hacking the IRS would be significantly less appealing if we criminalized corporate use of SSNs as credentials.

Good point, gov has less reason to sell your data

Yeah, that federal deficit surely doesn't need any help getting paid down /s

However, this isn't to say that someone doesn't get the bright idea that they could fund some sort of slush fund with this.

Personal data sold to model and modify behavior. It's even more valuable to gov agencies, which spend spend drastically more than the private sector to get it.

Doesn’t stop usps for making money from spam, or from speed traps from being primarily dedicated to revenue from out of towners.

>the single best entity to hold my data in terms of personal recourse

what type of recourse are you talking about? Voting your representatives out?

That’s the slow way, but sure. I was referring to the fact that the government does occasionally react to negative press and roll back plans, as is evidenced by this case. I’ve yet to see Equifax change its security policies based on negative press.

I'm still not clear on what personal recourse you believe you have against a government. I wouldn't consider negative press a personal recourse.

What lesson do you think organizations learned from that breach? (As it relates to this article.)

The pattern I see is:

1. Company collects and stores private consumer info.

2. Company gets hacked.

3. Company share price unaffected.

4. Company sued in class-action lawsuit.

5. Company settles by offering discounted/free products to victims of the hack. ("A $50 value!") Lawyers make a few million.

Result: company gets more users' info as they sign up to claim the discounted products.

Sounds like a good deal if the company is too big to fail.

> Sounds like a good deal if the company is too big to fail.

I don't know why Equifax is too big to fail. But then again, I don't know why Goldman Sachs was too big to fail either.

Because they're our de facto fascist rulers. America is a republic only on paper.

How is Equifax a "de facto fascist ruler"?

Because our society would fall apart without a social credit system. How else are we going to judge flight risk, loan risk, apartment lease risk, employment risk, etc?

Flight risk is an FAA thing or a bail bondsman thing. Or are you using a version I haven't heard before? Similarly, I have no idea why Equifax would have anything to say about Employment Risk.

But, yes, they provide a service. And? There are two other major players who didn't fuck up who supply the same service.

> Similarly, I have no idea why Equifax would have anything to say about Employment Risk.

If you got hired for any job worth doing at any point in the last decade, chances are high that among the various background checks, your employer also ran a credit check on you.

> a bail bondsman thing

Why wouldn't a bail bondsman care about your credit history?

Exactly, the only lessons companies have learned from this is "How to survive, and thrive, from what should be a catastrophic failure".

Do you notice a pattern of state legislatures who sponsor privacy legislation not having online political support or donations from people who track patterns like this? If you're following it this closely, you should be following the political careers of the folks who work hard to pass laws that have teeth and laud them, no?

It's not just the potential for a breach. I didn't want id.me itself to have my information. It's ridiculous to have a private company, not accountable to the public, gatekeeping government services, regardless of how many certifications they have.

Hopefully id.me will get booted from other government agencies as well.

Reply on news.ycombinator.com