An 'Ethical Hacker' On Protecting Your Identity

qwqwss writes "Canada.com is running an article by Terry Cutler, a 'certified Ethical Hacker', who wants to get the word out to people on protecting their identities from a growing number of risks. The piece covers shopping online, keeping your personal information contained, and avenues of inquiry if your identity is stolen."

Comments

Hiding your credit report

[Riding Spinners]

1-888-567-8688

Call this one number to opt out of all three bureaus. You can protect yourself from identity theft by taking your name off of the credit bureaus mailing lists. The credit bureaus are one of the biggest offender when it comes to selling your name and information to the credit card companies who in turn send you all those pre-approved applications. One call to the Opt Out Request Line (for Equifax, TransUnion, Experian and Consumer Credit Associates) is all it takes to permanently remove your name from all marketing lists that the credit agencies supply to direct marketers. You can also opt for a two-year period, renewing your request at any time in the future.

Identity theft certainly happens on the Internet, but it's the old-fashioned cons that usually get your SSN and such. Put your paranoia in the right place. Please.

Re:Hiding your credit report

[Jah-Wren Ryel]

One call to the Opt Out Request Line is all it takes to permanently remove your name from all marketing lists that the credit agencies supply to direct marketers.

And get your name on the "high-value" target list they sell to everyone else, and the "has something to hide" list they sell to the NSA.

Seriously, it is so bogus that in order to "opt out" you have to hand over your personal info -- SSN, address, full name - to the very same people who are abusing that info in the first place. Somehow I just don't trust them to keep it safe and never figure out a new way to abuse it for their own gain.

A real opt-out list would be maintained by a 3rd party with contractual and legal penalties for distributing your personal info. Then the agencies would be required send their lists to the 3rd who would filter out the people who have opted out. That way, even if the agencies were to reverse engineer the list by comparing before-and-afters, they would not know anything about the people whom they missed because they were never on the first list, nor would they get any sort of corrective information (like updated address, corrected spelling of names, etc).

Hell, while I am dreaming, these lists would be opt-in to start with and we wouldn't have these problems.

Re:Hiding your credit report

[stefanlasiewski]

That number will allow you to opt out of pre-approved offers of credit who follow the rules of the big credit bureaus (worked great for me).

However, it will not prevent the credit bureaus from selling your name and information to other companies for other reasons, and it will not hide your credit report from anyone.

Also, some credit companies don't use the big credit bureaus, and will instead compile information from other sources. If you have a home loan for example; your name, address and value of the loan are available at some county and state offices.

Re:Hiding your credit report

[Anonymous Coward]

the government is poisioning your cheerios....the government is poisning your cheerios....the government is poisoning you

Damnint. He put his tinfoil hat back on.

Re:Hiding your credit report

[mls]

Sign up for the Direct Marketing Association's (DMA), "Mail Preference Service" (MPS), it will reduce the amount of unwanted mail coming to you, including credit card offers, and it really works. Use option 2, and print and mail your form, it only costs the price of a stamp. Don't pay to do so online, it takes time to process anyhow.

However, a few notes on the service:
1) It can easily take 6 months for a mailing list to be updated removing your address from it. This has to do with the frequency that marketers update and certify their lists for the USPS.
2) Some of those catalogs that you have been getting for no apparent reason that you like getting, they may stop. If you are an existing customer of a company, or have specifically requested to get a certain mailing, then you may still get that mailing.
3) If there are multiple last names in your household, you may need to submit the form multiple times with those combinations (there are some stupid list maintainers out there).

Re:Hiding your credit report

[paeanblack]

The root of the problem:

A: Hi! I'd like to open a line of credit.
B: What's your name.
A: John Smith
B: There are alot of John Smith's, could you be more specific?
A: John Smith from New York, New York.
B: Sigh. That doesn't really help.
A: Well, how then?
B: Give us a publicly known number that refers to you and you alone.
A: My Social Security Number is 012-34-5678
B: Fine. Now I need to prove I'm actually talking to John Smith, 012-34-5678
A: How?
B: Tell us a number that only you know and would never, ever, tell anyone else.
A: My Social Security Number is 012-34-5678
B: Meh, I guess that's good enough. Have fun with your new credit card.

Re:Hiding your credit report

[Jah-Wren Ryel]

the government is poisoning your cheerios....the government is poisning your cheerios

So that's why they float there, all lifeless in my milk!!!

Re:Hiding your credit report

[theshowmecanuck]

This might be American or North American only (at least one of the credit bureaus cover Canada and the U.S.). I would hazard a guess that other countries have different credit bureaus and different rules.

Re:Hiding your credit report

[Banjonardo]

Damn! That's MY social security number!

(substitute SSN for luggage for more laughs)

Re:Hiding your credit report

[Anonymous Coward]

If they didn't have that information in the first place, how could they sell it?

I believe that they ask for that information for two reasons.

1. To keep people from being able to easily unsubscribe other people.
2. So that they can match future incoming data with records of who should be excluded to avoid accidentally re-including you when they are not supposed to.

Re:Hiding your credit report

[Anonymous Coward]

If they didn't have that information in the first place, how could they sell it?

Duh! Once you give it to them in order to "opt out" now they have the info.

Re:Hiding your credit report

[Anonymous Coward]

People call BECAUSE those agencies have the information and have been selling it. So it is information they already have. They don't need you to give it to them.

Re:Hiding your credit report

[Captin Shmit]

In addition to that phone number, they now have an email address you can use to opt out, as well.

Just send your name, birth date, social security number, credit card number, PIN, and billing address to TAKE_ME_OFFA_LIST@CaptinShmit.com

Re:Hiding your credit report

[DaGoatSpanka]

Damn! That's MY luggage! Is it funny?

Re:Hiding your credit report

[ClickOnThis]

Damn! That's MY luggage! Is it funny?

Well, it is (sort-of) if you saw this movie.

Re:Hiding your credit report

[Eivind]

Thats pretty close to how it works in Norway. For marketing of any sort adressed directly to you. There is a single govnerment-maintained list where you can opt to not receive direct marketing.

Companies that do direct marketing send their lists in, and get them back without those persons who have opted out. They learn nothing new about you in the process, other than the fact that you've opted out.

For electronic marketing (email, sms, fax) it's opt-in rather than opt-out. In other words, they cannot legally do it unless you've given prior, informed consent to that. The logic is that this in this type of marketing, the recipient typically pays a large part of the cost. Marketers are less likely to abuse say paper-based marketing as that actually costs them to print and distribute. (compare the quality of the marketing in the average paper-based marketing and the average spam you receive to see what I mean..)

For unadressed "distributed to all" marketing there's a small sticker you can put on your mailbox, and you won't get any.

In short, you can eliminate receiving any marketing by following 3 simple steps:

• Register yourself to opt-out of direct marketing. (one phone-call or one visit to the opt-out list.
• Do not agree to receive direct marketing when companies ask.
• Get a small sticker and put it on your mailbox.

Re:Hiding your credit report

[Jah-Wren Ryel]

People call BECAUSE those agencies have the information and have been selling it. So it is information they already have.

No, you are wrong.

I use a bogus name for my telephone directory listing (it is like getting an unlisted number, but better because it is free and it avoids having my real name on the "list of people with unlisted numbers"). I get tons of snail-mail marketing for this bogus person, I also get plenty of sales calls asking for this bogus person by name.

There is no way the credit marketing agencies are giving away this info because this person does not exist and the name was made up on the spot for the telephone listing - they certainly have no SSN and my real name is the one used for the bills so there isn't even any "credit history" to the name.

So you see, you are 100% demonstrably incorrect in saying that the sales contacts are due only to the credit marketing agencies. Even if this bogus person somehow did aqcuire an entry in their databases, there is no way for me to remove them because the person has no SSN to give them.

Re:Hiding your credit report

[berzerke]

...I use a bogus name for my telephone directory listing (it is like getting an unlisted number, but better because it is free and it avoids having my real name on the "list of people with unlisted numbers"). I get tons of snail-mail marketing for this bogus person, I also get plenty of sales calls asking for this bogus person by name...

I've done that [used a bogus name] and that name has gotten pre-approved credit card offers in addition to the other stuff you mention! Every time I see a story about how much banks lose annually to CC fraud, I just laugh.

Re:Hiding your credit report

[4of12]

A real opt-out list would be maintained by a 3rd party with contractual and legal penalties for distributing your personal info.

I've often maintained the most powerful tool would be for ordinary citizens to claim copyrights on correlated collections of personal information. Then, individuals would be permitted to pursue all the penalties that the *AA organizations do for unauthorized distribution of Britney Spears songs and Owen Wilson movies.

Re:Hiding your credit report

[Anonymous Coward]

I have a friend that used bogus names for various bills/subscriptions. When he was applying for a loan on his house he was asked to explain why he had so many aliases. When he looked at a copy of his credit report it said somthing like:

Name, Real
AKA Name, Fake
AKA Name, Other
AKA Name, YAFname ...

They had found and correlated almost every name he had ever used. Even down to one he had used once for a magazine subscription...

Re:Hiding your credit report

[cayenne8]

"I use a bogus name for my telephone directory listing (it is like getting an unlisted number, but better because it is free and it avoids having my real name on the "list of people with unlisted numbers"). I get tons of snail-mail marketing for this bogus person, I also get plenty of sales calls asking for this bogus person by name."

I used to work for a company called Acxiom , and they are a good bet to be where this info came from. I used to work on a project where we got phone books from all over the nation, and cut the binders off, ran through an OCR, and then sorted into a databases. They have databases from all sources and try to 'clean' them all out...they get info from Post Office Change of Address forms...states that sell drivers license info....They work closely with a couple of the credit companies, they might even partly own Trans Union, I'm not sure the exact assoc. they have with them.

But, yeah, I do the same thing for the phone books, and get amused when I get junk mail to that false name...knowing where it came from. When telemarketers used to call asking for that name, was funny since I knew where they got it from.

Re:Hiding your credit report

[gothzilla]

"And get your name on the "high-value" target list they sell to everyone else, and the "has something to hide" list they sell to the NSA."

Paranoia -- The Word

Paranoia is a term used by mental health specialists to describe suspiciousness (or mistrust) that is either highly exaggerated or not warranted at all. The word is often used in everyday conversation, often in anger, often incorrectly. Simple suspiciousness is not paranoia--not if it is based on past experience or expectations learned from the experience of others.

Paranoia can be mild and the affected person may function fairly well in society, or it can be so severe that the individual is incapacitated. Because many psychiatric disorders are accompanied by some paranoid features, diagnosis is sometimes difficult. Paranoias can be classified into three main categories--paranoid personality disorder, delusional (paranoid) disorder, and paranoid schizophrenia.

Re:Hiding your credit report

[Jah-Wren Ryel]

Paranoia -- The Word...

Delusional Disorder

Psychiatrists make a distinction between the milder personality disorder described above and the more debilitating delusional disorder. The hallmark of this disorder is the presence of a persistent, nonbizarre delusion without symptoms of any other mental disorder.

Delusions are firmly held beliefs that are untrue, not shared by others in the culture, and not easily modifiable. Five delusional themes are frequently seen in delusional disorder. In some individuals, more than one of them is present.

The most common delusional theme is the persistent belief that jokes posted to weblogs such as slashdot are in fact accurate representations of the posters' deeply held beliefs. Colloquially referred to as "clueless," these patients often find themselves the butt of jokes without being able to comprehend why everyone is laughing at them.

Wrong title

[Anonymous Crowhead]

It should be called "Common Sense 101". This type of thing should be posted on, oh I don't know, maybe blogs that old people read?

I don't even have to read the article...

[Anonymous Coward]

The trick to not worrying about identity theft is to have horrible credit and just about $0 in the bank. I've never got to worry about somebody using my identity. Hell, my identity doesn't even do me any good.

Re:I don't even have to read the article...

[ConsumerOfMany]

This is also a great way to make sure you never have a girlfriend or not have the choice to be one of those old people greeting me at walmart when they should be playing golf...

Re:I don't even have to read the article...

[kfg]

Somebody stole my identity once, but a week later I found it lying on my doorstep with a note of sympathy pinned to its blanket.

KFG

Re:I don't even have to read the article...

[Anonymous Coward]

> The trick to not worrying about identity theft is to have horrible credit and just about $0 in > the bank. I've never got to worry about somebody using my identity. Hell, my identity doesn't
> even do me any good.

Hey, I keep *hoping* someone will steal my identity. I ain't taking it back unless they PAY me.

Re:I don't even have to read the article...

[FLEB]

So then you get your identity stolen and have to deal with false debt and overdraft fees.

Re:I don't even have to read the article...

[Anonymous Coward]

"Somebody stole my identity once, but a week later I found it lying on my doorstep with a note of sympathy pinned to its blanket."

Apparently it wasn't that bad. They didn't attach any cash.

Re:I don't even have to read the article...

[kfg]

No, but the blanket was new, although I assume they didn't use their own identity to charge it, so I'm not sure that scored major points on karma.

KFG

Re:I don't even have to read the article...

[cayenne8]

"This is also a great way to make sure you never have a girlfriend..."

I hear ya, those are quite expensive. As the saying goes, "there is no such thing as a free ride"...

:-)

This article is too Canada-centric

[Neil Blender]

Here in the backwater US, you can get your credit report for free three times a year at http://annualcreditreport.com/ - Check it every four months.

Re:This article is too Canada-centric

[Anonymous Coward]

Here in the backwater US, you can get your credit report for free

The article is wrong. You can get your credit report for free in Canada too.

Re:This article is too Canada-centric

[curecollector]

I'm glad people already modded this informative (I guess that's a no-brainer), as I just used my last mod point prior to reading this. I just wanted to say "thanks", as a lot of the sites that claim to offer this info. tend to require enrollment in some program that I have no interest in... and I never actually think of looking this stuff up, at least not when I am near a computer...

To those who haven't checked out this site: no matter the outcome, it's ~10 minutes very well spent. Check it out.

Re:This article is too Canada-centric

[Bryansix]

I got all of my reports except Equifax. The whole process fails when I get to them. Does this happen to anyone else. I think out of all the credit reporting agencies this one is the most difficult to deal with.

Re:This article is too Canada-centric

[Anonymous Coward]

instead of too American-centric like everything else.

Re:This article is too Canada-centric

[Anonymous Coward]

I've been told that checking your report that often is actually a red flag and a detriment to your credit rating. I assume this isn't true; anyone know for sure?

Re:This article is too Canada-centric

[Andrewkov]

Where? I've been paying Equifax for mine..

Re:This article is too Canada-centric

[Anonymous Coward]

I would recommned not checking your credit report that regularly. I used to work for a Mortgage Company; one day we received an angry phone call from a man who had been refused credit and said we "fucked him". Apparently someone had made a mistake and accidently checked his credit 4 times (I'm not sure how you do this). He could no longer take out a loan because having too many credit checks on your credit history is an indication of bad credit. Basically people with lots of credit checks correlate to people who default on repayments so having too many will reduce your score. Incidently we refused him a mortgage too... poor bastard.

Re:This article is too Canada-centric

[Roofus]

It does not affect your score. From this place:

# Does every inquiry affect a credit score?
# Anytime your credit report is pulled - including when you order a copy of your credit report directly from the credit reporting agency - an inquiry is added to your report. Only some of those inquiries appear to creditors and therefore impact your credit score. Inquiries that were made for credit cards or loans for which you applied will be shown to creditors and are counted in a credit score. Inquiries added when you request a copy of your credit report or when an employer checks your credit report do not appear to creditors. We are pulling your credit report on your behalf, so the inquiry on your credit report will not be shown to creditors and will not affect your credit score.

When you request your credit report directly from Experian, it shows you ALL inquiries. This is done so you know who has been looking at your credit. Some inquiries on your report are accompanied by a description of why the report was pulled.

Re:This article is too Canada-centric

[Roofus]

Dude, you're full of it. Only some credit checks appear on your record are available to creditors. Ones done yourself are not. Ones done by mortgage companies do.

If someone from your company pulled his credit multiple times, *you* did fuck him.

Re:This article is too Canada-centric

[plague3106]

Um, perhaps you're not aware.. but annual means 'once a year.' So you can get your credit report free ONE time a year...

Re:This article is too Canada-centric

[Anonymous Coward]

You can get one credit report from each of the three agencies once per year. Get a report from one agency, 4 months later from another, 4 months later from another. Rinse, Repeat. You don't have to get reports from all three agencies at the same time.

Re:This article is too Canada-centric

[cayenne8]

"Where? I've been paying Equifax for mine.."

I believe this one is the official one. I got it from a reference I found on the FTC site . I've done it before, and is about time for another one...but, I think you only get one free one from each credit bureau annually.

Re:This article is too Canada-centric

[Anonymous Coward]

Yeah of course I am full of it. How dare I give an example that's applicable to the situation. WHAT A FUCKING ASSHOLE.

What? I made a mistake! Well shit I should just end my life.

Fuck you.

Re:This article is too Canada-centric

[Fallingcow]

I filled out the forms for two of the three companies on there a couple of months ago. Neither one seemed to think that I exist, so I stopped trying :(

I don't want to be a killjoy, but...

[winkydink]

...was there really anything mentioned in that article that your typical /. reader didn't already know?

Re:I don't want to be a killjoy, but...

[pseudorand]

Well, I'd never though of always typing in the wrong pin first to verify that the ATM is actually connected to the ATM network. But I'm also not sure I believe the keylogger keypad connected to wifi thing either. I imagined ATMs were tamper resistant such that the bank would be notified if anything was disconnected.

Re:I don't want to be a killjoy, but...

[ericlondaits]

Here in Argentina ATM fraud is common.

Saboteurs install a small keycard reader right next to the keycard reader at the ATM's door, so when you slide your car to enter, both readers get it. Recommendation: open the door with any other card, since the reader only checks for a magnetic strip and not for a valid card.

As for keypads, they usually install a different keypad over the regular one, which logs key presses and also activates the regular keys, so you notice nothing. The newspaper once showed one of this keyloggers, which had some sort of memory (flash perhaps) and ran on batteries.

Re:I don't want to be a killjoy, but...

[pilsner.urquell]

From the article:

In recent years, card duplication has been on the rise so, for instance, if at a gas station the card reader was switched out for a writer, your card could be copied. While the particle strip on the back of the card does not contain your PIN, the thieves could try to find a way to get it. In fact, the latest technology they are using is an ATM keypad with a keylogger built in that record your password.

I prefer a more passive approach. Most, if not all ATM, cards can be used the same as a credit card, i.e. Sign for the purchase instead of using a PIN number. This is accomplished by choosing credit on the keypad or telling the to charge the purchase as credit when he asks debit or credit. This accomplishes a lot of things.

1.Keeps prying eyes from seeing your PIN number. BTW, if someone does steal your PIN and uses you PIN the bank will take the position that you make the purchase and you must prove otherwise.

2.Store clerks are suppose to check for a picture ID before accepting a credit card for a purchase but if they don't it's not your problem.

3.Banks must prove that you signed for the merchandise if if you use the credit option and if you didn't sign for something the bank will have a harder time proving you did.

Re:I don't want to be a killjoy, but...

[karmatic]

Came across one of these locally - I only noticed it because the adhesive had come loose.

The device was a little over a half inch thick, and had a slot through which the card went. This device was placed over the normal ATM card slot. When you put your card in, it got read by the device, and the ATM sucked it in and read it there.

I found out from the bank that the PIN was read through a hidden camera nearby. The "nice" thing about a setup like this is that no change is made to the ATM itself. To add insult to injury, even if you type in the wrong PIN first, they still got both on camera, and can pull the mag stripe data from the memory in the device.

Re:I don't want to be a killjoy, but...

[Anonymous Coward]

2.Store clerks are suppose to check for a picture ID before accepting a credit card for a purchase but if they don't it's not your problem.

Absolutely NOT. I refuse to show my ID just to make a purchase with a credit card.

Re:I don't want to be a killjoy, but...

[Leebert]

Recommendation: open the door with any other card, since the reader only checks for a magnetic strip and not for a valid card.

Find where someone is installing a retail POS system. Many of them come with "test" credit cards. Installers just toss them in the trash. I have test Visa card in my car presently, as a matter of fact.

Re:I don't want to be a killjoy, but...

[ericlondaits]

What this criminals do, allegedly, is to match the swiped card with the captured PIN... so if you use a different ATM or credit card from the one you're about to operate with, you're safe. I myself have ATM cards for three different banks, and two different credit cards, so it's not much trouble. I sometimes swipe a pre-paid arcade parlor magnetic card, also common in Argentina (you can get them for about 1 argentine peso, which would be like 30 american cents)

Re:I don't want to be a killjoy, but...

[cayenne8]

"Recommendation: open the door with any other card"

Never had to swipe a card just to get into a bldg. with an ATM in it. Heck, most of the ATM's I go to aren't indoors at all....they are on the outside wall of the bank. Many are in convenience stores or grocery stores too. Do they all have 'special' sealed buildings for ATM's in Argentina?

Re:I don't want to be a killjoy, but...

[cayenne8]

"Most, if not all ATM, cards can be used the same as a credit card..."

That's why I specifically as for an ATM only card, I refuse to have a 'debit card'. With a true credit card, if stolen, you can report it and you are only liable for a small amount...with a stolen debit card...the money is GONE from your bank immediately, and stays gone till you can prove it is a criminal. I don't like that ascpect of it. I like to use cash when I have it, CC for when no cash on me (but pay off in full each month).

"2.Store clerks are suppose to check for a picture ID before accepting a credit card for a purchase but if they don't it's not your problem..."

Not sure where you got this. This is not a rule by the credit card companies...these policies are usually enacted on a store by store basis, but, no one is required by law or by CC companies to check any id on a credit card transaction. If that were the case, you couldn't purches by CC online...kinda hard to show that picture id to Amazon.com you know...

:-)

Re:I don't want to be a killjoy, but...

[ericlondaits]

A few ATMs are completely outdoors, but most are inside of the bank building, in a small area accesible through the street (size varies). That way, when the bank is closed you can still get in the ATM. We have lots of banks here, BTW.

Re:I don't want to be a killjoy, but...

[memprime]

At most places, if your total comes to less than 20-25 dollars, even if you choose credit, they don't even require that you sign anymore, i.e. Starbucks, Walgreens, etc.

Re:I don't want to be a killjoy, but...

[webwidejosh]

I believe this is for mastercard/visa, stores may not require ID. However, I do think that Discover may allow store employees to require an ID check.

Re:I don't want to be a killjoy, but...

[swv3752]

Up North, it was common for ATM's to be in the entry way of a bank. The outer door was unlocked with the ATM card to keep out bums and provide a little security for patrons. I remember in the 80's in MA, there wasn't a bank with an ATM accessible to the elements. In the 90's in NY, there were few banks that had the entry way ATM and one on the outside. Now in FL, every ATM is outside unless it is located inside a mall or supermarket.

Re:I don't want to be a killjoy, but...

[cayenne8]

"...in FL, every ATM is outside unless it is located inside a mall or supermarket."

Yeah, I'd seen a thread like this before, and I think the conclusion was, this is mostly a geographical thing, at least in the US....they do them indoors a lot up north, due to the long term freezing weather....

Not so much a problem down here...

Re:I don't want to be a killjoy, but...

[cayenne8]

"I believe this is for mastercard/visa, stores may not require ID."

No, I'm not talking about department store credit cards, I am talking about Visa, Mastercard, Amex...etc. And no, none of them require anyone taking one of their cards to request ID be shown. If a store accepting a major credit card, asks for ID, then it is the store's policy, not the major credit card companies'....

Re:I don't want to be a killjoy, but...

[webwidejosh]

Ah, I was speaking of Discover which I would consider a major credit card company. My understanding however is that VISA/MasterCard actually specify in their merchant agreement that the merchant cannot REQUIRE a credit card. I'm only about 92% sure of this as fact, and as far as Discover card I'm not sure but suspect they do not make this restriction.

Re:I don't want to be a killjoy, but...

[snerdy]

I'd never though of always typing in the wrong pin first to verify that the ATM is actually connected to the ATM network.

This sounded like a good idea when I first read it, but now I'm having trouble seeing how it would help.

With your first entry (the false/incorrect PIN) both an authentic ATM and a fake ATM keylogger device would return the result "Incorrect PIN," right?

With your second entry (the true/correct PIN) the authentic machine verifies that the PIN is valid and proceeds with your ATM transaction while fake machine would still simply return the result "Incorrect PIN."

It's not like the fake machine was going to ever complete a real transaction for you!

So, how does one identify the fake ATM keylogger device using this "false PIN first" scheme? How does one distinguish the fake machine from an authentic but broken machine? If your answer is that when the ture/correct PIN is rejected you should call your bank, why bother with the false PIN to begin with?

I suppose this scheme could help to identify a fake ATM before making a deposit (if the machine accepts your false PIN, don't put your deposit into the machine), but I fail to see how it would serve to identify devices set up to capture your PIN and the information on the magnetic strip on your bank card.

Re:I don't want to be a killjoy, but...

[pseudorand]

Good point. The false pin first method would help with situations like the one described in another reply where they simply put an entire false machine that actually despenses money. That's another pretty hard to believe story though.

too much work.

[konigstein]

Just about all the information the "certified ethical hacker" is putting out is nothing new. Awareness is all good and well, but the steps to protect your identity require more work and understanding than the average joe is willing to commit to. Laziness is the trait that identity thiefs hope for, and usually find.

Until the current standards change or are more rigorously enforced, Identity theft will remain one of our electronic cultures downfalls. And now that pandora's box has been opened on identity theft, I doubt a system will be made that could keep even the most determined from gaining your identity.

This is pretty much what I do

[WillAffleckUW]

Minor methods like:

a. shredding the account numbers and names/address on your bills or mail.

b. taking out the recycling only on recycle day, and making sure none of it contains identifying materials, but that all those are shredded and then mixed.

c. not taking too much ID with you.

And realizing that you're being phished. I learned a lot of techniques in the Canadian Armed Forces, when they would try to get information out of our systems by trying to pretend they were from someplace that just needed info, or wanted to verify something.

Never trust email, don't trust phoners, and never action things that you didn't originate.

And keep your hand over the other one (shading it) when entering your PIN.

Canada.com is a website for daily newspapers in Canada, FYI. Always right-click to inspect any links and ensure they go to the correct location before clicking them - and always use URLs you made yourself to access your banking and credit info.

Now, I've got an underwater tunnel to sell you if you don't want to follow that advice, and I'm sure other people will tell you about all the lotteries you've won, and how a rich religious minister left you money in [NAME OF COUNTRY] ...

Re:This is pretty much what I do

[Anonymous Coward]

Should we always use IP and never DNS?

But you do raise an interesting point about web access...it's something I've been mulling over:

How many of our currently amalgamated uses for something such as the web are actually very pointless and wrong? Wouldn't we be better served by a frill-less, separate protocol for connecting to banks? And so on.

Thanks.

Re:This is pretty much what I do

[moeinvt]

I've never understood the allure of plastic money and ATMs, especially now that the risks involved in using them have increased so dramatically.

Why not go to the bank every couple of weeks, deal with a real live teller who asks for your ID, and conduct all of your retail transactions with cash? I always see people standing in line at the ATM between 11:00 and 1:00, waiting to get $10 for their lunch. I'm often standing behind people in the "express" lane at the grocery store watching them swipe cards and sign their names for $10 worth of stuff. Ridiculous.

Keep all your credit cards, ATM cards, SS cards, etc. at home until you absolutely need them. It would suck to lose the $100 in cash, driver's license and business cards you have with you, but it makes sense in limiting liability.

Re:This is pretty much what I do

[plague3106]

I pretty much never use cash anymore, and haven't had a problem using my check card for everything. I've never encountered a rogue ATM, and if paying by telling the cashier credit, VISA protects you against fraud.

The grocery store I use has a very quick link to the network; using my card + pin is typically faster than handing the cashier cash and waiting for him to count change.

I even lost my card once (forgot to get it out of the ATM). Fortunatly I found out pretty quick, but the card was gone (the machine didn't eat it, because I never answered the prompt 'do you want another transaction.'). My credit union immediately canceled the card and sent me one with a new number.

Limiting your liability makes sense, but be aware that ther are protections in place which do so on your behalf already. Most of your liability comes from those CC offers and throwing away personal information. My wife hates that I have all my receipts, bills, bank/cc statements from 2001, but OTOH no one has any of the numbers from my cards.

Re:This is pretty much what I do

[cayenne8]

"I've never understood the allure of plastic money and ATMs, especially now that the risks involved in using them have increased so dramatically."

Well, there's a few good reasons. First, I've often seen banks that will give you 'free checking', no monthly or per check fees if you have direct deposit, and ONLY use ATM's. Basically they charge for human interaction.

Secondly...well, there's a pretty high danger of carrying large amounts of cash on you. You can lose it, but, more commonly, it is not a good thing to do, to be flashing a ton of cash all the time...makes you a good 'mark' for muggers.

Also, I never know how much money I'll need for the week...some weeks, not that much, but, what if I feel like eating out or hitting the bars a few nights of the week...what if I come across a great deal on a used pinball machine or something...I'd hate to lose a good deal just because I didn't have enough cash on me.

Now, all that being said...I'm changing a bit...I don't like the tracibility that CC's put on you...and more and more, I'm carrying cash for as much as I can...I just try to be careful about flashing it about too much...but, in the past, I just pretty much used my Amex for every purchase that month, and then, just paid off one bill in full for my expenses...and usually online, so I didn't even have to write a check for it...just like cash, but, without the hassle of finding a nearby ATM and keeping up with wads of cash every day...

Get your CEH creditial now!

[Itninja]

Apparently, 'certifed ethical hacker' is an actual cert one can get. But I don't think I would the term 'hacker' to appear anywhere on my resume. Unless I was trying to get a job with some black hat pseudo legal firm...that'd been sweet.

Re:Get your CEH creditial now!

[mordors9]

What boxen do you have to hack into to, to get the certificate.... oh, never mind, downloading a copy now, just have to change the name ;-)

Re:Get your CEH creditial now!

[JavaLord]

It sounds better than ethical lamer.

Re:Get your CEH creditial now!

[infosec_spaz]

Uh...You would be suprised about how in demand this "Set of Skillz" is right now!!! No, I do not have it, I depend on knowledge and know how when it comes to this kind of thing :o)

Re:Get your CEH creditial now!

[Drathus]

Apparently, 'certifed ethical hacker' is an actual cert one can get. But I don't think I would the term 'hacker' to appear anywhere on my resume.

I've actually taken a CEH prep course, but that was because my boss had been pressuring me to take a class, and it was a week away from work paid. The information it covers is very basic, the vast majority of it is based on the "tools" used. They spend a bit of time covering how you're supposed to operate as a CEH, but there's so much material that even with five full day classes we were rushed when moving through it all.

Buy a shredder

[Colin Smith]

Hey, it's fun to shred stuff...

Just don't ever allow your kids to shred anything, even once. If you do, you may find yourself re-filling your taxes, one piece of sellotape at a time.

Re:Buy a shredder

[kfg]

Showing your kids how to use the toilet is a time of great cognative dissonance.

I know my own mom would dearly like to get her watch back.

KFG

Re:Buy a shredder

[Incadenza]

Just don't ever allow your kids to shred anything, even once. If you do, you may find yourself re-filling your taxes, one piece of sellotape at a time.

Or have a bunch of fanatic Iranian students do it for you. I have a copy of Documents From the US Espionage Den, volume 5 [6 MB PDF] that is a quite good illustration of why US embassies have been incinerating and not shredding their paper waste since 1979.

well..

[Anonymous Coward]

Umm ..call me paranoid.. how do I know that number u posted is not set up by some guy to get people's info?

That said, I did verify on google.. and it seems fine.

Re:well..

[Pollardito]

how do i know you verified it on Google and aren't just a co-conspirator with the person that posted the first number?

Re:well..

[BaltikaTroika]

The phone number works. Some Nigerian guy answered the phone. After taking my personal information, he offered me this great deal where I just have to let him use my bank account and he'll give me 40% of some dead guy's 20 million dollar estate.

Re:well..

[Anonymous Coward]

He's cool, I checked him out on Google. He seems legit.

Re:well..

[Anonymous Coward]

Ah ah ah...

He may be cool, but you're not! How do we know you're not in cahoots with him who's in cahoots with the phone number guy?!

Mr Trolley,
Trolls, Inc.

Re:well..

[holdenholden]

Did you mean you googled him or you Googled him?

Re:well..

[bcat24]

I looked him up on Google, I don't think he's in cahoots with him who's in cahoots with the phone number guy.

Re:well..

[ESqVIP]

I looked him up on Google, I don't think he's in cahoots with him who's in cahoots with the phone number guy.

So you just admitted there's someone in cahoots with the phone number guy, eh? I KNEW IT!

Online identity theft = FUD?

[porkmusket]

Does anyone else think that online identity theft is exaggerated? I mean, I have seen stats for identity theft in general, but not specifically for online identity theft. It strikes me as an insurance company/bank/credit card company ploy to make money. They take the internet, something a lot people don't understand, paint it as a major source of fraud, and ask you to pay $10/mo for their 'identity protection' services.

I have a feeling that the mjaority involvement of the internet in these crimes is as a vehicle for the transmission or cracking or databases made available by poor security practices.

Re:Online identity theft = FUD?

[Anonymous Coward]

This is true. You are more likely to have your neighbor steal your mail and get your credit card information. Once they have that they can go on a shopping spree. All they have to do is make sure they get home from work before you. I know four people who have had this happen in the last year. They don't find out until they got their bill with all of the extra purchases.

Re:Online identity theft = FUD?

[EtherMonkey]

I do security and compliance for a big corporation (100k+ employees). I am not aware of even one case of identity theft via the Internet. I am aware of many cases of fraud via the Internet, where a persons' credit card or bank account number was stolen and/or misused. I suspect that, as pointed out elsewhere, statistics for fraud and identity theft together. This may be because of legislative constraints that includes, and rightfully so, credit card account information as protected personal/financial information. But there's also no doubt that higher numbers makes for more sensational news stories and more compelling selling points for those $10/month protection services.

100% of the identity theft cases and about 30% of the fraud cases I've helped out with or heard of were not due to any use of the Internet (even though many of the unapproved charges were made to Internet resellers). Disgruntled/dishonest employees, ex-spouses and boyfriends/girlfriends, and neighbors/acquaintances are, in my experience, the top three perpetrators of identity theft. Then there are the randoms: the car salesman that puts through auto loans in other customers' names; the 'crew' that dumpster-dives tax preparation offices and then sells the identities to illegal immigrants.

If you are reasonably careful and avoid 'risky behavior' on the Internet you are fairly safe from fraud and identity theft. Never give your SSN or birthdate to anyone over the phone, and only the bare minimum as absolutely required on a face-to-face basis (i.e. banks, financial institutions, employers, medical as needed for insurance processing). For anyone else, just make up a SSN and birthdate: there's no point in arguing with people too stupid to understand that there's no legitimate use for that information.

Never pay for anything by check. ACH fraud is trivial and is probably the most common scam because of the lack of controls and authentication. It can also be the most damaging because, unlike credit-card fraud, the money is gone from your account and you have to convince the bank to put it back. Any organization with either an ACH merchant account with a bank or via one of hundreds of ACH 3rd-party processors can take money from any US bank account with nothing more than your bank's routing number (public information) and your account number (printed on every check). I have been hit with ACH fraud a few times and now order only a one-year supply of checks and then open a new account when the checks run out.

When paying on-line or over the phone always use your credit card company's 'temporary account number' service. These are time-limited and, optionally, amount-limited account numbers that do not reveal your permanent credit card number. You can set limits for how long they are valid (from one month to one year) and how much total can be charged. Most MasterCard and Visa providers offer this service. You have to be Internet-connected to generate a new number. (American Express pioneered this service but then discontinued it shortly before introducing their enhanced security service, for an extra fee). An added benefit is if someone does make fraudulent use of the temporary account number you know who is at fault for leaking your information.

If you have the ability, use a separate e-mail address for each financial institution and each vendor you use. If you have your own domain name you can usually configure "catch-all" email forwarding so any incoming email without a matching mailbox gets forwarded to a specific address. This helps identify phishing attempts because you will see email supposedly from, e.g., Citibank Security come into your "ebay@example.com" address instead of the proper "citibank@example.com" address. An added benefit here is being able to identify who is selling your email address (surprisingly, very few).

And if you deal with illegal, semi-legal, illicit or other fringe sites (porno, high-yield investing, paid-to-surf/email, Ponzi, pirate software/music/video/games, or an

Re:Online identity theft = FUD?

[Urox]

My identity was stolen via the internet. Not by my doing, but by my bank's doing.

My bank (a rather large one) was hacked. Later, that information was used in connection with the Russian mob to commit internet fraud.

And my bank has not been the only one out there that has been hacked.

Re:Online identity theft = FUD?

[EtherMonkey]

And then the bank is at fault for failing to protect your confidential personal information from unauthorized disclose, and they are liable for all the costs and expenses associated with the correction of your resulting identity theft, possibly including indirect damages due to the higher intrest rates you will be forced to pay as a result of the identity theft, legal fees to correct the issue, lost time from work or your job (even if you used paid leave instead of unpaid leave), etc.

If you have not already done so you should consult with an attorney.

Get a Prepaid Master Card

[mfh]

That's what I did. Now if some joker gets my numbers, I can simply dump the card and get a new prepaid Master Card. Pfffft, eat that h4xx0rz! ;-)

Re:Get a Prepaid Master Card

[golgoj4]

But what happens when they flag you as a terrorist for using pre-paid credit cards too much?

Re:Get a Prepaid Master Card

[ultranova]

That's what I did. Now if some joker gets my numbers, I can simply dump the card and get a new prepaid Master Card. Pfffft, eat that h4xx0rz! ;-)

Or just use cash. You know, the green rectangular pieces of paper and the small round metal things ?

Re:Get a Prepaid Master Card

[jacobw]

Or just use cash. You know, the green rectangular pieces of paper and the small round metal things ?
Cash is even worse, because every dollar bill has your picture printed right on it.

...oh, come on. Like I'm the only person here who looks exactly like George Washington.

Re:Get a Prepaid Master Card

[ultranova]

...oh, come on. Like I'm the only person here who looks exactly like George Washington.

You poor bastard, sharing the face of a known insurgent and terrorist :(. Maybe you should consider plastic surgery, least you get confused with this infamous rebel who used tactics of harassment and attrition and kept his troops hidden - a strategy favored by terrorists !

Yes, this infamous leader of the treacherous insurgency which murdered several British soldiers - wait, you use dollars so you're an American, so Washington would be a hero to you, right ? Sorry, my bad.

How does one judge "ethical"?

[EmbeddedJanitor]

Robin hood: hacks the rich to give bandwidth to the poor? Only hacks on weekdays, never on a Sunday?

Right and wrong are always blurred and I can't see how "ethical" can really be defined.

Re:How does one judge "ethical"?

[Anonymous Coward]

No, "ethical" is determined by questions 7, 12, and 30-42 of the ethical hacker certification test. ;)

Re:How does one judge "ethical"?

[rohan972]

Something like: has a knowable standard of behavior and lives by it.

It's about predictability. I have friends with a different standard of ethics than I do, but that's ok, if I know what it is, I can know what to trust them with.

Not a conclusive definition, but that's a fair part of how I assess ethics.

Re:How does one judge "ethical"?

[plague3106]

If you believe that people have rights (and that belief can be derived logically), then ethical behavior is behavior which does not violate the rights of another.

similar tips for highly mobile (homeless) people

[xeno]

It's shameless self-promotion, but I just wrote an article on computerworld about basic security and privacy issues for the homeless and/or other perennially wandering folks. There's a little coverage about identity establishment there too, along with general protection of information and resources.

-Jon

Simple: post AC!

[mangu]

I can't really understand why /. always has these news about protecting one's identity, but when someone wants to post a comment and remain anonymous they call him a "coward"...

Re:Simple: post AC!

[Frightening]

Well I certainly hope your real name isn't "mangu", and that your CC number is different from 126918.

The reason the Anonymous are cowardly is because they refuse to show even their funny little cyber-nicknames when they post vitriolic comments. They don't want to be known because they usually know they are wrong, and will lose karma. Some cowards are very funny however and get modded up considerably. I suspect taco and others post anonymously, don't you?

Re:Simple: post AC!

[mangu]

The reason the Anonymous are cowardly is because they refuse to show even their funny little cyber-nicknames when they post vitriolic comments.

And others are reluctant to let the world know that, let's see, from two randomly picked comments of yours, you think "pacifism and veganism" are "philosophically flawed nonsense" and you want Pluto to be considered a planet because you don't know how to pronounce "Quaoar". Well, I must say I agree with you on both counts, but sometimes one wants to make a controversial argument without disturbing our very anonymous little cyber-nickname.

Privacy is a funny thing, we value it even if it's valueless. What does anyone care if you masturbate with your right or left hand? Who would want to see a video of you picking your nose? Apart from the goatse guy, I know of no one who wants his most intimate self being known to the world.

I don't know if you are old enough to remember a rock band called "Pink Floyd", but they had an album in 1979 with a song called "The Happiest Days of our Lives" that went like this:
When we grew up and went to school
There were certain teachers who would
Hurt the children anyway they could
By pouring their derision
Upon anything we did
And exposing every weakness
However carefully hidden by the kids
But in the town it was well known
When they got home at night, their fat and
Psychopathic wives would thrash them
Within inches of their lives

The next to the last song in the album ends like this:
But my friend you have revealed your
Deepest fear
I sentence you to be exposed before
Your peers
Tear down the wall

Re:Simple: post AC!

[Frightening]

but sometimes one wants to make a controversial argument without disturbing our very anonymous little cyber-nickname.

Ah but you see, that's exactly what cowardice is :D

Re:Simple: post AC!

[techno-vampire]

What does anyone care if you masturbate with your right or left hand?

You only need one hand? I feel sorry for your girlfriend. If, that is, you've managed to get one.

Use Virtual Credit Card Numbers

[dakirw]

Some banks allow users to generate virtual credit card numbers (that can have dollar limits and specific expiration dates) for use with online purchases. Probably not a bad idea to buy things online with one of these generated online numbers (using the purchase amount as the limit).

Re:Use Virtual Credit Card Numbers

[holdenholden]

I have been using such a service for about 3 years. Works great. One caveat though: the actual limit on the virtual card may be 10% higher than the one that you request. My bank adds it because it thinks that I will forget to add the shipping charge and the number will "bounce". Just something to keep in mind. I am not sure if all banks do it.

Re:Use Virtual Credit Card Numbers

[dakirw]

I have been using such a service for about 3 years. Works great. One caveat though: the actual limit on the virtual card may be 10% higher than the one that you request. My bank adds it because it thinks that I will forget to add the shipping charge and the number will "bounce". Just something to keep in mind. I am not sure if all banks do it.

I found out the hard way that my bank doesn't do that - I was off by one cent (typo), so I had to update the amount again and resubmit the order.

Mind your language please

[Anonymous Coward]

I know this comment will probably languish in obscurity, it's becoming an unfashionable sentiment but the
world is changing, Slashdot too.

But I object to the phrase "Ethical Hacker"

Kudos to the ed/poster who placed it in quotes, but personally I would have dropped the qualifying word.

I never knew a genuine hacker who wasn't deeply ethical, even the mischievous ones up for cracking and pranks.
To propagate this newspeak merely reinforces unfounded prejudices and panders to the frightened powers and ignorati.

How does one become certified?

[Anonymous Coward]

And does Jinx.com carry Certified Hacker shirts for the l33t crowd?

Cell phones

[Anonymous Coward]

This is sortof unrelated, but it seems appropriate.

What's the privacy record as far as cell phone address books? If I store names and numbers on cell phones, is a warrant required in order for the police to view those records, or do the police just pop on into the phone company and ask nicely (or not so nicely?)

I agree

[Anonymous Coward]

no comment.

"Contained"

[Short Circuit]

keeping your personal information contained

Last week, I tasked myself with determining ways to contact 72 Slashdot users. (People who'd responded to a subset of my journals in the past.) I found email addresses for fifty of them, instant messenger IDs for three others, profiles in other communities for five of them, and other ways to contact all the rest but four. That's a success rate of 94%. Oh, and I didn't spend a cent on acces to databases. Google and WHOIS was sufficient for most of them.

My recommendations to those in the Slashdot community who want to keep their lives private:

• Use an anonymizer to sign up for domain names. I found a bunch of email addresses through WHOIS.
• Don't base your username on the whole or parts of your Real name.
• Above all, avoid using the same username on multiple communities. If I know your username, and even a small bit of information about your interests (Like, "You read Slashdot"), I can find your profile on plenty of other websites.

For those of you who've failed any of those three tests already, well, it's likely to be a long, uphill battle if you want to regain your privacy.

Re:"Contained"

[Anonymous Coward]

How long did it take you to track down "Anonymous Coward"?

Re:"Contained"

[Short Circuit]

I already knew who thatwas...my ex girlfriend still terrorizing me.

Re:"Contained"

[Kredal]

Oh noes!

You can correlate my identity across the net... so what? And you have your email address publicized in your comment, so I could contact you without going to a WHOIS site or even Google.

So what's your point?

Re:"Contained"

[Short Circuit]

For a community so concerned about privacy, most Slashdotters haven't taken adequate measures to protect their own.

My email address is attached to this comment because I realized a long time ago that there's enough info about me in my Slashdot posting history alone to write a biography about me.

Re:"Contained"

[Anonymous Coward]

I did this once three years ago, half for fun and half for work. A buddy was chatting with me in my cube, talking about an article in the pages of an old 2600 magazine featuring our company (which is never a good thing!) So he showed it to me and noted the guy authored his article with a Yahoo! email address. He said "I've been trying to think of how to track this guy down." I said "that should be easy" and turned to Firefox.

I Googled for the email address, found nothing, checked a few other search engines (including Yahoo) that turned up nothing, and then thought to search Google Groups. I found half a dozen hits, one of which had an AKA to a variant of the email address as an IM name. Googling for the new IM name led to over a hundred hits, and one had a link to someone's page on a big social networking site. The "friends" list on that page had a link to another social page with a nickname composed of another variant of the email address. This site was pay dirt! On that page the guy had listed yet another email address for his college, which looked like it was based on his real name. I also found his city and date of birth. A quick trip through Dex later, and I had it narrowed down to 19 people who matched the partial details of the name. Reading the article had already led me to guess that he might be an employee, so I looked at the employee list for that city's location. There was one exact match for that partial name. Bingo! And the whole thing took less than 30 minutes, including chasing the dead ends.

My buddy just stood there the whole time, slackjawed. He had no idea that it was so easy to track people down, or that people would give away that much information. I went back through my browser history, got pages and screen prints of what I found and emailed it to him. He then forwarded it to our security team, where it must have disappeared into a black hole. (Although I did hear a rumor later that they had been trying to find the guy ever since the article was published.)

A few months later got to I wondering what ever happened to my little friend, so I returned to his social site. Apparently he had been visited by the ghosts of Secret Service present, had tea and crumpets with them, and was given a matching pink slip to go with his lecture on the joys of a stay in Federal Pound-Me-In-The-Ass prison. (I felt bad about that; I have no idea why the company dragged in the Federal government just to fire the idiot.)

But I still don't feel bad about my decision to turn my findings over to security. If an employee finds a security hole in his own company, he should have the decency to report it to the company to get it fixed. With his hack he'd already proven he had the technical skills to work in the IS area, so he could have turned this into a promotion (I was considering asking him to come in for an interview.) Instead, he published the info to a big group of outsiders who were likely to explore the hole, if not find a way to exploit it. I decided I couldn't trust someone like that, so I never contacted him personally.

There are two morals to this the story. The first, obviously, is don't bite the hand that feeds you. The second is more of a lesson than a moral: if you're going to use a throw-away identity for possibly illicit purposes, be sure to actually THROW IT AWAY.

Re:similar tips for highly mobile (homeless) peopl

[sgt_doom]

What I can't figure out is how did you know that Computerworld is the preferred reading material of the homeless?????

New technologies == Trouble

[mangu]

What's the privacy record as far as cell phone address books?

Good question. If you give information to a third party, what are your privacy rights concerning that? In some cases, that's pretty clear. If I give my credit card to a store clerk, it's implied that he will not give it to anybody else but the card company.

But there are many instances where we presume a right that others may consider subject to interpretation. "Is Jack Brown here?" -- "Let's see. Sure, his key is here". Perhaps Jack Brown would object to his whereabouts being known. If he told a garage attendant not to tell anyone, the police would need a warrant to get that information. OTOH, if the traffic camera on the other side of the street caught his car coming in, the police wouldn't need any warrant.

Unfortunately, the basic rights we have are all specified on documents that are centuries old. We need a new and revised phrasing to make sure everything we take for granted is covered. What was called a "house" two hundred years ago today includes things such as our bank account and phone address databases.

All about credit

[NineNine]

Let's be honest. "Identity theft" is only about the precious "credit rating". "Credit ratings" are useful, true, but they're waaaay overused, primarily because people tend to live faaar beyond their means. A credit rating can only be held over your head if you insist on living on credit. The simple fact of the matter is that by avoiding using credit you don't really have to worry about "identity theft", one of the Big Three screwing up, and you don't have Big Brother watching your every move. People use credit so much that a person's credit rating has become the equivalent of "be good, or it goes on your PERMANENT RECORD" from grade school. It's been an adjustment, but I'm both personally, and business-wise (I own my own business) completely debt-free, and I intend to stay that way.

In fact, I had a company (BellSouth Advertising) screw up my business listing badly last year. They published my store hours saying that we were closed a day that we're not. I never signed off on that ad. As a result, business is slower that day. Of course, BellSouth Advertising is giving me some bullshit about "you signed off on the previous year, and it says in fine print that if you don't sign off for the next year, that we can still bill you, blah, blah, blah". I told them that I don't pay for anything that I don't agree to, and I certainly won't pay for an ad that hurts my business. They call every few days, and all they can threaten me with is that they'll ding my credit rating. I just smile and say, "that's fine. I'm still not paying."

That's REAL freedom. I'm not beholden to ANYBODY, from a financial standpoint. How many people in the US today can say that they're financially free?

Re:All about credit

[nametaken]

I've considered this, since my old man does it. The difference is he already owns houses and cars and has enough income to live off of. What do you do when you need to buy your first house? I can't afford hundreds of thousands of dollars out-of-pocket. Cars are manageable if you don't have to drive something insane... but I wonder about homes. I own my car now... paid down my 2005 mazda pretty quick (i hate oweing anyone anything) to a point where it's nearly done, but I still had to do it on a loan.

Re:All about credit

[nra1871]

Don't forget your credit score is now used to help determine insurance rates, etc.

Re:All about credit

[wralias]

A credit rating can only be held over your head if you insist on living on credit.

I agree with the spirit of what you're saying; unfortunately, it's becoming less and less practical to ignore your credit score. For example:

• An auto insurance company can charge you more $$ per month after finding out you have a bad credit score.
• A credit card company can jack up your interest rate after finding out that you paid some other lender late, even just one time. They get that info from your credit report.
• An employer can reject your application in favor of another applicant with a better credit score.
• A mortgage or auto loan company can deny your loan application because of your credit history.
• A landlord can deny your rental application based on your credit score.

Increasingly, credit scores are seen not just as a summary of your financial history, but as a judgement of your character. If you have bad credit, you could be without a car or car insurance, a job, and a home (at least here in America). It's much, much too serious of a thing to just ignore and pretend like it doesn't exist...

Re:All about credit

[DragonFodder]

Let's be honest. "Identity theft" is only about the precious "credit rating".

While agree in principle with many of your points, I have to say on the whole it is an impossibility for most people to acheive. But, that isn't what I am concerned with here. Identity theft is definitely much more than just your "precious" credit rating.

I in fact was a victim of identity theft, and the criminals didn't open up new credit somewhere against my credit report. They somehow (and I beleive from an online store) got my credit card numbers. From that, they charged almost a $1000 at some mom-n-pop convenience store everal thousand miles away from my home. Luckily for me, my account had a security watchdog on it, and the card was disabled when it indicated the same exact number was buying items both in my home town, and in this other location at exactly the same time.

After several days, going to the police (whom were very reluctant to file a report by the way), and sending notarized documents to my bank indicating that these were fraudulent charges. I eventually got my money back. I will not get back my (false) sense of security, nor the several days away from work I had to take, in order to file the necessary paperwork. And, I probably will never get the satisfaction of knowing these criminals were ever caught and convicted. Such a low dollar amount isn't worth the time of anyone but (possibly) the insurance company for my credit account.

Re:All about credit

[illumin8]

A credit rating can only be held over your head if you insist on living on credit. The simple fact of the matter is that by avoiding using credit you don't really have to worry about "identity theft", one of the Big Three screwing up, and you don't have Big Brother watching your every move.

That's fine and everything. I agree with you; don't have any credit cards, buy cars with cash, only use my Visa check card to make purchases with money I have in the bank. But what about when I want to buy a house? Most people don't have enough disposable income to buy a house, even if they can afford most of their other daily expenses without going into debt.

Also, what if I want to simply rent a place to live? Most landlords now require a credit check before they will even let me sign the lease. If my credit is poor, or I don't have enough credit (I actually had a banker once tell me that since I didn't have any credit cards, that lowered my rating by a number of points, and that I should get a no annual fee credit card and not use it much just to prove that I actually had credit) I might end up homeless just for lack of credit.

The credit system is setup so that everyone that wants to be part of society has to participate, unless of course you don't mind being homeless. This is the scam the big credit agencies have perpetrated on the american public.

Of course, the alternative is to live in a third-world country without a credit rating system where nobody can get a loan because there is too much risk involved. I guess I'll take our corporate-ruled and governed society over living in a mud-hut somewhere any day. That's the price we pay for progress, but sometimes it makes me wonder if the progress is really worth it...

Fool Me Twice

[Joebert]

Certified Ethical Hacker

Let us analyse this boobytrap shall we ?

"Certified" -- Here we have the Welcome Mat, designed to make us feel comfortable & willing to continue.

"Ethical" -- Ah, we find outselves Tempted By Cheese sitting on the welcome mat.

"Hacker" -- And here we have, the 10 Ton sandbag hanging above the welcome mat, if you look closely, you can see the fishing line that holds the bag above the mat going through a series of pullies & eventually running under the mat.

ph1rst of 4ll

[packetmon]

Data Thefts have been so rampant there is likely little this article says for pointers. You can have ubersecurity skills and all it takes is the theft from your bank and everything you've done is down tubes. The article if you ask me was meant for those new to the net and did nothing to give me insight. Flame on, moderate away but lets be realistic, the article did nothing for me.

Re:Annual Credit Report

[keytohwy]

I should have felt misled when I followed the link to AnnualCreditReport.com think that is free and less than annual as the poster stated. How does one get it every 4 months for free. I did it last summer and have been waiting for the anniversary to roll around. Even the welcome page states 1 per year. Please tell me!!

LOL @ CEH!

[ninja_assault_kitten]

I love how they make him seem qualitifed because he's a "CERTIFED ETHICAL HACKER". This is equivalent to A+ Certification in the generic IT space.

I call B.S. .....

[King_TJ]

Sure, it's great if you can live without credit and get by.... But I occasionally run into someone just like yourself, preaching that the "rest of us" need to stop using credit and achieve "financial freedom" (or some variation on that theme). EG. One of my former bosses that I do some computer work for got that same lecture from his bookkeeper a few months ago. (He was upset that a few incorrect things on his credit report, plus an ex-employee mishandling some bills caused his credit score to drop too low to get a home loan he was seeking for a new investment property.)

I didn't get in the middle of that particular argument -- but if it was me, I would have told the bookkeeper to shut her trap. The fact is, she was only able to live "credit/debt free" because her husband happened to have a really good paying job - and her salary was just "play money" for them.

Credit scores *are* important, if only because a smart individual has more options with a good credit score. Credit is simply a tool, and it can be used well or improperly. But without a decent credit score, you've lost access to that "tool" completely.

People like my former boss leverage their credit to make purchases that help them generate positive cash flow. (He rents out houses after buying them when he sees a good deal on one.)

In circumstances like your ordeal with BellSouth, I can sympathize - except it's a smarter thing to attack the problem directly, rather than just ignore it and let them damage your credit. If you didn't sign their agreement, you have a great lawsuit right there. Force them to produce the paperwork in court, or else they have to release you from the contract (and you could probably claim damages too, and recoup some of those lossses from the lost business due to their errors!).

I think you misinterpret "financial freedom" to an extent.... I'd say financial freedom is the ability to buy anything you want or need, when you want or need it. If you're a Bill Gates, you're there already and the "credit tool" is irrelevant. But most of us don't have that kind of cash in the bank.

"Ethical Hacker"

[Lord Kano]

makes about as much sense as "Ethical Lawyer".

The ones who help other people are ethical. The ones who try to fuck other people over are not.

Calling yourself ethical doesn't make you that. It's your deeds that determine whether or not you're ethical.

LK

How does one judge "ethical"?-Humanism.

[Anonymous Coward]

"Right and wrong are always blurred and I can't see how "ethical" can really be defined."

Which explains the messes the world gets into. Too many people "defining" ethics, and not enough living them.*

*Here's a way to think about morality and ethics. They're more what you do when no one is looking, than when they are [1]

[1] Example: For all of you engaging in illegal copyright infringement (of ALL kinds). Would you do it with the content creator looking over your shoulder? Or wait till they left the room?

Re:Annual Credit Report

[Neil Blender]

How does one get it every 4 months for free

One per year per agency. Get one from one agency every four months. If anything major happens, you can bet on it being in all three. Minor stuff, like addresses, etc are most likely what will differ from one agency to another and are not so urgent to get fixed.

Equifax

[falconwolf]

I got all of my reports except Equifax. The whole process fails when I get to them. Does this happen to anyone else. I think out of all the credit reporting agencies this one is the most difficult to deal with.

Of the three major credit report agencies, Equifax is the worst. Especially if you're trying to clean up your credit reports. Even if they're supposed to investigate and delete bad info if they ever get around to it they drag their feet to investigate. They're also supposed to allow you to write a letter to be attached to the report but they loose these. Because they're so bad it's a wonder why anyone would use them.

Falcon

certifed ethical hacker

[falconwolf]

Apparently, 'certifed ethical hacker' is an actual cert one can get. But I don't think I would the term 'hacker' to appear anywhere on my resume. Unless I was trying to get a job with some black hat pseudo legal firm...that'd been sweet.

I've never heard of any certification for ethical hackers before reading this article. What organization issues the cert? Once upon a tyme I read about the Model Railroad Club at MIT, the WOZ, and others and I wanted to be a hacker like them. Alas back then adjective "ethical" wasn't needed, but reporters and the mass media has bastardized the word. When I read where a reporter goes on about how hackers are bad I want to ask "so why are you a hacker?" Many people may not recall or know it but "hackers" is what reporters were once called. Though I'm not sure I think they are referred to as hackers in "Citizen Kane" made in 1941.

Falcon

Re:certifed ethical hacker

[looney9]

There may be others that also issue the certification, but I earned mine from the EC Council. Web site is at http://www.eccouncil.org/.

worrying about id theft

[falconwolf]

Let's be honest. "Identity theft" is only about the precious "credit rating". "Credit ratings" are useful, true, but they're waaaay overused, primarily because people tend to live faaar beyond their means. A credit rating can only be held over your head if you insist on living on credit. The simple fact of the matter is that by avoiding using credit you don't really have to worry about "identity theft"

If only this were true but it's not. Even if you're careful and watch your spending, say you have a small discresionary fund but the rest you save and invest, you still need to be careful about your credit reports and id theft. Someone who stills your id can open credit accounts in your name then take all the money and run. If you are looking to buy a new car, no say a house, you may not be able to get a house once you find it because your credit as been messed up. Or say you're looking for new employment, you can be denied employment because of your FICA credit score. More and more employers check applicants credit. You can also be arrested because someone stole your id and used it. I've come across a number of stories like this in the news.

Falcon

Re:worrying about id theft

[DarkDragonVKQ]

Yeah..I love how the ID worked.. Ok Social Security #, it's a # that you should keep private and not give to anyone else.. Bank: "ok can we see your SSN" *hits head* And the problem is that it's always going be like this. Even if a new system were in place, people would ask for that cause it's the only way they know or think they know of identifying a person. -_-. Thus defeating the point of its existance in the first place.

Paranoia Paranoia Paranoia

[elmCitySlim]

There is no such thing as privacy. Getting on or off lists wont help you a damn when any half-wit felon grabs your SSN and ruins your life.

For some victims of identity theft, it takes years to clear their normally good names. I read one article that describes the horror one person went threw. She couldnt ever get a job because a police unit in another state has a "file" on her time she did in prison for attempted murder and grand theft auto. She has never been to prison.

I guess teh ebst defense is to never give out any information, or be careful about it.

For example: Every time I go and get my school schedual they ask for my SSN. Most people blurt theirs out. I write mine down on a piece of paper and then get the paper back. I dispose of it by adding one number to the begginning (i dont seperate the digits initally) and pen in random name above it. So if someone crawling threw the school records office trash finds it; they will just think its a telephone number.
Its little things like this that will most likely keep you out of trouble. But you cant controle certain people grabbing hold of this information...so whats the use of being paranoid about it.

Note Scarcasm

[MattS423]

Wow, he said alot of new and useful things in that article....I never knew that before!

Ethical Hacker(tm) Certification, only $29.95

[OrangeTide]

Please send me $29.95 and you will receive your Official Certified Ethical Hacker welcome kit. The kit contains:
1. Certificate of Authenticity
2. Certified Ethical Hacker Mug
3. Paper bag to hide your face from your friends and loved ones.

Re:Ethical Hacker(tm) Certification, only $29.95

[pedalman]

3. Paper bag to hide your face from your friends and loved ones.

Does the bag have pre-cut eyeholes, or do you have to create them yourself?

Re:Ethical Hacker(tm) Certification, only $29.95

[OrangeTide]

In the interest of customer safety we have prepared the eye holes for them. Please be advised that some bags may have "hanging chads", please carefully remove them before placing the bag over your head.

Do not, I repeat, do not create eye holes in a paper bag with scissors or a knife while still wearing the paper bag.

All bags are made from the highest quality unbleached organically grown paper cut with no old growth material and 95% post consumer recycled paper.

Canada does it right

[talledega500]

I reported an ebay scam to a canadian govt and they took care of it right away.

But sometimes you want to prevent the problem before it starts
and theres plenty of encryption tools out there to help you.

But common sense rules the day.

For a bit of technical help try http://www.mysecureisp.com/

Certified Unethical Network Tester....

[Anonymous Coward]

I wouldn't trust a CEH for advice on how to tie shoes, let alone anything security related :P....

Saw these funny stickers, thought the CEH people would like to see them...

http://www.cafepress.com/defconshirts

All your details are belong to us!!

[pr0file]

Having had the inside scoop on identity fraud for a long while now I would just like to say that there is a lot that the media/banks and governments are not saying. The crux of it all is this The fraudsters already have your details and they have had them for a long while and when i say a long while i mean years!

Information security has only reached its peak in the last couple years. Prior to this, it was pretty lax especially during the height of companies outsourcing their call centers to foreign lands and not having a clue about data protection laws in said countries. There were multiple stories of fraudsters going to india with briefcases of cash and offering call center employees the equivalent of 1 years salary for them to pass on customer details. These people didnt pass on the names of one or two people, they passed on whole databases! http://news.bbc.co.uk/1/hi/uk/4121934.stm

Nowadays this is a lot more difficult to do, because information security is being taken a ot more seriously, and partly because thousands of people are getting stung.

IMHO, another reason why identity theft is so prevalent and will continue to be for the foreseeable future is that the weakest link will always be people. You cant bribe a computer system, but you can always bribe a call center employee or an equifax worker. I'll bet that no one reading this is more that 3 degree's of separation away from one of those two people. and besides, they say everyone has a price. If you can convince a couple of young men to blow themselves up, then personally i think it will be a peice of piss to get them to accept a bribe.

Just like everything else, fraud has and will continue to evolve. Initially it was stolen cheque books and credit cards, now you have elaborate schemes involving huge sums of money and lots of different people but using very little technology. For instance.

Nothing stops someone from spending a couple of grand putting ads in select newspapers offering loans etc. As soon as some unfortunate person bites, and say requests a loan for $5,000. The appropriate details are taken, and the sum of say $20000 is paid into the account. the recipient is called up a day later and told that themoney is in their account but they were overpaid and needs to send the excess of $15000 via money transfer or bank wire to X country/location ASAP. The "Mugu" at this point does so, and suddenly becomes liable for $20000 while the fraudsters vanish.

Now you may ask where did the initial $20K come from?? easy.

Well generally this comes from the account of someone with a lot of money in the bank. it is generally obtained by a frauduent person working in a bank. They will tend to get the details from accounts that they access as part of their job so as not to arouse suspicion. All that is done next is to match the details of this person with their credit report/ identity information obtained earlier, effect a wire transfer.. which can be done over the phone and voila, Robert is your father's brother!

They way we as humans do things, has to change. We want faster fast food, we open more fast food restaurants, and to cope with demand we pump the chicken full of hormones so that when it is slaughtered after 3 weeks its nice and fat. Then we start complaining about being obese, talking about being cruel to animals, worrying about what those hormones are doing to us. Yet we are the ones that demand faster fast food.

Its the same with banking, we want more convenience, we want to be able to bank online, but cant be bothered to secure our home computers against key loggers, we want lesser charges so banks operate call centers in far flung countries. Its all about what WE want. But we forget, that with the increases in our reliance on technology and our demands for "more" there are always risks that will have to be dealt with and until those risks are acknowledged there will always be victims. This goes for every facet of our existence.

Intriguing statistic

[cb372]

I gave up on reading TFA after I got to:

consider that over 60 per cent of a person's identity can be found in his or her garbage can.

What on earth does that mean? How can you quantify identity like that? And what percentage of my identity should somebody be allowed to steal before I start worrying?

Look what I can do!

[Shoten]

Woo hoo! Look at me...I just got one of the least-respected certifications ("Certified Ethical Hacker") in computer security!

Woo hoo! Look at me...I'm parroting back a little bit of information, containing nothing new whatsoever in depth or breadth of scope, about protecting your identity!

(yawn)

CEH = bogus cert

[brennz]

CEH is like an "i'm a newbie badge" for security. Think of it as one step below security+

Anyone can pick up a book and learn how to run vuln scanners or use prepackaged exploits.

If people want to go to some real security training, I recommend http://www.immunitysec.com/education-overview.shtm l

Dave Aitel is both technically brilliant and incredibly funny - a rare combination.

Trojan ATMs

[White Yeti]

The fake PIN would work against trojan ATMs. I've seen more than one story on the news where fraudsters install a fake, free-standing ATM in a public shopping area (mall). It reads the cards and PINs, and maybe dispenses cash (or some sort of error message). The "service technicians" later remove the machine with all the recorded info. for cloning the cards.

Hackers were never ethical...

[Anonymous Coward]

Alas back then adjective "ethical" wasn't needed, but reporters and the mass media has bastardized the word.

The hackers back then weren't ethical, either. Take a closer look at those "heros"; and you'll find a band of con artists, and criminals.

These believed that breaking and entering was ethical; they were big on theft of services (especially phone and computer services), they loved to trespass, and they generally felt that forcing their way into places that the owners didn't want them to go was a fun thing to do. These were people who felt that everyone else's information should be free to all; but they themselves had an inviolable right to privacy. They were hypocrites of the highest order. They're mostly gone, and good riddence to them. They sucked.