Slashdot Mirror
Equifax Made Salary, Work History Available To Anyone With Your SSN and DOB (krebsonsecurity.com)
An anonymous reader quotes a report from KrebsOnSecurity: In May, KrebsOnSecurity broke a story about lax security at a payroll division of big-three credit bureau Equifax that let identity thieves access personal and financial data on an unknown number of Americans. Incredibly, this same division makes it simple to access detailed salary and employment history on a large portion of Americans using little more than someone's Social Security number and date of birth -- both data elements that were stolen in the recent breach at Equifax. At issue is a service provided by Equifax's TALX division called The Work Number. The service is designed to provide automated employment and income verification for prospective employers, and tens of thousands of companies report employee salary data to it. The Work Number also allows anyone whose employer uses the service to provide proof of their income when purchasing a home or applying for a loan.
The homepage for this Equifax service wants to assure visitors that "Your personal information is protected." "With your consent your personal data can be retrieved only by credentialed verifiers," Equifax assures us, referring mainly to banks and other entities that request salary data for purposes of setting credit limits. Sadly, this isn't anywhere near true because most employers who contribute data to The Work Number -- including Fortune 100 firms, government agencies and universities -- rely on horribly weak authentication for access to the information.
The homepage for this Equifax service wants to assure visitors that "Your personal information is protected." "With your consent your personal data can be retrieved only by credentialed verifiers," Equifax assures us, referring mainly to banks and other entities that request salary data for purposes of setting credit limits. Sadly, this isn't anywhere near true because most employers who contribute data to The Work Number -- including Fortune 100 firms, government agencies and universities -- rely on horribly weak authentication for access to the information.
This only gives a person's work history? Far less of an issue than getting a loan in another person's name. Unless someone can show me a hack that makes use of this information that's worse than getting a credit line... Many places are also making a switch to transparent salaries anyway. Again, why is this a big deal?
they wont know my DOB or SSN at first because I hid them in alternative calendars and bases
Remember when people mocked the credentials of Equifax's former CIO and other people pushed back because many people in the field didn't have traditional background?
Well, it looks like security was a systemic failure at Equifax, so perhaps it's actually time to suggest that someone with a music degree wasn't qualified for the job?
Let's face it: success is defined as no known security breaches, yet, this could be down to luck rather than skill. Either no-one successfully targeted her prior employers or any breaches never became public.
The real "Libtards" are the Libertarians!
What business is it of a potential employer what I was paid by my previous employers? All that does is weaken the applicant's position when it comes time to negotiate a starting salary.
What protects voting history exactly? Is there a special law that would stop a data seller like Equifax (or Cambridge Analytica, or Choicepoint) from selling data on voting history? Work history is bad enough, but there does not seem to be privacy laws for anything but medical history.
In theory the voting history is supposed to be secret, but its apparently recorded if you do postal votes.
I notice that data on postal ballot votes was handed over to Trump's "Election Integrity" commission, which in turn contains Hans Von Spakovsky of the Heritage Foundation, a vote suppression specialist. These are the same election databases Russia was trying to hack last year, so I believe its very useful to groups like Heritage Foundation.
So if that data finds its way into a political data mining company, would there be an investigation into the handing over of private data and a prosecution or would be simply be ignored?
When is enough, enough, and the peasants rise with pitchforks, rakes, and torches? (none of those stinking tiki torches though)
Time for the corporate death penalty. If "corporations are people", then they can get the death penalty.
Yank their charter. And, if possible, blacklist their CxOs.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
our entire economic system was rigged against the working class. Good thing that would never happen.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Site designed to help capitalists to abuse workers is abused by non-capitalists. I feel profound indifference.
If corporations are people, give that bastard the electric chair.
Table-ized A.I.
âoeWith your consent your personal data can be retrieved only by credentialed verifiersâ
However, without your consent, weâ(TM)ll share it with anyone that offers us money. And we never seek your consent.
None of those sections refute anything in the article.
The first section describes what different requestors might want, not what they are limited to getting.
The second section how the requestors access may be authorized, not whether an unauthorized requested is limited in any way.
Note that Krebs actually obtained the information you claim cannot be obtained in this manner.
...you are golden? Good to know!!
Time is what keeps everything from happening all at once.
It's not like their info isn't already compromised. Between Equifax and all the other leaks, particularly the Office of Personal Management fiasco, everyone who gets a government paycheck can easily have their identity stolen. It's a dead certainty that both the Russians and the Chinese can impersonate anyone in the government online almost instantly. It's a security nightmare that has been covered up. Showing how completely screwed all our security is would be a public service. It would force government and business to behave responsibly for a change.
The really ballsy move would be to apply for credit cards for all of Congress and then go to Amazon and buy a sex toy packing, one for their office and one for their home. It would be suicidal at the level of Kim Dotcom or Assange, but it would be funny. You could have a great laugh in Gitmo when the FBI is tasering your eyeballs.
Why is Snark Required?
Sweden makes tax returns public with no apparent ill effect. The US already makes real estate values, ownership, and taxes public, and we should do the same thing for income tax returns.
Years ago in order to get a job, I took a pretty low starting salary.
I moved to another job after a couple of years because that company treated us like shit.
Anyway, upon looking for another job, I find out that I was being paid about a third less than my peers.
When I told my real salary to the recruiter and that I wanted to be paid the same as my peers - same experience and skills - I was told that I was being unreasonable to expect an employer to give me that much of a raise. She found me something and the employer offered me a $5,000 increase - but I'd still be paid WAAYYYY less than my peers. I rejected it and the recruiter seeing her commission evaporate became a real bitch. (recruiters work for the EMPLOYER NOT FOR YOU! If you think they are your friend, you are naive.)
I ignored her calls and found another recruiter (they grow on trees) and lied about my current pay at the time. Can't do that anymore.
Seriously? They charge market prices for their products. We are not allowed to do the same?
And this shit of kids who get out of college in bad times will be paid less for the rest of their lives? Just because they were unlucky enough to get out of school during a recession?
This system is fucked and rigged against us.
The Work Number is used to automate employment verification. The company doesn't just make it available, companies have to sign up and pay for The Work Number. Every time a company uses The Work Number, the person/entity requesting the verification has to pay for it.
They usually only give you dates of employment and position, in order to get salary information there's a whole process and it would be EXTREMELY easy to find out who requested the information.
How I know this: I do background screenings for a living.
The status quo of only the employer (or someone having the right personal info) being able to find out what you make is lopsided in favor of companies. They have a bigger data set on what a given role pays than the applicant.
Since the data is now easily accessible to anyone who is looking to commit a crime, maybe it's time for the data to just be out there for anyone. At least that way, employees could get known accurate data on how their salary stacks up in the market instead of relying on the self reporting of others.
People are losing their heads over this. The Work Number is only one of the services that do this, but because it's owned by Equifax (Apparently), everyone's freaking out about it. To look up a record on The Work Number costs money, and the only thing they're doing is providing a service. Large companies (Such as Wal-Mart) use the work number to streamline their employment verification process so they don't have to deal with it on the day the day.
Hell, Robert Half has their OWN version of this, and it requires less money, less information, and is FREE and it does the same thing The Work Number does for anyone that's ever worked with Half and Half.
There's also Thomas and Company, U-Confirm, and many many many others.
Any time you have a background check and list your former employers (or DON'T list your former employers) - The Work Number is probably used to check and make sure the information you provided is correct.
How I know: I do background screenings.
I'm a state government employee. My pay and benefits information is available for the general public to look up with just my name.
The CIO was a scarecrow. Always was.
Good operational security is more important than fall guys.
Discovered and reported to them in 4Q13. Their response: "Yeah it's not a problem." Our response: "GTFO."
Being someone who said she was clearly not real infosec material it's satisfying to see more and more complete data come out that confirms my intuition. It's not the music degree.. it's the whole package.
Those were shitty low energy dried out turds of companies during the years she worked there. Equifax's CEO described the company as a culture of tenure and mediocrity, so with a history like that sidestepping into a CISO role where she could cyber-this and cyber that until a better C-level position opened up was a natural fit for her.
Too bad for her the inevitable shit hit the fan while she was in the hotseat, stories are coming out that everyone knew it would happen eventually. She was exactly as competent as they needed her to be.
Before people stop falling over themselves to defend her?
She could have EE/CS undergrad with a MBA and she still sucks. She is not mudge or the wizard at your work who dropped out of highschool she is a Pointy Haired Bastard and she would probably not piss on you to put you out.
May i remind you that equifax is now saying this breach is the fault of one single engineer... not a C-level executive. She would have roasted you to save toilet paper.
This post barely makes any sense, yes people will try to pay the least they can for things right up to stealing them. Since they benefit from keeping their money it's reasonable and prudent to assume so in most transactions.
It's also wise to wave away any insinuation that you're being unreasonable by asking for more.
Surprise surprise I find that I usually make a little more than my co-workers in the same position wherever I work.. because I don't talk no for an answer.
Not by being the smartest, most productive, or anything like that.
But because I got fucked in the ass by society until I went from janitor, the military (janitor pt2 with bullets) skip a few and then a respectable engineering position. I know exactly how much people will take advantage of each other because it's so apparent when you start from low places. The worst part is that I could walk up to my 18 year old self and skipped half that shit, it was just that I was surrounded by people who actively interfered with my success in order to use me for menial tasks, not even because I was good at them... but because it would have been a pain to replace me. Willing to throw away a promising young man's life to avoid the hassle of doing some interviews!
Now I act like a smug prick when I deal with certain people, recruiters, hr, etc my reward is a chill office, high pay, and get this... a boss who actively makes sure I'm enhancing my career. I don't act like a smug prick to my boss and co-workers though.
Certainly Australia. No way salary let alone detailed credit history can be accumulated by a private company and sold.
Mind you, we became a bit more like the US recently (2014) with watering down of these laws with no good reason and far too little debate.