Comment by BeefySwain
3 years ago
NOTE: It is possible to freeze access to your employment data here: https://employees.theworknumber.com/employee-data-freeze
That being said, it doesn't stop employers from continuing to hand Equifax your data on a gold platter, and therefore does nothing to protect you from the inevitable data breach that will result in Equifax being required to give everyone affected $0.36 or one year of free credit monitoring.
Wow placing a freeze requires filling out a PDF form, attaching a scan of your ID, and then sending it in over email, mail, or fax. The PDF lacks built in form fields you can type in. The extra friction is probably a feature: https://assets.equifax.com/wfs/theworknumber/assets/twn_Empl... (the exif data on that PDF shows the name of the employee that created it and that they used Word 2010...)
The Equifax CCPA request process on the other hand is very smooth and automated. Though doesn't seem like it's including Work Number information: https://myprivacy.equifax.com/
Shameless plug [1] that hopefully provides value: simplePDF.eu [2] will allow you to fill it in more easily (the fields are already set)
[1] It's a side-project of mine
[2] https://www.simplepdf.eu/editor?open=https://assets.equifax....
Just making sure, the site will NOT save the data that I entered in the PDF? Thank you for sharing your side-project!
1 reply →
This isn't working quite right for me (Firefox on Windows). The SSN field is a single text box and the numbers don't line up with the boxes on the form. I can pad with a single space, but additional spaces don't increase the padding.
https://imgur.com/NXrZGaS
Thumbs up for https://www.simplepdf.eu! Just generated the Equifax form.
Neat! How do I save in the filled out PDF??
2 replies →
>The extra friction is probably a feature: https://assets.equifax.com/wfs/theworknumber/assets/twn_Empl... (the exif data on that PDF shows the name of the employee that created it and that they used Word 2010...)
I don't get it. how is "PDF shows the name of the employee that created it and that they used Word 2010" relevant to the claim that "extra friction is probably a feature"?
Just speculating here, but I wonder if their point is that they went out of their way to create a PDF that is as unusable as possible, and that Word 2010 is somehow required to create such a PDF.
A few simpler explanations:
- Equifax IT hasn't rolled out modern O365 apps
- The form was created a long time ago, and has not been updated
Regardless of the exif data, I do believe that friction is absolutely a feature in this process, but I also think the Word 2010 angle is tenuous at best.
3 replies →
And then they have all of that as well ready to be breached!
When I submit the myprivacy.equifax.com validation it hangs at "Processing..." indefinitely. #AbolishCreditAgencies
Credit, bank checking (ChexSystems), and personal information aggregators like Lexis Nexis and Thomson Reuters Clear ought to be abolished or curbed indeed. I hate to bring trans politics into this. I'm sure that's the last thing anybody wants to hear about right now. However we are a class of people whose sexuality can be unfairly identified by these databases.
34 replies →
The current oligopoly of the big three credit bureaus is a travesty and needs substantial reform.
That being said, abolishing the concept of a consumer credit report entirely is a terrible idea. It is a fact that different people simply present different risks to a lender in their likelihood of default. Having actual data about a person's previous repayment history is extremely predictive of their future default probability (with proper ML applied).
If you remove the ability to use data about that actual person's previous behavior then instead lenders will simply not provide credit or financial services to large proportions of the population whom might be credit worthy as they would be unable to determine if they are creditworthy.
Again, I'm not arguing for the status quo. A lot of reform is needed. But to ignore the reality of how credit underwriting works is foolish. One of the reasons that many developing countries don't have financial services for their populations to access debt is because they don't have sufficient data to do credit underwriting.
And debt is a critical tool to enable investment in the present. Used wisely, debt enables a person to borrow from the future to invest in the present, e.g. buying a car so they can commute to a nearby city and earn a higher salary.
35 replies →
#AbolishCreditAgencies
Things were bad, or worse, before they existed. Every little town had one (I remember walking past Palo Alto’s downtown; it was just a storefront with a bunch of file cabinets). Getting credit was slow and complicated and really a pain when you moved.
And before that, even into the mid 20th century, getting credit was all about your network. And remember how much people complain about VCs relying on intros rather than cold calls…well that’s how the entire financial system used to work.
Yes the credit agencies are abusive and lazy and need serious reform and legal management, but they also provide valuable services. I believe it is possible to have the latter and fix the former.
Check if an ad blocker might be interfering? I finished my CCPA request in ~2 minutes and it only required that I do SMS verification. Presumably because the name, phone, address, and email all matched records they had on file for me...
3 replies →
At least they let you mail or email.
I faxed them 4 times in 6 months to verify my identity because they have me confused with someone else and eventually just gave up.
They said any other alternative was not supported.
You can contact a consumer law attorney to get this fixed. There is an attorney's fees provision in the FCRA which will make it economical to pursue the remedy.
With GDPR you could just send them a formless deletion request.
There are good parts in GDPR for sure.
With GDPR there is no way this could be allowed.
Unfortunately they'd certainly be registered in Ireland and Irish Privacy agency doesn't hand out notable fines ...
GDPR is an EU law and does not have legal legs in the US.
3 replies →
well there's no law that forces them to make it easy.
There’s also no law that requires it be true or accurate. What a great system! :-/
26 replies →
Hijacking here to say, literally all you need to get access to someones employment + salary history is their SSN and birthdate.
edit: and a past employer that used this system
Birthdays are extremely easy to get (public record), and I seem to recall a specific large organization leaking a bunch of SSN's not too long ago.......
Unless you are very young (read: born after 2011) your SSN can be trivially brute forced if an attacker knows where and when you were born, because those details were (before 2011) mapped onto 5 of the 9 digits in an SSN.
You should assume your SSN is public anyway. There have been so many leaks, and it's not like a credit card where you get a new number if it is compromised.
3 replies →
More accurately where you were born and when your SSN was issued (my brothers who are four years older than me got their SSNs at the same time I did). Some of us older folks were born in an era in which you didn't automatically get an SSN along with the birth certificate. And then there are people who weren't born in the US so will have had their SSN not matching birth year.
I also think it's less than 5 of the 9 digits that are reflected in this manner. That would not leave room for a lot of distinction in SSNs.
2 replies →
In Italy you don't even need to brute force them, you can generate them because the algorithm is public.
Except same rare case of same name, same birthday, same place of birth, the generated code is always valid.
https://en.wikipedia.org/wiki/Italian_fiscal_code
Hate to break it to you but that’s 21 year olds now :)
[edit: so I program for a living. you'd think I know how to subtract to integers??? I /assume/ I read 2001? at least I hope I did]
2 replies →
It seems crazy to allow a large organization like that to continue operation after such an egregious error, especially if their business is centered around a bunch of personal information.
Their customers are happy. And that means Congress is kept happy. You are not their customer and Congress doesn't care if you are happy.
50 replies →
SSNs are generated by a not very secret algorithm. They were explicitly designed to be public information.
You don't need a data leak to get someone's SSN.
Also, malicious actors are almost never targeting you specifically. It is enough for them to
1) choose a birthdate
2) generate all SSNs associated with that birthdate
3) get all employment/salary histories accessible with that info.
4) scan the list for interesting tagets
5) ...
6) profit
And you'd need to know a past employer, right? I couldn't seem to find a way to get access to the info without inputting an employer first.
Many people post their professional career on LinkedIn. Again, it seems easy to find this information through public sources.
1 reply →
Good catch, I'll add that.
Or send them a CCPA data deletion request: https://yourdigitalrights.org/d/equifax.com. This will generate a request email. You can then change the wordings to indicate that you are interested in deleting your salary history data.
Disclaimer: I'm one of the creators of YourDigitalRights.org.
What are the potential ramifications for submitting a request on your site when you don't have residency in one of the listed areas?
Worst case they wont deal with your request.
Great site, I just used your service to email "Right to Access Request (Section 110 of the CCPA)" to Equifax.
Question / suggestion -- Have you considered monetizing by allowing lawyers specializing in CCPA / consumer privacy issues to advertise on your site?
Interesting suggestion. We're not interested in advertising, but would consider collaborating with law firms that work in this space (consumer protection / privacy). I have a lot more to say about this so message me if you're interested.
Nice site. You should probably update it for Brexit though. There are two GDPRs, for now.
The dropdown has options for "GDPR (UK)", "GDPR (EU)" or "CCPA" so they have actually already done this.
But, I didn't opt in for them to have this information about me to begin with.
>But, I didn't opt in for them to have this information about me to begin with.
Everyone is up in arms about Facebook and Google collecting our information... meanwhile credit bureaus are sitting in the shadows giggling to themselves
The obsession with "big tech" as the biggest abuser of consumer privacy frustrates the hell out of me, and must be a real delight to credit bureaus, cell carriers, data brokers, fintech parasites, and all the rest of the slimy fuckers who do far worse things every day and aren't even on the public's radar.
6 replies →
Well yeah -- did you think it was somehow about consumer rights?
Democrats and Republicans alike want to use the threat of regulation and anti-trust action to force social media companies to adopt moderation policies favorable to them. They both recognize (IMO correctly) that they must make these threats; principled adherence to economic liberty leaves one without leverage and is likely to result in companies simply caving to one's opposition (c.f. the behavior of most companies with respect to China).
Credit bureaus don't influence elections, ergo there is little advantage to be gained by making threats against them.
1 reply →
You don't need to. Your employer can give this info to whoever they want, and many give this data to Equifax or one of the other credit agencies.
Also, you might give your bank employment details, and your bank will most likely send that info to a credit agency as well.
There's not much of an escape.
Opt out of the system as soon as you possibly can. No mortgage, no bank, no address, no traditional job.
6 replies →
If I bundle my personal information together into an nft and then buy that nft, could I issue the credit agency with a DMCA takedown notice?
3 replies →
What exactly do employers and banks stand to gain from sharing this information? Is it an exchange of information for money?
9 replies →
theworknumber.com is yet another symptom of a much larger problem in that it is currently impractical for a regular person to enforce their rights via the court system.
According to Peter Thiel “If you’re a single-digit millionaire like Hulk Hogan, you have no effective access to our legal system...” https://theintercept.com/2016/10/31/trump-fan-peter-thiel-sa... So never-mind the non-millionaires.
However it is really nice to see efforts by some regular people out there setting up services such as https://yourdigitalrights.org which is the service I just used to request my information from Equifax. It will be interesting to see what comes of it. I suppose if they do not respond in 45 days I'll file a complaint with the CA Attorney General to put yet another ping regarding Equifax on their radar. https://oag.ca.gov/contact/consumer-complaint-against-busine...
This shows that ultimately it is the regular people who drive progress, while the powerful and the wealthy just take credit for it.
Ultimately United States will transition to European-style privacy laws when it comes to private information like income and these credit agencies will be abolished, but the way to get there is for the regular non-millionaire people to exercise whatever "rights" they kinda have to ultimately get these annoyances shut down.
So a new company you are joining can easily verify your current salary with your ssn & dob. Right? They have your history of employers from your resume already.
That's not legal under the FCRA unless you've given them written permission.
Though some companies will do a background check on all new hires (again, with your permission) which would include employment verification.
1 reply →
Just also want to point out that freezing might result in certain parties that you do want to verify your employment from being able to do so.
If you're in the process of buying a house, you might want to hold off on this freeze until your mortgage has been approved. Might be true if you re refinancing or buying some else that requires a significant loan.
I'm not entirely sure if what I've stated above is true, but I've had to use theworknumber in the past when going through the mortgage process.
What are the consequences of doing this? What conclusion do HR departments draw about a person who freezes their employment information?
Are there other agencies we have to do this for as well?