Why is Equifax still in business?

[Anonymous]

Good grief, what a disaster of a company. I planned on applying for a credit card today, so I went to www.equifax.com to unlock the 'freeze' I placed on the account after they exposed the data of 143 million people ... and was greeted with a concerning error message, which I've attached a screenshot of. I guess I'm not applying for a credit card today ... 

[Anonymous]

Their security certficate may have expired and/or may already be updated, but your cache may not be refreshed. I would not perform your business on public wifi, a library computer, etc. If you are on a home connection with a strong SSID and password, (disclaimer: I am not a security expert) more than likely you are OK to proceed with the freeze.equifax page. 

[Anonymous]

Chrome doesn't offer the option of proceeding. It offers only one option ... which is "back to safety". 

[Anonymous]

You click on "Advanced" and it will offer you the option to proceed.

fwiw, when I go to the entire address, I get the site with no warning (though it is slow). I am also in Chrome, though on Windows. My suspicion is your cache has not updated. Sometimes it can take several days to refresh. 

[iv]

Ah, NET::ERR_CERT_SYMANTEC_LEGACY!

One of the first high-profile impacts of the Chrome 66 distrust of Symantec certs! Fun!

(Also will show up in Firefox 60 shortly.)

Due to an ongoing series of ...issues, trust of Symantec-issued TLS certificates is being phased-out in several major web browsers.

Any competent sysadmin will have been aware of this and prepared to swap out affected certificates prior to the drop-dead distrust dates.

Since that hasn't happened here, I'll leave you to draw your own conclusions about Equifax staffing...

(It's true that hitting "Advanced", and then "Proceed to www.freeze.equifax.com (unsafe)" will work fine, and will not be less safe than it was last week. Take that as you will.)

[Anonymous]

heh ... I clicked "Advanced" and then clicked the freeze.equifax.com link displayed on the page it served ... and got this message:

System Currently Unavailable - Error 500

We're sorry. We cannot process your security freeze request online at this time. Please try back later.

... which tells us even more about this business that shouldn't even be online, let alone in possession of everyone's sensitive data.

[iv]

Yeah, the site is probably a cluster (the "multiple servers" kind, as well as the "Charlie Foxtrot" kind) - looks like some of the hosts are up and working, some are very slow, and some are currently offline.

Perhaps someone finally woke up and noticed that two of the top five browsers are starting to flag the cert as invalid, and they're getting around to fixing it. Maybe.

They did at least replace the certs for www.equifax.com (in March) and www.trustedid.com (in February) - I guess someone "forgot" about www.freeze.equifax.com.

Not that replacing the certs on those other sites helped their actual security, though:

https://observatory.mozilla.org/analyze/www.freeze.equifax.com

https://observatory.mozilla.org/analyze/www.equifax.com

https://observatory.mozilla.org/analyze/www.trustedid.com

No CSP, no HSTS, no SRI, no Secure cookie flag, etc, etc...

At least all three redirect from http to https... baby steps?

Not that the other CRAs are all that much better. In terms of publically-visible web security, Transunion/​TrueIdentity are at least making some effort, and Experian/​creditscore.com/​freecreditscore.com/​etc are... at least slightly better than Equifax/​TrustedID. Slightly.

[Anonymous]

Site is down for me at the moment.  Restarted VPN and firewall just to be sure.

[Anonymous]

The saga continues ... 

So I finally ended up calling Equifax and got the freeze lifted. 

Then I tried to lift the freeze at Experian ... unsuccessfully so far. The freeze / unfreeze page is broken:  "Due to technical issues, we're unable to provide this service at this time. Please try again in a few minutes.".  I've been trying all day but no banana. I also called Experian 3 times and each time I was put on hold and after about an hour, disconnected. 

grrr ... 

[Anonymous]

Just to weigh in that EQ isn't teh worst site in the world, i ahd the same issue with ATT,com a month back. Ths does happen occasionally, to any site. 

Why are they still in business? The same reason all the other companies with data breaches are.