Tumgik
#it redacts like 90% of a Wikipedia page and you have to guess what it’s about it’s fun
communistkenobi · 2 years
Note
there's a supernatural-inspired wordle called superdle, if you'd like another little word game :)
OOOh yes I’ve seen that one thank u! I also enjoy redactle but that one takes like an hour to play lol
7 notes · View notes
Text
Is It Really THAT Bad?
Tumblr media
I’m going to warn you all now. This one is going to get a bit angry at the end. Normally I would try and remain as professional as possible, but in this case, I don’t feel like I would be able to.
Batman & Robin is a film that has lived in infamy since its release in 1997. Upon release, it was critically reviled, and this hatred of the film continued long into the modern day, where it frequently tops “worst films of all time lists” to the point where it actually is listed on the Wikipedia page for “List of films considered the worst.” It was nominated for at least 11 Razzies but only won a single one, and it went on to be a frequent punching bag on the {REDACTED] Critic’s web show, where he would get irrationally angry at the mere mention of the Bat Credit Card. In contemporary reviews, Mick LaSalle of The San Francisco Chronicle stated “"George Clooney is the big zero of the film, and should go down in history as the George Lazenby of the series,” which is less of a criticism and more of a compliment, if I’m being totally honest.
Most of the stars would take a negative stance towards it as well, with legend stating that if you tell George Clooney that you saw the film in theaters, he will refund you for your ticket out of his own pocket. Chris O’Donnell likewise is not particularly fond of the film, stating "It just felt like everything got a little soft the second time. On Batman Forever, I felt like I was making a movie. The second time, I felt like I was making a kid's toy commercial." And, perhaps most depressingly, Joel Schumacher himself was apparently very apologetic for the film, though this may or may not have come about because of years and years of vitriol being directed at him for making this film.
In the wake of Mr. Schumacher’s passing, I decided to re-watch the film, as I am famously rather fond of it, and I am going to tell you all why the answer to the question “Is it really THAT bad?” is a loud, resounding, NO.
THE GOOD
There’s honestly quite a lot to like here, more than you might think. I think first and foremost what you need to understand going in is that this is a silly, cartoonish take on the Burton style, blending the silliness and camp of the West series with the drama and aesthetics of the Burton films, all while adding some over-the-top, colorful flair. John Glover, who appears in the film as a cartoonish mad scientist, even has gone on record as saying "Joel would sit on a crane with a megaphone and yell before each take, 'Remember, everyone, this is a cartoon'. It was hard to act because that kind of set the tone for the film”… the last sentence makes the statement very baffling, but at least even the actors were aware of what they were doing. If this doesn’t sound appealing, well, the opening is sure to warn you off, as it is a suiting up montage with various shots of the firm butts, large codpieces, and stiff batnipples of the Dynamic Duo. The movie is very upfront about what you’re in for.
Tumblr media
On the subject of the infamous batnipples, Schumacher stated "I had no idea that putting nipples on the Batsuit and Robin suit were going to spark international headlines. The bodies of the suits come from Ancient Greek statues, which display perfect bodies. They are anatomically correct." It seems a very odd choice, but it’s pretty clear that he meant it as an amusing little design choice and nothing more. Of course, this hasn’t stopped everyone and their mother from spewing homophobic comments about how he was purposefully making the film gayer, even from star George Clooney, who has said that he played Batman as a gay man and was told by Schumacher Batman is gay. It’s so disgusting that people did and continue to do this, because honestly, the costumes are fine, and even if they are meant to be fanservice… so what? O’Donell and Clooney’s asses look nice, as does Alicia Silverstone’s when she dons a suit. The fact hers is just as form-fitting as the other two really shows that the whole idea Schumacher did it because he was gay is ridiculous; the man was very egalitarian about the fanservice in the movie.
Whatever else Clooney says, he does a pretty great job as Batman and Bruce Wayne. His speech at the end of the film where he talks to Mr. Freeze and reminds him that he is a good man and offers to help him is honestly one of the few moments in any Batman film where Batman actually feels like the one from the animated series, a man who fights crime but also wants to help the people he’s trying to stop. Clooney just has a very natural charisma that lends himself to playing a hero, and while there are a few awkward moments in the performance, he captures the fun and charm a more lighthearted Batman should. Michael Gough’s last turn as Alfred is also surprisingly poignant, and a lot of mileage is gotten out of his genuinely tearjerking subplot.
Tumblr media
Of course, the very best part of the film is the villains. Uma Thurman is clearly having a ball as Poison Ivy, and she gets to have a ludicrous amount of costumes as well as numerous moments of fanservice. She also has the power to turn every man around her into a simp, which is absolutely amazing and leads to quite a few scenes of Batman and Robin slapping each other over her. But f course, there’s really no doubt that the best part of the film is Mr. Freeze. He’s a combination of the sillier Mr. Freeze from the West days and the more modern take of the character most are familiar with, the tragic anti-villain who wants to save his wife; such a character would take a talented man capable of comedy and drama in equal measure. And who better than Arnold Schwarzenegger? Joel Schumacher wanted a man who looked like he was chiseled from a glacier, and Arnold certainly fits that description. He spends the movie juggling some of the most corny puns you can imagine and a lot of truly powerful, understated drama, and it really does work. You honestly get the sense that Arnold really gets Mr. Freeze and what makes him a great character. Also, that suit he has is amazing.
Tumblr media
As a final note: the Bat Credit Card is absolutely not stupid. Linkara has defended it in the past, giving reasons why and how it could actually work, but really, all that needs to be said is… is this any more ridiculous than Shark Repellent Bat Spray?
Tumblr media
THE BAD
So don’t get the wrong idea here; this film is far from perfect. As is the case with any comedy, the humor can be hit or miss; not all of the puns land, not all of the jokes are great. You’re never going to get a perfect comedy no matter how hard you try, and this is no exception.
As for performances, I think O’Donnell’s Robin and Silverstone’s Batgirl are a bit wonky. O'Donnell has long been a source of derision for his whining, and while I think the hate is a bit overblown, he does spend a ludicrous amount of time in this film being snippy, miserable, and arrogant. I think he actually fights with Batman more than any of the villains! Still, his performance isn’t horrible, he just gets a bit too whiny at a few points.
Silverstone is a bit of a bigger problem, but she’s not quite as bad as even I remembered. She’s pretty much Batgirl in name only, since she’s related to Alfred in this, but she’s mostly okay. The issue really is that her arc in the film is relatively bland and feels a bit shoehorned, which comes to a head where she fights Poison Ivy in a designated catfight, obviously because they didn’t want Batman to punch a woman in the face I guess. There’s just one issue with that:
Tumblr media
On the subject of Ivy, while she definitely does have plant powers here, they’re strangely underplayed. She rarely uses them even when it would probably be beneficial, instead relying on Bane to do most of the fighting for her. Ah, Bane… Bane is one of the few things about this film I can’t really muster up any sort of defense for. While his creation scene is rather cool, it doesn’t lead to much of interest, as this version of Bane is pretty much a mindless supersoldier lackey who serves Poison Ivy. Now, this was still relatively early in Bane’s existence, as he had only debuted in 1993 and was really most famous for his signature “breaking the Bat” move, but it still is baffling why, with that famous thing fresh in everyone’s minds, that they would just choose to go and basically make Bane into Evil Diet Captain America. Surely they could have either saved him for a sequel or utilized him in a way more befitting of the character? I think this Bane is kind of responsible for the negative perception of Bane as this big, dumb bruiser, something that works like The Dark Knight Rises and Arkham Origins have thankfully gone a long way to rectifying. Bane is at his best when he’s a cunning genius bruiser; here, he’s nothing but a glorified prop.
Tumblr media
Is It Really THAT Bad?
The answer is no. No it isn’t. AT ALL.
I’ve always felt this film came out at the wrong time. It was towards the end of the 90s, during the Dark Age of Comics when everything was dark, gritty, and edgy. The world didn’t want a movie like this back then; they wanted stuff like Blade, who would come in shortly after this film and show us how to make that aesthetic work. I guess in terms of Batman they wanted something more like Dawn of Justice, which really speaks volumes to how awful the 90s were for superheroes. 
Look, I’m not trying to convince anyone this is the greatest Batman film ever. Even I don’t think that; Batman Returns, The Dark Knight, and Under the Red Hood are all much better films. But is this really the worst Batman film now that we have the deeply misogynistic and disgusting The Killing Joke and the relentlessly bleak and unpleasant Batman v Superman? Hell, it’s not even worse than Batman Forever! At least the Batman in this film has some kind of emotional range beyond “plank of wood!” And even calling it the worst sequel ever is just… so baffling. Again, this is definitely better than Batman Forever, lack of Jim Carrey notwithstanding. And can you honestly look me in the eye and tell me that this is worse than any of the Terminator sequels after the second film? Worse than Iron Man 2 or Thor: The Dark World? The almost half dozen Alvin and the Chipmunk sequels? This is only the worst sequel or even a bad sequel if it is the only sequel you’ve ever seen in your life.
A lot of the hate for it from back in the day carries a strong undercurrent of homophobia. Much like the infamous backlash against disco, it’s seriously uncomfortable, and it definitely is cruel how accusatory people were towards Schumacher’s intentions for the suits of the heroes in the film. The fact that even the two main stars have gotten in on it is a bit disgusting, though O’Donnell questioning why there needed to be a codpiece is certainly less offensive than George Clooney saying he played Batman as a gay man for… whatever reason. Was he implying that Batman being gay made the movie worse? I’m not sure what he’s on about there. Even The New Batman Adventures made a cruel dig at the film; notice the sign and the effeminate-looking boy. You could only get homophobia this good in the 90s!
Tumblr media
The hatred of this film is absolutely overblown. It’s so ridiculous. #70 on the bottom rated movies of IMDB? #1 on the 50 worst films of all time list from Empire? Doug Walker’s personal punching bag whenever he needs to talk about a bad sequel, to the point where he literally said no one wanted a comedic take on Batman in his worst sequels video? Come the fuck on.
Tumblr media
Joel Schumacher may or may not have ended up hating this film, but he certainly was made to feel like shit for making it… and it is honest to god not that bad! But he was just absolutely eviscerated, to the point where this was a fucking headline when he died:
Tumblr media
Literally fuck all of these people. Fuck io9 for their insensitive headline. Fuck Empire for rating this as the worst film ever. Fuck Doug Walker for his constant bashing and his shitty old “chimp out over the Bat Credit Card” gag. Double fuck Mick LaSalle for shitting on George Clooney’s performance while also trying to say George Lazenby’s Bond was bad. In fact, fuck George Clooney for his weird idea that playing Batman as gay is a bad thing (sorry George, but I can’t defend this). Fuck the Razzies. Yes, it was nominated, but I just feel it’s always a good time to say “Fuck the Razzies.”
I will never say you have to love or even like this film, but the sheer amount of vitriol and hatred for it is absolutely beyond me. At worst, this film is just a bit too goofy, and at best, it is a fun tribute to the campy days when Batman just couldn’t get rid of a bomb. I didn’t take off my score this time. I’m proud to say I gave this an 8/10, personally. If I’m being honest, a 6.6 – 6.9 is more appropriate, because it does have quite a few issues, but god, this film is not bad at all. It’s silly, goofy, campy, and fun… but bad? Not by any stretch of my imagination. And fuck the critics for convincing an entire generation that this is Batman at his worst, when we have Batman fucking slaughtering his ways through criminals and fucking Barbara Gordon on rooftops these days. I will always take stupid ice puns over misery, murder and creepy intergenerational sex, thank you very much.
youtube
I hope you can rest easy, Mr. Schumacher. Maybe you didn’t love your film in the end but, wherever you are, I hope you know I loved it.
34 notes · View notes
jennifersnyderca90 · 7 years
Text
Equifax or Equiphish?
More than a week after it said most people would be eligible to enroll in a free year of its TrustedID identity theft monitoring service, big three consumer credit bureau Equifax has begun sending out email notifications to people who were able to take the company up on its offer. But in yet another security stumble, the company appears to be training recipients to fall for phishing scams.
Some people who signed up for the service after Equifax announced Sept. 7 that it had lost control over Social Security numbers, dates of birth and other sensitive data on 143 million Americans are still waiting for the promised notice from Equifax. But as I recently noted on Twitter, other folks have received emails from Equifax over the past few days, and the messages do not exactly come across as having emanated from a company that cares much about trying to regain the public’s trust.
Here’s a redacted example of an email Equifax sent out to one recipient recently:
As we can see, the email purports to have been sent from trustedid.com, a domain that Equifax has owned for almost four years. However, Equifax apparently decided it was time for a new — and perhaps snazzier — name: trustedidpremier.com.
The above-pictured message says it was sent from one domain, and then asks the recipient to respond by clicking on a link to a completely different (but confusingly similar) domain.
My guess is the reason Equifax registered trustedidpremier.com was to help people concerned about the breach to see whether they were one of the 143 million people affected (for more on how that worked out for them, see Equifax Breach Response Turns Dumpster Fire). I’d further surmise that Equifax was expecting (and received) so much interest in the service as a result of the breach that all the traffic from the wannabe customers might swamp the trustedid.com site and ruin things for the people who were already signed up for the service before Equifax announced the breach on Sept. 7.
The problem with this dual-domain approach is that the domain trustedidpremier.com is only a few weeks old, so it had very little time to establish itself as a legitimate domain. As a result, in the first few hours after Equifax disclosed the breach the domain was actually flagged as a phishing site by multiple browsers because it was brand new and looked about as professionally designed as a phishing site.
What’s more, there is nothing tying the domain registration records for trustedidpremier.com to Equifax: The domain is registered to a WHOIS privacy service, which masks information about who really owns the domain (again, not exactly something you might expect from an identity monitoring site). Anyone looking for assurances that the site perhaps was hosted on Internet address space controlled by and assigned to Equifax would also be disappointed: The site is hosted at Amazon.
While there’s nothing wrong with that exactly, one might reasonably ask: Why didn’t Equifax just send the email from Equifax.com and host the ID theft monitoring service there as well? Wouldn’t that have considerably lessened any suspicion that this missive might be a phishing attempt?
Perhaps, but you see while TrustedID is technically owned by Equifax Inc., its services are separate from Equifax and its terms of service are different from those provided by Equifax (almost certainly to separate Equifax from any consumer liability associated with its monitoring service).
THE BACKSTORY
What’s super-interesting about trustedid.com is that it didn’t always belong to Equifax. According to the site’s Wikipedia page, TrustedID Inc. was purchased by Equifax in 2013, but it was founded in 2004 as an identity protection company which offered a service that let consumers automatically “freeze” their credit file at the major bureaus. A freeze prevents Equifax and the other major credit bureaus from selling an individual’s credit data without first getting consumer consent.
By 2006, some 17 states offered consumers the ability to freeze their credit files, and the credit bureaus were starting to see the freeze as an existential threat to their businesses (in which they make slightly more than a dollar each time a potential creditor — or ID thief — asks to peek at your credit file).
Other identity monitoring firms — such as LifeLock — were by then offering services that automated the placement of identity fraud controls — such as the “fraud alert,” a free service that consumers can request to block creditors from viewing their credit files.
[Author’s note: Fraud alerts only last for 90 days, although you can renew them as often as you like. More importantly, while lenders and service providers are supposed to seek and obtain your approval before granting credit in your name if you have a fraud alert on your file, they are not legally required to do this — and very often don’t.]
Anyway, the era of identity monitoring services automating things like fraud alerts and freezes on behalf of consumers effectively died after a landmark lawsuit filed by big-three bureau Experian (which has its own storied history of data breaches). In 2008, Experian sued LifeLock, arguing its practice of automating fraud alerts violated the Fair Credit Reporting Act.
In 2009, a court found in favor of Experian, and that decision effectively killed such services — mainly because none of the banks wanted to distribute them and sell them as a service anymore.
WHAT SHOULD YOU DO
These days, consumers in all states have a right to freeze their credit files, and I would strongly encourage all readers to do this. Yes, it can be a pain, and the bureaus certainly seem to be doing everything they can at the moment to make this process extremely difficult and frustrating for consumers. As detailed in the analysis section of last week’s story — Equifax Breach: Setting the Record Straight — many of the freeze sites are timing out, crashing or telling consumers just to mail in copies of identity documents and printed-out forms.
Other bureaus, like TransUnion and Experian, are trying mightily to steer consumers away from a freeze and toward their confusingly named “credit lock” services — which claim to be the same thing as freezes only better. The truth is these lock services do not prevent the bureaus from selling your credit reports to anyone who comes asking for them (including ID thieves); and consumers who opt for them over freezes must agree to receive a flood of marketing offers from a myriad of credit bureau industry partners.
While it won’t stop all forms of identity theft (such as tax refund fraud or education loan fraud), a freeze is the option that puts you the consumer in the strongest position to control who gets to monkey with your credit file. In contrast, while credit monitoring services might alert you when someone steals your identity, they’re not designed to prevent crooks from doing so.
That’s not to say credit monitoring services aren’t useful: They can be helpful in recovering from identity theft, which often involves a tedious, lengthy and expensive process for straightening out the phony activity with the bureaus.
The thing is, it’s almost impossible to sign up for credit monitoring services while a freeze is active on your credit file, so if you’re interested in signing up for them it’s best to do so before freezing your credit. But there’s no need to pay for these services: Hundreds of companies — many of which you have probably transacted with at some point in the last year — have disclosed data breaches and are offering free monitoring. California maintains one of the most comprehensive lists of companies that disclosed a breach, and most of those are offering free monitoring.
There’s a small catch with the freezes: Depending on the state in which you live, the bureaus may each be able to charge you for freezing your file (the fee ranges from $5 to $20); they may also be able to charge you for lifting or temporarily thawing your file in the event you need access to credit. Consumers Union has a decent rundown of the freeze fees by state.
In short, sign up for whatever free monitoring is available if that’s of interest, and then freeze your file at the four major bureaus. You can do this online, by phone, or through the mail. Given how unreliable the credit bureau Web sites have been for placing freezes these past few weeks, it may be easiest to do this over the phone. Here are the freeze Web sites and freeze phone numbers for each bureau (note the phone procedures can and likely will change as the bureaus get wise to more consumers learning how to quickly step through their automated voice response systems):
Equifax: 866-349-5191; choose option 3 for a “Security Freeze”
Experian: 888-397-3742; –Press 2 “To learn about fraud or ADD A SECURITY FREEZE” –Press 2 “for security freeze options” –Press 1 “to place a security freeze” –Press 2 “…for all others” –enter your info when prompted
Innovis: 800-540-2505; –Press 1 for English –Press 3 “to place or manage an active duty alert or a SECURITY FREEZE” –Press 2 “to place or manage a SECURITY FREEZE” –enter your info when prompted
Transunion: 888-909-8872, choose option 3
If you still have questions about freezes, fraud alerts, credit monitoring or anything else related to any of the above, check out the lengthy primer/Q&A I published here on Sept. 11, The Equifax Breach: What You Should Know.
from https://krebsonsecurity.com/2017/09/equifax-or-equiphish/
0 notes
nedsvallesny · 7 years
Text
Equifax or Equiphish?
More than a week after it said most people would be eligible to enroll in a free year of its TrustedID identity theft monitoring service, big three consumer credit bureau Equifax has begun sending out email notifications to people who were able to take the company up on its offer. But in yet another security stumble, the company appears to be training recipients to fall for phishing scams.
Some people who signed up for the service after Equifax announced Sept. 7 that it had lost control over Social Security numbers, dates of birth and other sensitive data on 143 million Americans are still waiting for the promised notice from Equifax. But as I recently noted on Twitter, other folks have received emails from Equifax over the past few days, and the messages do not exactly come across as having emanated from a company that cares much about trying to regain the public’s trust.
Here’s a redacted example of an email Equifax sent out to one recipient recently:
As we can see, the email purports to have been sent from trustedid.com, a domain that Equifax has owned for almost four years. However, Equifax apparently decided it was time for a new — and perhaps snazzier — name: trustedidpremier.com.
The above-pictured message says it was sent from one domain, and then asks the recipient to respond by clicking on a link to a completely different (but confusingly similar) domain.
My guess is the reason Equifax registered trustedidpremier.com was to help people concerned about the breach to see whether they were one of the 143 million people affected (for more on how that worked out for them, see Equifax Breach Response Turns Dumpster Fire). I’d further surmise that Equifax was expecting (and received) so much interest in the service as a result of the breach that all the traffic from the wannabe customers might swamp the trustedid.com site and ruin things for the people who were already signed up for the service before Equifax announced the breach on Sept. 7.
The problem with this dual-domain approach is that the domain trustedidpremier.com is only a few weeks old, so it had very little time to establish itself as a legitimate domain. As a result, in the first few hours after Equifax disclosed the breach the domain was actually flagged as a phishing site by multiple browsers because it was brand new and looked about as professionally designed as a phishing site.
What’s more, there is nothing tying the domain registration records for trustedidpremier.com to Equifax: The domain is registered to a WHOIS privacy service, which masks information about who really owns the domain (again, not exactly something you might expect from an identity monitoring site). Anyone looking for assurances that the site perhaps was hosted on Internet address space controlled by and assigned to Equifax would also be disappointed: The site is hosted at Amazon.
While there’s nothing wrong with that exactly, one might reasonably ask: Why didn’t Equifax just send the email from Equifax.com and host the ID theft monitoring service there as well? Wouldn’t that have considerably lessened any suspicion that this missive might be a phishing attempt?
Perhaps, but you see while TrustedID is technically owned by Equifax Inc., its services are separate from Equifax and its terms of service are different from those provided by Equifax (almost certainly to separate Equifax from any consumer liability associated with its monitoring service).
THE BACKSTORY
What’s super-interesting about trustedid.com is that it didn’t always belong to Equifax. According to the site’s Wikipedia page, TrustedID Inc. was purchased by Equifax in 2013, but it was founded in 2004 as an identity protection company which offered a service that let consumers automatically “freeze” their credit file at the major bureaus. A freeze prevents Equifax and the other major credit bureaus from selling an individual’s credit data without first getting consumer consent.
By 2006, some 17 states offered consumers the ability to freeze their credit files, and the credit bureaus were starting to see the freeze as an existential threat to their businesses (in which they make slightly more than a dollar each time a potential creditor — or ID thief — asks to peek at your credit file).
Other identity monitoring firms — such as LifeLock — were by then offering services that automated the placement of identity fraud controls — such as the “fraud alert,” a free service that consumers can request to block creditors from viewing their credit files.
[Author’s note: Fraud alerts only last for 90 days, although you can renew them as often as you like. More importantly, while lenders and service providers are supposed to seek and obtain your approval before granting credit in your name if you have a fraud alert on your file, they are not legally required to do this — and very often don’t.]
Anyway, the era of identity monitoring services automating things like fraud alerts and freezes on behalf of consumers effectively died after a landmark lawsuit filed by big-three bureau Experian (which has its own storied history of data breaches). In 2008, Experian sued LifeLock, arguing its practice of automating fraud alerts violated the Fair Credit Reporting Act.
In 2009, a court found in favor of Experian, and that decision effectively killed such services — mainly because none of the banks wanted to distribute them and sell them as a service anymore.
WHAT SHOULD YOU DO
These days, consumers in all states have a right to freeze their credit files, and I would strongly encourage all readers to do this. Yes, it can be a pain, and the bureaus certainly seem to be doing everything they can at the moment to make this process extremely difficult and frustrating for consumers. As detailed in the analysis section of last week’s story — Equifax Breach: Setting the Record Straight — many of the freeze sites are timing out, crashing or telling consumers just to mail in copies of identity documents and printed-out forms.
Other bureaus, like TransUnion and Experian, are trying mightily to steer consumers away from a freeze and toward their confusingly named “credit lock” services — which claim to be the same thing as freezes only better. The truth is these lock services do not prevent the bureaus from selling your credit reports to anyone who comes asking for them (including ID thieves); and consumers who opt for them over freezes must agree to receive a flood of marketing offers from a myriad of credit bureau industry partners.
While it won’t stop all forms of identity theft (such as tax refund fraud or education loan fraud), a freeze is the option that puts you the consumer in the strongest position to control who gets to monkey with your credit file. In contrast, while credit monitoring services might alert you when someone steals your identity, they’re not designed to prevent crooks from doing so.
That’s not to say credit monitoring services aren’t useful: They can be helpful in recovering from identity theft, which often involves a tedious, lengthy and expensive process for straightening out the phony activity with the bureaus.
The thing is, it’s almost impossible to sign up for credit monitoring services while a freeze is active on your credit file, so if you’re interested in signing up for them it’s best to do so before freezing your credit. But there’s no need to pay for these services: Hundreds of companies — many of which you have probably transacted with at some point in the last year — have disclosed data breaches and are offering free monitoring. California maintains one of the most comprehensive lists of companies that disclosed a breach, and most of those are offering free monitoring.
There’s a small catch with the freezes: Depending on the state in which you live, the bureaus may each be able to charge you for freezing your file (the fee ranges from $5 to $20); they may also be able to charge you for lifting or temporarily thawing your file in the event you need access to credit. Consumers Union has a decent rundown of the freeze fees by state.
In short, sign up for whatever free monitoring is available if that’s of interest, and then freeze your file at the four major bureaus. You can do this online, by phone, or through the mail. Given how unreliable the credit bureau Web sites have been for placing freezes these past few weeks, it may be easiest to do this over the phone. Here are the freeze Web sites and freeze phone numbers for each bureau (note the phone procedures can and likely will change as the bureaus get wise to more consumers learning how to quickly step through their automated voice response systems):
Equifax: 866-349-5191; choose option 3 for a “Security Freeze”
Experian: 888-397-3742; –Press 2 “To learn about fraud or ADD A SECURITY FREEZE” –Press 2 “for security freeze options” –Press 1 “to place a security freeze” –Press 2 “…for all others” –enter your info when prompted
Innovis: 800-540-2505; –Press 1 for English –Press 3 “to place or manage an active duty alert or a SECURITY FREEZE” –Press 2 “to place or manage a SECURITY FREEZE” –enter your info when prompted
Transunion: 888-909-8872, choose option 3
If you still have questions about freezes, fraud alerts, credit monitoring or anything else related to any of the above, check out the lengthy primer/Q&A I published here on Sept. 11, The Equifax Breach: What You Should Know.
from Technology News https://krebsonsecurity.com/2017/09/equifax-or-equiphish/
0 notes
amberdscott2 · 7 years
Text
Equifax or Equiphish?
More than a week after it said most people would be eligible to enroll in a free year of its TrustedID identity theft monitoring service, big three consumer credit bureau Equifax has begun sending out email notifications to people who were able to take the company up on its offer. But in yet another security stumble, the company appears to be training recipients to fall for phishing scams.
Some people who signed up for the service after Equifax announced Sept. 7 that it had lost control over Social Security numbers, dates of birth and other sensitive data on 143 million Americans are still waiting for the promised notice from Equifax. But as I recently noted on Twitter, other folks have received emails from Equifax over the past few days, and the messages do not exactly come across as having emanated from a company that cares much about trying to regain the public’s trust.
Here’s a redacted example of an email Equifax sent out to one recipient recently:
As we can see, the email purports to have been sent from trustedid.com, a domain that Equifax has owned for almost four years. However, Equifax apparently decided it was time for a new — and perhaps snazzier — name: trustedidpremier.com.
The above-pictured message says it was sent from one domain, and then asks the recipient to respond by clicking on a link to a completely different (but confusingly similar) domain.
My guess is the reason Equifax registered trustedidpremier.com was to help people concerned about the breach to see whether they were one of the 143 million people affected (for more on how that worked out for them, see Equifax Breach Response Turns Dumpster Fire). I’d further surmise that Equifax was expecting (and received) so much interest in the service as a result of the breach that all the traffic from the wannabe customers might swamp the trustedid.com site and ruin things for the people who were already signed up for the service before Equifax announced the breach on Sept. 7.
The problem with this dual-domain approach is that the domain trustedidpremier.com is only a few weeks old, so it had very little time to establish itself as a legitimate domain. As a result, in the first few hours after Equifax disclosed the breach the domain was actually flagged as a phishing site by multiple browsers because it was brand new and looked about as professionally designed as a phishing site.
What’s more, there is nothing tying the domain registration records for trustedidpremier.com to Equifax: The domain is registered to a WHOIS privacy service, which masks information about who really owns the domain (again, not exactly something you might expect from an identity monitoring site). Anyone looking for assurances that the site perhaps was hosted on Internet address space controlled by and assigned to Equifax would also be disappointed: The site is hosted at Amazon.
While there’s nothing wrong with that exactly, one might reasonably ask: Why didn’t Equifax just send the email from Equifax.com and host the ID theft monitoring service there as well? Wouldn’t that have considerably lessened any suspicion that this missive might be a phishing attempt?
Perhaps, but you see while TrustedID is technically owned by Equifax Inc., its services are separate from Equifax and its terms of service are different from those provided by Equifax (almost certainly to separate Equifax from any consumer liability associated with its monitoring service).
THE BACKSTORY
What’s super-interesting about trustedid.com is that it didn’t always belong to Equifax. According to the site’s Wikipedia page, TrustedID Inc. was purchased by Equifax in 2013, but it was founded in 2004 as an identity protection company which offered a service that let consumers automatically “freeze” their credit file at the major bureaus. A freeze prevents Equifax and the other major credit bureaus from selling an individual’s credit data without first getting consumer consent.
By 2006, some 17 states offered consumers the ability to freeze their credit files, and the credit bureaus were starting to see the freeze as an existential threat to their businesses (in which they make slightly more than a dollar each time a potential creditor — or ID thief — asks to peek at your credit file).
Other identity monitoring firms — such as LifeLock — were by then offering services that automated the placement of identity fraud controls — such as the “fraud alert,” a free service that consumers can request to block creditors from viewing their credit files.
[Author’s note: Fraud alerts only last for 90 days, although you can renew them as often as you like. More importantly, while lenders and service providers are supposed to seek and obtain your approval before granting credit in your name if you have a fraud alert on your file, they are not legally required to do this — and very often don’t.]
Anyway, the era of identity monitoring services automating things like fraud alerts and freezes on behalf of consumers effectively died after a landmark lawsuit filed by big-three bureau Experian (which has its own storied history of data breaches). In 2008, Experian sued LifeLock, arguing its practice of automating fraud alerts violated the Fair Credit Reporting Act.
In 2009, a court found in favor of Experian, and that decision effectively killed such services — mainly because none of the banks wanted to distribute them and sell them as a service anymore.
WHAT SHOULD YOU DO
These days, consumers in all states have a right to freeze their credit files, and I would strongly encourage all readers to do this. Yes, it can be a pain, and the bureaus certainly seem to be doing everything they can at the moment to make this process extremely difficult and frustrating for consumers. As detailed in the analysis section of last week’s story — Equifax Breach: Setting the Record Straight — many of the freeze sites are timing out, crashing or telling consumers just to mail in copies of identity documents and printed-out forms.
Other bureaus, like TransUnion and Experian, are trying mightily to steer consumers away from a freeze and toward their confusingly named “credit lock” services — which claim to be the same thing as freezes only better. The truth is these lock services do not prevent the bureaus from selling your credit reports to anyone who comes asking for them (including ID thieves); and consumers who opt for them over freezes must agree to receive a flood of marketing offers from a myriad of credit bureau industry partners.
While it won’t stop all forms of identity theft (such as tax refund fraud or education loan fraud), a freeze is the option that puts you the consumer in the strongest position to control who gets to monkey with your credit file. In contrast, while credit monitoring services might alert you when someone steals your identity, they’re not designed to prevent crooks from doing so.
That’s not to say credit monitoring services aren’t useful: They can be helpful in recovering from identity theft, which often involves a tedious, lengthy and expensive process for straightening out the phony activity with the bureaus.
The thing is, it’s almost impossible to sign up for credit monitoring services while a freeze is active on your credit file, so if you’re interested in signing up for them it’s best to do so before freezing your credit. But there’s no need to pay for these services: Hundreds of companies — many of which you have probably transacted with at some point in the last year — have disclosed data breaches and are offering free monitoring. California maintains one of the most comprehensive lists of companies that disclosed a breach, and most of those are offering free monitoring.
There’s a small catch with the freezes: Depending on the state in which you live, the bureaus may each be able to charge you for freezing your file (the fee ranges from $5 to $20); they may also be able to charge you for lifting or temporarily thawing your file in the event you need access to credit. Consumers Union has a decent rundown of the freeze fees by state.
In short, sign up for whatever free monitoring is available if that’s of interest, and then freeze your file at the four major bureaus. You can do this online, by phone, or through the mail. Given how unreliable the credit bureau Web sites have been for placing freezes these past few weeks, it may be easiest to do this over the phone. Here are the freeze Web sites and freeze phone numbers for each bureau (note the phone procedures can and likely will change as the bureaus get wise to more consumers learning how to quickly step through their automated voice response systems):
Equifax: 866-349-5191; choose option 3 for a “Security Freeze”
Experian: 888-397-3742; –Press 2 “To learn about fraud or ADD A SECURITY FREEZE” –Press 2 “for security freeze options” –Press 1 “to place a security freeze” –Press 2 “…for all others” –enter your info when prompted
Innovis: 800-540-2505; –Press 1 for English –Press 3 “to place or manage an active duty alert or a SECURITY FREEZE” –Press 2 “to place or manage a SECURITY FREEZE” –enter your info when prompted
Transunion: 888-909-8872, choose option 3
If you still have questions about freezes, fraud alerts, credit monitoring or anything else related to any of the above, check out the lengthy primer/Q&A I published here on Sept. 11, The Equifax Breach: What You Should Know.
from Amber Scott Technology News https://krebsonsecurity.com/2017/09/equifax-or-equiphish/
0 notes