Undoubtedly Equifax will claim that the hackers were agents of a sovereign power, to escape liability. Regardless, they admitted on their own web page that there was a flaw in their web application.
Biometrics would be a terrible idea. Mass surveillance, anyone?
> Biometrics would be a terrible idea. Mass surveillance, anyone?
What if the biometrics were stored on something you have - say a smartcard (definitely not a phone!)? Along with a PIN. Plus, these two items went into a "write only" store on the card (actually, a hashed value of both are stored).
You have a card reader (one at home - and any place you are doing a transaction to confirm identity also has one). You put in your card. Type your PIN. Present your (physical) biometric.
The reader takes the data, passes it to the card (or maybe the card has the reader and pin pad?). The card runs the hashing again, and compares the values. If all is good, it outputs a "Yes" otherwise a "No".
Remember, only the card holds the data (a hashed version) of the biometric and the PIN. That can only be written (you can do this with your terminal at home?). The only output the card has is that "yes/no" value.
All transactions of such nature would be done with this card.
I'm probably missing some steps or such - but the idea is there. That gives a 3-factor authentication system.
Biometrics would be a terrible idea. Mass surveillance, anyone?