US Senate report on Equifax breach [pdf]
Just skimmed the table of contents. Looks like the vast majority of the report is investigating their patch policy. Okay. Fine. It was bad. But really, I think they missed the point.<p>What I really wanted to see was some discussion about how vulnerable the entire US identity system is in the first place. The data is mostly valuable to hackers because there's an assumption that anyone with a birthday, social security number, etc is the person they claim to be.<p>A verified twitter account shouldn't be more secure than the best the government can offer. Governments need to step up with an modern identity system. Having one secret social security number for life is ridiculous. Having to do financial transactions in-person at a bank so you can present your driver's license and sign with a pen is ridiculous.<p>You shouldn't need to use a social security number directly. There should be a token system where you authorize companies to reference your data. Just like using twitter to sign into another service. You verify that you're actually the owner of that identity.<p>The US needs to learn that social security numbers were never meant to be used as identifiers. It's awful. Just fix the real problem.