Identity thieves bypassed Experian security to view credit reports
> you simply change the last part of the URL from “/acr/oow/” to “/acr/report,” and the site would display the consumer’s full credit report.<p>Oh wow, that's one of the dumbest security hole I've seen so far. That means you're either authenticated in the first screen, or the second assumes that you are whom you say you are if you lend on it. There's a clear lack of ethics from whomever built that, whom either didn't care, or didn't know enough know enough to excuse themselves from building it and ask for assistance.<p>I mean, this is not your regular system. Everyone is in there, not that they have much of a choice, and it's their most sensitive data, that you decide you're up to the task to protect.<p>I'm all for learning from your mistakes and I'm the first one to screw up once in a while, and to admit that I am not a security expert. But the size of this combined with how freaking dumb this issue is... This is most likely gross negligence. In most of other industries where people call themselves engineers, you would be putting your own professional reputation on the line when deciding you're up to the task. Then you would get in front of am ethics commission and likely get your license suspended or revoked.