On: Mark Karpeles' blog hacked

[mpyne]

> The point being that "identity theft" is typically used to shift responsibility to the individual from institutions.

That's hasn't been the case for me. Each of the several times my data was taken and there was the possibility of identity theft, the company responsible ended up having to pay for various monitoring schemes.

And should that data have been used fradulently, it would still have been the fault of whatever person took that data, not the institution that misproperly handled it.

[dredmorbius → mpyne]

the company responsible ended up having to pay for various monitoring schemes

And who did the monitoring?

That's pretty much my point: you have to keep track over use of credentials in your name, and fight these in a court of law.

There's little or no criminal liability on financial or information bureaus for getting information wrong.

That is: the onus is on the individual, not the system.

[mikeash → dredmorbius]

This is all very interesting, but what does the terminology of "identity theft" have to do with any of it?

[dredmorbius → mikeash]

It's not that "my identity has been stolen". It's that financial institutions (and others) have established procedures for freely creating binding obligations in my name on the flimsiest of actual evidence. It's fraud, enabled by financial institution's weak procedures.