USAA Epic Collapse

[Lord Ratner]

1 hour ago, brabus said:

At what point in the bumper replacement process did you put a VIN in? Also, this is an example that really makes me want to VPN/encrypt my entire network, not just run the app on a phone while I’m on airport Wi-Fi or something like that.

A VPN and or encryption would do absolutely nothing to prevent what's being discussed here. 

It prevents your ISP from seeing where your traffic is being directed (the traffic itself is already encrypted and beyond your ISP's ability to read), but the ISP is the tiniest player in the game of data brokerage.

[disgruntledemployee]

2 hours ago, Smokin said:

Not just insurance companies.  Gotta watch out anytime you put a VIN in ANY system.  Had a driving lesson for my kid go badly and hit a tree going slow enough that the bumper broke, but that was it.  Found a new bumper online and replaced it myself.  A few years later, went to sell and Carfax showed it as an accident.  Crazy and a bit scary that they could pull info on something like that.  It was at our house, so no one besides my family and my google search/credit cards knew anything happened but Carfax found it.

Another USAA story.  Fender bender (well more like the hood and grill).  USAA said to take pics and upload vs taking it to a shop for the estimate. I said sure, but just give me the estimate. We'll as it's a 2006 and costs exceeded their tolerance for my state, they "Totaled" it without my knowledge/input.  I am told em to delete the claim, I'll do it myself.  They say nope, once they total it, it can't be undone.  MFers!  So I tell em I'll take their money and deduct salvage value, I'm keeping my baby.  To release funds, they want the title, but I inform them that my state doesn't require that for cars 10+ years old.  They actually agree.  I take the cash, get it repaired for.... the value of the claim minus my deductible.  And I didn't have to do a salvage title goat rope.  The nice thing at the end, a Carfax VIN run doesn't show the accident because I think I paid for it and it wasn't a designated repair shop for USAA (avoid those).  The shop was at one time, but the shop got tired of dealing with em. Car drives straight, got a new bumper cover and hood, and it looks shiny.

As for Lexis Nexis, you can dispute info.  It's a chore but worth the effort.

[Smokin]

5 hours ago, brabus said:

At what point in the bumper replacement process did you put a VIN in? Also, this is an example that really makes me want to VPN/encrypt my entire network, not just run the app on a phone while I’m on airport Wi-Fi or something like that.

On the parts website to make sure it matches.  Lesson learned, skip the VIN on any parts search.  My guess is Carfax or someone like them buys the data from the parts website to increase their own database, so when you search for a new bumper, the assumption is there was an accident that necessitated a new bumper.  A poor assumption as it could have been bad factory paint, or maybe I just wanted a new bumper.  But by the time I realized it, it was too late to challenge the data, assuming there even is a way to challenge the data.

VPN wouldn't help with that as no one relevant to this has access to any of my internet data (at least that we know of....).  I use a VPN anytime I'm not at home, to include my phone.  There was an interesting recommendation from some cyber think tank recommending high profile individuals to actually not use VPNs so obviously they're not a magic bullet.  Luckily I'm pretty much the opposite of high profile.

[brabus]

@Smokin What’s with the rec to not use a VPN? I figure more encryption and creating a harder path to finding your internet travels is a good thing. Genuinely curious.

[brabus]

8 hours ago, Lord Ratner said:

A VPN and or encryption would do absolutely nothing to prevent what's being discussed here. 

 

Copy on the input VIN, just an indirect reminder of that topic for me. Maybe I need another topic on this - seriously curious on what guys are doing for personal security on the web. If VPN isn’t the right thing for us regular guys, then what is?

[Smokin]

4 hours ago, brabus said:

@Smokin What’s with the rec to not use a VPN? I figure more encryption and creating a harder path to finding your internet travels is a good thing. Genuinely curious.

https://www.pcmag.com/news/the-feds-have-some-advice-for-highly-targeted-individuals-dont-use-a-vpn

I don't think that you and I are currently the people being targeted.  The concern is the VPN itself gets hacked and then everything you're sending gets intercepted when you think it is GTG.  Not a problem for us, at least not for a little while yet.  Also, may be just the free or lower end VPNs, so could be defeated/mitigated by using a quality subscription.  Kinda like a home break in or mugging, random people like us just need to make it difficult enough for a bad actor to chose another target.  A national politician or celebrity needs a totally different level of protection.

I strongly agree with using a VPN for the things you said and I use one myself 100% of the time I'm not on my home internet.  Will be interesting to see if that holds true in the long run.  I think it will for the higher end subscription ones like Nord.  When traveling, I think you'd be borderline crazy to not use a VPN for a hotel wifi.  And you would think that just using cell data is fine, until someone makes a fake cell tower and intercepts data that way, which is happening.

[ViperMan]

22 hours ago, Smokin said:

https://www.pcmag.com/news/the-feds-have-some-advice-for-highly-targeted-individuals-dont-use-a-vpn

I don't think that you and I are currently the people being targeted.  The concern is the VPN itself gets hacked and then everything you're sending gets intercepted when you think it is GTG.  Not a problem for us, at least not for a little while yet.  Also, may be just the free or lower end VPNs, so could be defeated/mitigated by using a quality subscription.  Kinda like a home break in or mugging, random people like us just need to make it difficult enough for a bad actor to chose another target.  A national politician or celebrity needs a totally different level of protection.

I strongly agree with using a VPN for the things you said and I use one myself 100% of the time I'm not on my home internet.  Will be interesting to see if that holds true in the long run.  I think it will for the higher end subscription ones like Nord.  When traveling, I think you'd be borderline crazy to not use a VPN for a hotel wifi.  And you would think that just using cell data is fine, until someone makes a fake cell tower and intercepts data that way, which is happening.

VPN or not, isn't all your traffic encrypted while you're on https???

[Smokin]

Disclaimer, I'm not a computer nerd, so I'm sure many people here will be able to amplify/correct this:

Yes, https encrypts your data between your browser and the server.  Which is why when I'm at home, I don't use the VPN. 

However, when you're on a network you don't trust, which should basically be any that isn't yours, there is a pretty high amount of traffic and peripheral information that is visible to anyone that knows how to look for it.  Think of the https as you sending a message in code over the radio with both the sender and the recipient named in the clear.  Anyone with a radio can hear that you are talking to site X, W, and Z.  The VPN takes that same coded message, but now encrypts it a second time and all anyone can see is that you're sending data to site Y.  The VPN (site Y) in turn talks to X,W, and Z, but the person monitoring the network can't see that.  Its just another layer of protection and protecting information that isn't protected with https.