<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.0 Transitional//EN'>

<html><head><title>531096-00087.htm</title>

<meta name='vs_defaultClientScript' content='JavaScript'>

<meta http-equiv="Content-Type" content="text/html; charset=utf-8">

<meta name='vs_targetSchema' content='http://schemas.microsoft.com/intellisense/ie3-2nav3-0'>

<meta name='Originator' content='CommentWorks'></head><body><Table>

<tr><td><b>Comment Number: </b></td><td>531096-00087</td></tr>

<tr><td><b>Received: </b></td><td>8/6/2007 3:26:10 PM</td></tr>

<tr><td><b>Organization: </b></td><td></td></tr>

<tr><td><b>Commenter: </b></td><td>Comfort</td></tr>

<tr><td><b>State: </b></td><td>MD</td></tr>

<tr><td><b>Agency: </b></td><td>Federal Trade Commission</td></tr>

<tr><td><b>Rule: </b></td><td>Private Sector Use of SSNs</td></tr>

<tr><td>No Attachments</td></tr></Table>

<hr><P><b>Comments:</b></p>Experian uses the SSN in a dangerous way on their website for authentication. In order to log in, a username and password is asked for first. After the username and password are accepted, it asks for your full SSN. Spoofing the website to accept any username/password pair and then requesting a SSN could easily allow any phisher access not only to a user's SSN, but also to the user's Experian credit report. This "security" enhancement on Experian's site is ill conceived and is not necessary to ensure security. </body></html>