I believe the bank where I have my savings account is using this IP for their login system ... I don't know whether Equifax provides it or not. I guess the other question is whether this can be invalidated by prior art. It also seems obvious and common to me but I can't say whether it was in 2004 either.