Shocking Poor Security at the Social Security Administration
plus.google.com
Shocking Poor Security at the Social Security Administration
1–10 of 18 posts
Re: Shocking Poor Security at the Social Security Administration
#2This is why the government desperately needs to keep 18F/US Digital Service so they can keep modernizing these sites.
Re: Shocking Poor Security at the Social Security Administration
#3If Trump wants to put his name on some silver bullet modernization, he'd do well to get rid of these 9 digit albatrosses, and transition to a new identifier format.
Sunset these ###-##-#### format numbers and deprecate their use. (especially forbidding private sector credit report usage, and the like)
Migrate everyone to a stronger ID system, that's secured according to modern standards, and retire each old number as it's converted. Put measures in place so that the new numbers cannot and must not be used for purposes other than government benefit transactions.
I am so sick of being asked by fantastically stupid HR and Data Security goons to do pathetically inadequate tasks, such as:
Please download this SSN_HumanResources.exe
file and double click to run it on your
local machine. This program requires you
to install the .NET runtime, version 3.0 or
higher. Your "C:\" drive will be subjected
to a full text scan of all files, to ensure
that you are not retaining SSN information
provided by fellow employees. When finished,
please download, print out, sign and fax a
copy of the affirmation form to Bob in HR at
(555) 555-5555.
Thank you,
Data Security
Re: Shocking Poor Security at the Social Security Administration
#4What login rate-limiting, account lock-out, and password expiry policies do they have though?
Based on the password requirements, they have something like 2.6 trillion possible passwords. If your account is locked out after 3 failed login attempts, if they limit to one attempt per second, or if they have a forced password change every month, etc. there are a number of ways to tighten this up.
Their password policy is anachronistic, and this /could/ be a symptom of other issues. However by itself, it seems more like a usability issue than a security issue.
In fact, they could be attempting to discourage password reuse with other sites. That would be a security bonus if it worked (I doubt it works).
Re: Shocking Poor Security at the Social Security Administration
#5What login rate-limiting, account lock-out, and password expiry policies do they have though? Based on the password requirements, they have something like 2.6 trillion possible passwords. If your account is locked out after 3 failed login attempts, if they limit to one attempt per second, or if they have a forced password change every month, etc. there are a number of ways to tighten this up. Their password policy is…
From the screenshot, it looks like they enforce password changes every 90 days.
Re: Shocking Poor Security at the Social Security Administration
#6This sounds like someone tazering a guard at the SSA. *shockingly
If you're mad about 8 char mandatory case insensitive password rules maybe leaking data, you'll probably be super mad when they just lose the whole db on their end to hacks. Perhaps they should code a 2fa option through one of the many useful api's, as so many other companies have.
Re: Shocking Poor Security at the Social Security Administration
#7This is why the government desperately needs to keep 18F/US Digital Service so they can keep modernizing these sites.
You misunderstand. The current party in power wants this dysfunction so they can justify further cuts. See the with-holding funds from Obamacare and forcing the post office to save for healthcare decades before those who would use it could require it.
Re: Shocking Poor Security at the Social Security Administration
#8This is why the government desperately needs to keep 18F/US Digital Service so they can keep modernizing these sites.
You misunderstand. The current party in power wants this dysfunction so they can justify further cuts. See the with-holding funds from Obamacare and forcing the post office to save for healthcare decades before those who would use it could require it.
Oh I know. I'm sure there are shady back-room deals lined with kickbacks from shitty contractors who will overcharge the government (tax payers) for systems that don't do what they need to and will have to be redeveloped every 5 years.
Re: Shocking Poor Security at the Social Security Administration
#9Some banks do this too. They store the password in the clear then at login ask for the Nth character of your password (rather than the whole password).
That obviously means that the whole password is rarely sent over the network. It also means that they can use the same validation system over the phone for telephone banking.
The system is however far from ideal of course.
Re: Shocking Poor Security at the Social Security Administration
#10They also have more than 60 million lines of COBOL in production.
Cite: http://oig.ssa.gov/sites/default/files/audit/full/pdf/A-14-1...