Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shocking Poor Security at the Social Security Administration

plus.google.com

Post reply on HN
Print view View original

11–18 of 18 posts

Re: Shocking Poor Security at the Social Security Administration

#11

Post by forgotpwtomain »

GICodeWarrior wrote: post #4

What login rate-limiting, account lock-out, and password expiry policies do they have though? Based on the password requirements, they have something like 2.6 trillion possible passwords. If your account is locked out after 3 failed login attempts, if they limit to one attempt per second, or if they have a forced password change every month, etc. there are a number of ways to tighten this up. Their password policy is…

> If your account is locked out after 3 failed login attempts, if they limit to one attempt per second,

The point of effective passwords isn't that someone is going to guess it on login - it's that if the database gets dumped all the passwords aren't recoverable from the hashes.

Re: Shocking Poor Security at the Social Security Administration

#12

Post by tomohawk »

What else would you expect? They can't go out of business. They are so sacred that they appear immune to any sort of political reform. There's no chance of anyone getting fired for keeping things as they are. To change things would paradoxically be more risky.

Re: Shocking Poor Security at the Social Security Administration

#13

Post by netsharc »

tritosomal wrote: post #3

If Trump wants to put his name on some silver bullet modernization, he'd do well to get rid of these 9 digit albatrosses, and transition to a new identifier format. Sunset these ###-##-#### format numbers and deprecate their use. (especially forbidding private sector credit report usage, and the like) Migrate everyone to a stronger ID system, that's secured according to modern standards, and retire each old number as…

Hah. I wonder if that program can see into Zip files. Or tar.gz ones. Or rar ones. And what will they do with password-protected Zip files?

Or... the USB stick using the D:\ drive?

Re: Shocking Poor Security at the Social Security Administration

#16

Post by GICodeWarrior »

forgotpwtomain wrote: post #11
GICodeWarrior wrote: post #4

What login rate-limiting, account lock-out, and password expiry policies do they have though? Based on the password requirements, they have something like 2.6 trillion possible passwords. If your account is locked out after 3 failed login attempts, if they limit to one attempt per second, or if they have a forced password change every month, etc. there are a number of ways to tighten this up. Their password policy is…

> If your account is locked out after 3 failed login attempts, if they limit to one attempt per second, The point of effective passwords isn't that someone is going to guess it on login - it's that if the database gets dumped all the passwords aren't recoverable from the hashes.

The security of passwords at rest depends on how they are stored. Further, if an SSA database is dumped, passwords won't be the data exposure people are upset about.

Re: Shocking Poor Security at the Social Security Administration

#17

Post by GFK_of_xmaspast »

tomschlick wrote: post #8
noobermin wrote: post #7

Earlier quoted context omitted.

You misunderstand. The current party in power wants this dysfunction so they can justify further cuts. See the with-holding funds from Obamacare and forcing the post office to save for healthcare decades before those who would use it could require it.

Oh I know. I'm sure there are shady back-room deals lined with kickbacks from shitty contractors who will overcharge the government (tax payers) for systems that don't do what they need to and will have to be redeveloped every 5 years.

That's essentially all for-profit contractors.

Re: Shocking Poor Security at the Social Security Administration

#18

Post by forgotpwtomain »

GICodeWarrior wrote: post #16
forgotpwtomain wrote: post #11

Earlier quoted context omitted.

> If your account is locked out after 3 failed login attempts, if they limit to one attempt per second, The point of effective passwords isn't that someone is going to guess it on login - it's that if the database gets dumped all the passwords aren't recoverable from the hashes.

The security of passwords at rest depends on how they are stored. Further, if an SSA database is dumped, passwords won't be the data exposure people are upset about.

> The security of passwords at rest depends on how they are stored.

Insecure passwords are insecure at rest no matter how they are stored..

Post reply on HN