2

I attended a small community college and our network/user login to campus computers were our student ID as the username, and the last 4 digits of our SSN as the password. I thought nothing of it while I attended, but thinking back it seems unusual. Let me be clear about a few points.

  • All login verbiage specifically stated this information. So it was well know and not just limited to my login
  • You could not change your username or password for any reason
  • You could not login to their system outside campus

Perhaps I'm overreacting, but it doesn't seem like a good practice. Not only is the password short and limited to digits, but it's a partial SSN. Anyone else ever encounter this? Is there a security risk?

  • 3
    your SSN is partially public info, so this scheme violates some pretty basic credential models – schroeder Aug 8 '16 at 20:59
  • 4
    Any system that doesn't allow you to change your password has serious security concerns. – Neil Smithline Aug 8 '16 at 22:04
2

The risk is that anyone who guesses your password can now also find your full SSN.

The first three digits of your SSN are based on where you were born (public information), while the next two are based on when you were born (also public information). This leaves only the final four digits as secret information.

In normal usage, this isn't a major problem: an employer or bank isn't going to let you hand in thousands of fake Social Security cards until you come up with one where the name and number match. But with the system you describe, an attacker can sit in front of a terminal, patiently entering numbers until they succeed.

  • The OP states that only the last four of the SSN is used as password. – Neil Smithline Aug 8 '16 at 21:57
  • The OP states that only the last four of the SSN is used as password. The title was misleading - I edited it to make it match the text of the OP better. – Neil Smithline Aug 8 '16 at 22:04
  • "The middle two digits are the group number. The group numbers range from 01 to 99. However, they are not assigned in consecutive order. For administrative reasons, group numbers are issued in the following order..." - Source – Bacon Brad Aug 8 '16 at 23:06
  • 2
    Also as of 2011 all the above information is no longer valid as it switched to a randomize system. Under the randomization system you couldn't predict her SSN if you tried. – Bacon Brad Aug 8 '16 at 23:25
  • 3
    Oh good, so all those 5-year-olds going to this college are safe! – Ben Aug 9 '16 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.