Using last four digits of Social Security number as password

Question

I attended a small community college and our network/user login to campus computers were our student ID as the username, and the last 4 digits of our SSN as the password. I thought nothing of it while I attended, but thinking back it seems unusual. Let me be clear about a few points.

• All login verbiage specifically stated this information. So it was well know and not just limited to my login
• You could not change your username or password for any reason
• You could not login to their system outside campus

Perhaps I'm overreacting, but it doesn't seem like a good practice. Not only is the password short and limited to digits, but it's a partial SSN. Anyone else ever encounter this? Is there a security risk?

Answer 1

The risk is that anyone who guesses your password can now also find your full SSN.

The first three digits of your SSN are based on where you were born (public information), while the next two are based on when you were born (also public information). This leaves only the final four digits as secret information.

In normal usage, this isn't a major problem: an employer or bank isn't going to let you hand in thousands of fake Social Security cards until you come up with one where the name and number match. But with the system you describe, an attacker can sit in front of a terminal, patiently entering numbers until they succeed.