I attended a small community college and our network/user login to campus computers were our student ID as the username, and the last 4 digits of our SSN as the password. I thought nothing of it while I attended, but thinking back it seems unusual. Let me be clear about a few points.

  • All login verbiage specifically stated this information. So it was well know and not just limited to my login
  • You could not change your username or password for any reason
  • You could not login to their system outside campus

Perhaps I'm overreacting, but it doesn't seem like a good practice. Not only is the password short and limited to digits, but it's a partial SSN. Anyone else ever encounter this? Is there a security risk?

  • 3
    your SSN is partially public info, so this scheme violates some pretty basic credential models
    – schroeder
    Aug 8, 2016 at 20:59
  • 4
    Any system that doesn't allow you to change your password has serious security concerns. Aug 8, 2016 at 22:04

1 Answer 1


The risk is that anyone who guesses your password can now also find your full SSN.

The first three digits of your SSN are based on where you were born (public information), while the next two are based on when you were born (also public information). This leaves only the final four digits as secret information.

In normal usage, this isn't a major problem: an employer or bank isn't going to let you hand in thousands of fake Social Security cards until you come up with one where the name and number match. But with the system you describe, an attacker can sit in front of a terminal, patiently entering numbers until they succeed.

  • The OP states that only the last four of the SSN is used as password. Aug 8, 2016 at 21:57
  • The OP states that only the last four of the SSN is used as password. The title was misleading - I edited it to make it match the text of the OP better. Aug 8, 2016 at 22:04
  • "The middle two digits are the group number. The group numbers range from 01 to 99. However, they are not assigned in consecutive order. For administrative reasons, group numbers are issued in the following order..." - Source
    – Bacon Brad
    Aug 8, 2016 at 23:06
  • 2
    Also as of 2011 all the above information is no longer valid as it switched to a randomize system. Under the randomization system you couldn't predict her SSN if you tried.
    – Bacon Brad
    Aug 8, 2016 at 23:25
  • 3
    Oh good, so all those 5-year-olds going to this college are safe!
    – Ben
    Aug 9, 2016 at 15:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .