I attended a small community college and our network/user login to campus computers were our student ID as the username, and the last 4 digits of our SSN as the password. I thought nothing of it while I attended, but thinking back it seems unusual. Let me be clear about a few points.
- All login verbiage specifically stated this information. So it was well know and not just limited to my login
- You could not change your username or password for any reason
- You could not login to their system outside campus
Perhaps I'm overreacting, but it doesn't seem like a good practice. Not only is the password short and limited to digits, but it's a partial SSN. Anyone else ever encounter this? Is there a security risk?