I just signed up with an employer's selected vendor for HR/Direct Deposit. As I went through the signup process, I saw that my SSN was displayed in Plain Text.

Seeing as they have to pay me, I do not begrudge them having my SSN stored, but I am very VERY uncomfortable with them sending it over the web unencrypted.

What possible attacks does this leave my SSN open to?

  • I just want to point out that, "sending it over the web unencrypted" implies that the site is http:// and not https://. I highly doubt that is the case. – TTT Dec 20 '17 at 20:06

As long as the page you're viewing was encrypted via TLS, (page using https:// and with a certificate that your browser trusts), then it's unlikely that your SSN will be susceptible to someone sniffing your web traffic. If you're on Wifi, make sure you're using an encrypted network that you trust also. That being said, having it written in plaintext is a little more worrisome should someone steal your credentials to the employer site - whether by guessing or phishing it from you. If that happens they will probably have your bank info and SSN both, amid a bunch of other critical personal data. Make sure you use strong creds to access the site, don't share them across accounts-- the standard safety warning.

  • 1
    TLS will protect data in transit. However, I would also be concerned about the manner in which the SSN is stored at rest if it is being retrieved and displayed as plain text. One would hope that this data is encrypted when stored, but unfortunately it is difficult to know for sure. I would contact your HR department with your concern, and hopefully they could direct you to someone technical who could address your question. – John Dec 20 '17 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.