I am designing a web site that contains external suppliers to register and keep their information with the company up to date. We already have a db with EIN, SSN numbers and their addresses.

One of the enhancements users wanted is to display a list of addresses when a known ein/ssn is entered during registration.

This avoids creating a duplicate address in the back end for the same address. It also gives them a more fluid registration process. Architect is objecting to this on the grounds of security.

I can implement a lock feature if you enter more than 3 unsuccessful attempts at guessing ein/ssn, your account is locked for an hour/day.

Is this good enough? Any alternative ways you can think of without letting somebody try ssns and display addresses. Are there any established standards?

2 Answers 2


Address information is at least mostly in the phone book. There are plenty of other sources, such as local property tax records; I can find my own address with a name search of my county's on line property tax database. I'd assert that address information is not "sensitive" in the way an SSN or credit card number is sensitive.

You might be able to appease the system architect and make life easier for users if you ask for EIN/SSN and ZIP code. That would let you display only appropriate addresses and require that a user know a part of the address to see the rest of it.

  • Thanks, I agree. He will tell me what happens if people keeps entering different zip codes, to brute force. I can then say, lock them out of the system. Security is a nightmare in my workplace. It's done without reason or research. External password policy at least 8 characters, upper and lower case letter with a number and a special character such as !#@ On top of that password expires every 3 months and you cannot change your password once password is expired even if you know your old password. It's madness. Jan 26, 2015 at 5:10

Locking someone out after wrongfully entering their info for x amount of times for x hours/days is a good idea, but annoying to users, this helps preventing Bruteforcing.

What could be an alternative, is that instead of getting a list when you enter a SSN number, that you have to manually enter the address yourself, and a script checking if that address is used yet (if in use, it should tell you so, with a button to recover your login details, send to the email address assosciated, ofcourse not mentioning it in the warning).

That means the script should convert the address to a string that is always the same! (no capital letters or symbols. i.e.), for easy processing, or even if possible, a API/script that checks if the address is the right format/is valid.

its a small step that takes an extra 10 seconds of your life, but adds to security, atleast, thats how i would do it!

  • This would prevent duplicates. However it would still be not a happy user experience.Think of the credit card checking web site, where you enter ssn, they might prompt you with data that you would know and after you pick so many correct answers, they give you your score. However in my case, I am just asking them to register online with us. There will be a mail campaign telling they can register online so those people are expecting to register their contact information. It's almost painful to make an easy process hard. Sep 27, 2014 at 4:18
  • Aim is to get them to register and use the website. Sep 27, 2014 at 4:18
  • @user3586195 it's indeed hard, but when handeling sensitive/privacy-related information, using such method would seem lacking privacy, due to the ability to match adresses and numbers
    – Lighty
    Sep 29, 2014 at 7:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .