4

When a user logs in with their username (Their public ID number) and a password (Their birthday, by default) their name, full social security number, partial credit card number/Expiration date, and billing address is sent over. The user is asked to confirm that the information is correct; This happens every time they try to add classes.

I have a feeling this a massive security risk even though it's sent over HTTPS, but I'm just a student here. What do I do?

(Some less critical information like phone numbers are also sent over)

  • Well, that sounds like it might violate a few things from FERPA to some data security standards. – Fernando Dec 9 '14 at 8:53
  • 1
    In most jurisdictions there is some legislation constraining how information is controlled, in different context anyone holding information has a duty of care which may have explicit legal underpinning - but again depending on the jurisdiction. But you've not said what jurisdiction this applies to. – symcbean Dec 9 '14 at 12:36
  • My mistake, I live in California. – Joan D Dec 9 '14 at 14:27
1

When you say sent over what do you mean? Is this information presented to you, and you then have to verify it or does it also ask for this information as well as your regular login credentials (Username, password) of which it then verifies whether the credentials (SSN, etc.) that you have entered are correct?

Because there is to sides to the security coin as it were, with this situation. As using multiple factors of authentication before a student can add a new class is a particularly good idea, as the underlying fact is it's hard for an attacker to gather all that information on a single person unless of course you're really clumsy with your credentials or your attacker is a really good profiler. However, keeping that amount of data on a person is possibly not the best thing to do if your colleges back end is not all its beefed up to be.

-Dumming down the HTTPS stuff before I go on too much!- On the matter of the use of HTTPS. It's only really as good as it's implementation. There are allot of holes and work around's if it hasn't been implemented correctly. Although I shouldn't worry about it as much as the integrity of the AP you're using to send that information.

But If you have any concerns you should talk to a lecturer or someone higher in Management and always use a VPN or if possible an SSH Tunnel.

  • Your first few sentences are spot on. You log in and have the information presented to you, then check a box to verify the data is correct. – Joan D Dec 9 '14 at 14:30
  • Ew .... That's not something I would want to do. You're then open to a fair few attack vectors. Including that of shoulder surfing (pretty stone age, but still has it's uses; Especially in this case), so ensure you're verifying this in privacy. Also having the data presented to you directly ... they might as well not be using HTTPS :( sorry to seem so dark on the matter but the college is still responsible and liable for any attacks where your personal information may be compromised. So not all doom and gloom! But definitely use a VPN if possible. – Oavatog Dec 9 '14 at 15:04
1

Logging in with their public ID number and date of birth sounds like a huge security risk.

If ID is public like you say, the date of birth of the person associated with that ID can easily be discovered. It would be trivial to either know (if the potential attacker knows the victim with it being a localised system), retrieve (e.g. via social media), guess or brute force the date of birth. Brute forcing the date of birth across all accounts if the IDs are sequential would be easy as only narrow date range would be required, assuming most students are born around the same year for a given range of IDs.

Of course, students can change their passwords to something else, but if they are not required to by the system the risk is not significantly lowered. I would guess that most users would not bother to change their password as their DOB is easily remembered.

Using HTTPS is good, although you have no idea how the information is stored and secured on their back-end systems.

You should talk to a lecturer or somebody at the college with your concerns, although often these concerns can fall on deaf ears. However, I would not go about trying to prove any vulnerabilities as there are all too many stories out there such as this one. If you did have any proof though, it might be best to submit it to the college anonymously on printed paper printed on a public printer to prevent printer steganography from identifying you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.