Slashdot Mirror
Is The US Social Security Site Still Vulnerable To Identity Theft? (krebsonsecurity.com)
Slashdot reader DERoss writes: Effective 1 August, the U.S. Social Security Administration (SSA) requires users who want to access their SSA accounts to use two-factor authentication. This involves receiving a "security" code via a cell phone text message. This creates two problems. First of all, many seniors who depend on the Social Security benefits to pay their living costs do not have cell phones [or] are not knowledgeable about texting.
More important, cell phone texting is NOT secure. Text messages can be hacked, intercepted, and spoofed. Seniors' accounts might easily be less secure now than they were before 1 August... This is not because of any law passed by Congress. This is a regulatory decision made by top administrators at SSA.
In addition, Krebs on Security reports that the new system "does not appear to provide any additional proof that the person creating an account at ssa.gov is who they say they are" and "does little to prevent identity thieves from fraudulently creating online accounts to siphon benefits from Americans who haven't yet created accounts for themselves." Users are only more secure after they create an account on the social security site -- and Krebs also notes that ironically, the National Institute for Standards and Technology already appears to be deprecating the use of SMS-based two-factor authentication.
More important, cell phone texting is NOT secure. Text messages can be hacked, intercepted, and spoofed. Seniors' accounts might easily be less secure now than they were before 1 August... This is not because of any law passed by Congress. This is a regulatory decision made by top administrators at SSA.
In addition, Krebs on Security reports that the new system "does not appear to provide any additional proof that the person creating an account at ssa.gov is who they say they are" and "does little to prevent identity thieves from fraudulently creating online accounts to siphon benefits from Americans who haven't yet created accounts for themselves." Users are only more secure after they create an account on the social security site -- and Krebs also notes that ironically, the National Institute for Standards and Technology already appears to be deprecating the use of SMS-based two-factor authentication.
It is!
This involves receiving a "security" code via a cell phone text message.
Basing your authentication on Yahoo!'s mail and facebook isn't the best thing to do.
I don't have text messaging on my cell phone (I specifically had it disabled by the carrier). But I can still receive text messages on my computer by using a Google Voice number. The text message appears in my Gmail inbox and I can reply to it as I would to an email.
Ok, maybe folks who don't have a cell phone also don't have a computer. So there needs to be an option of letting SS that you want online services to be blocked for security purposes.
"He took a duck in the face at 250 knots." -- William Gibson, Pattern Recognition
Screw those people who can't be bothered to keep up with technology and all the changes it brings.
My favorite thing that pisses me off is when I go to the grocery store or the local big-box superstore and I am in line behind a senior citizen who can't figure out how to use their check card and then, they complain to the cashier that "they can't get all this stuff with computers" or some other such dribble. Or, they can't work an ATM machine.
I cry bullshit.
All of these people in their late sixties and above were in their twenties or thirties when computerized accounting systems began rolling out in stores, offices, and even such places as the local DMV. ATMs have been around since the early- to mid-1960s (if not longer). So for them to make a statement like they don't understand it is more akin to them just being too lazy to try.
There are plenty of average senior citizens who can handle ATMs, card readers, cellphones, smartphones, and computers just fine.
So the rest of those whiny bastards need to get with the program.
Disclaimer: I'm a 43 year old white male who is tired of seeing people being lazy and such. Truthfully, I don't give a damn about their age. I'm just tired of the complaining.
It does appear to be a bit more secure than what they had in the past, but since without text service it will lock out some people from using the service. With their password protocols requiring a new password every 6 months and requiring alpha-numeric and special key combinations it virtually guarantees that the password will have to be written down, so I guess by using this text requirement makes a bit of sense compared to just letting anyone in that happens across your password. I'm wondering though how will you be able to change numbers if you get a new phone.
/* TODO: Spawn child process, interest child in technology, have child write a new sig */
Until they let you leave what you've paid in to anyone other than what meets their narrowly define criteria, I shall consider it a scam.
I lost my dad a few months back. He was penniless, for the most part, and had only been collecting for a year and a half.
All those years of paying in, for nothing to leave his children.
Just what I want - to turn over my cell phone number to the government. What could possibly go wrong?
First of all, many seniors who depend on the Social Security benefits to pay their living costs do not have cell phones [or] are not knowledgeable about texting.
Not just seniors.
I'm not particularly old, but I cancelled my SSA account because I don't have a cell phone and I am quite unlikely to ever use one in the future.
A land line is quite sufficient for me -- In all my years on earth, I have never picked up a land-line phone and not gotten a dial tone. Cell and VoIP service are many orders of magnitude less reliable.
The US seems unable to insure information. One hears of action by the US government that are offensive in nature, such as alleged hacks of state actors or in defeating encryption. What is being done about infosec defense? The most encouraging thing I've heard in the business community is from Bank of America where CEO Brian T. Moynihan said, "The only place in the company that doesn’t have a budget constraint is. . ." cyber. He further notes they spend > $400M for this purpose.
Anyhow, the vibe is that things are getting worse and the good guys are losing. One's individual security is already a part time job if one is being diligent.
The requirement for a cell phone w/text service is an absurd requirement. It may be a fine default, but there should be alternatives (other than VOIP based text services with their inherent security problems).
Some people live in areas where they have broadband (at least DSL) but, due to the terrain, there is no cell coverage at a significant percentage of the homes. To use the SSA's online service, these people are likely to end up at their local coffee house using the public WiFi to access their SSA account -- not a great idea.
Why is there an "insightful" mod and why isn't it "-1"? If I wanted insight, I wouldn't be reading
I did not need 2FA to get anything from SSA via the website.
What I did need was answers to a few questions about my credit history.
So I answered all the questions, "none of the above", because, as far as I know, I never had the activities they asked about. As a result, I was denied access to the info I wanted.
Further checking indicated that I had my identity stolen and that recently some mortgages and credit cards were opened as me.
(And I went to credit bureau websites to try to get my credit report and because I did not answer the questions about fraudulent accounts correctly, I was denied access to my credit reports as well. And it seems that whoever stole my identity also put in a fraud alert, which is making it even harder to get my own credit report.)
So all I could find out was that I was well & truly pwned.
Sorting this out is going to be a fun ride!
Whee.
Should we be surprised that these overpaid bureaucrats are idiots?
But, you see, they actually are not idiots. Because their goal is not to safeguard YOUR interest, but rather THEIR OWN interests. They did not do this to make the SS site more secure. They did it to cover their own asses. Now, when people or the site are hacked, they can say "We conformed to the highest industry standards" even if they didn't.
https://www.ssa.gov/oact/STATS...
Fully agree with potential problems of requiring a cell phone: not all people that use the system will have access to cell phones or text messages, for example. There's also the question of how to update your cell phone number in the system if it changes. Krebs seems to be focused on the creation of accounts, which allows you to register a phone number and lock others out (which gets back to that updating your number thing); that seems to be a potentially big problem, considering how many security breaches have leaked our SSNs and what not. If all I need is a name and SSN to initially register and get benefits, then the system needs a better way of verifying identity before allowing to apply.
But I don't understand the text message security complaint that is "more important". Two factor auth means I need *two* things. Even if someone were to intercept the text message (which I believe is difficult, requiring special equipment and proximity to the victim, but feel free to correct me), the point of the system is that nothing can be done with that text without also knowing the password. And if someone knows your password and text messages, then no system is going to prevent an intruder. I understand that NIST is working to update the recommendation (which is a good idea), but I feel like its more safe than not using 2FA (it at least requires attackers to do much more work!), and I'm sure when the NIST guidelines are finalized, other agencies will begin the move to the new recommendation too. It seems a mountain out of a molehill. Am I missing something?
I have one of the most latest devices and I know how to use it. I also have ALL text messages (SMS) blocked from my phone because I don't need or want text messages in my life (let alone the spam that comes with them). So now I'm supposed to be unable to use govt services? This is a bunch of techno-bullshit.
If they break into mine all they can do is deposit.
Bring it on, bitches.
Vulnerabilities never come alone.
"First they came for the slanderers and i said nothing."
They don't need better hacker security this is just another push.
Who already have your data are the US Surveillance agencies. Will they distribute it? Will they still be alive to do so?
"Is The US Social Security Site Still Vulnerable To Identity Theft?" The answer is almost certainly, yes. But is it vulnerable to the *same* threat as last time, and the answer, again, is probably yes.
Organization? You must be joking..
I've tried to address this issue with SSA: One-third of Americans have no cellphone service. That's all SSA will allow!
Most banks do this with an eMail account: If they're uncertain (e.g., you've been offline for a long time), they'll send you a random string of digits you must provide back on the login page, so they know you're YOU.
But, the SSA decided that if you don't have a cellphone, you don't deserve access to My SSA at all.
My guess: The contractor they engaged to implement the recently mandated two-factor authentication made a side deal with AT&T or Verizon to get extra money by only implementing something from which they financially benefit!
Please write to SSA and tell them this is not a way to treat citizens...they MUST implement the email option in their two-factor authentication, in my opinion.