Slashdot Mirror
Under Fire, US Social Security Site Changes Security Policy Again (vortex.com)
Long-time Slashdot reader Lauren Weinstein writes: I'm told that Social Security Administration has now removed the mandatory cell phone access requirement that was strongly criticized... I appreciate that SSA has done the right thing in this case. Perhaps in the future they'll think these things through better ahead of time!
The web site now describes the "extra security" of two-factor cellphone authentication as entirely optional -- but security researcher Brian Krebs had also warned that the bigger risk was how easy it was to impersonate somebody else when creating an account online. He wrote Thursday that now "the SSA is mailing letters if you sign up online, but they don't take that opportunity to deliver a special code to securely complete the sign up. Go figure."
The web site now describes the "extra security" of two-factor cellphone authentication as entirely optional -- but security researcher Brian Krebs had also warned that the bigger risk was how easy it was to impersonate somebody else when creating an account online. He wrote Thursday that now "the SSA is mailing letters if you sign up online, but they don't take that opportunity to deliver a special code to securely complete the sign up. Go figure."
Astroturfing: you're doing it wrong.
Told by who? Via what channel? Have you verified this? How? How can someone else verify it?
I seriously hope that they have removed that requirement, but I'd like to verify it for myself.
"I was told by a little bird that was told by his friend that heard it from his garbage man that he heard it in a restaurant by a waitress who ......." is useless.
"donÃ(TM)t" just like /. editors taking opportunity to read the summaries.
AC: Hey EditorDavid, how many lines of coke did you just snort?
EditorDavid: Yes.
Is this 1992 calling?
Be sure to check with your lawyers. Microsoft products are copyrighted under the exact same copyright laws that Linux is copyrighted under. That means that, according to your lawyers findings, anything you use Microsoft products to create are not owned by you, but by Microsoft!
Best advice is to either stop trolling so lamely with such lame unrealistic lies, or if you're actually telling the truth get new lawyers.
Intel and IBM, as well as hundreds of thousands of other corporations around the world use Linux to create software and other copyrighted content and their lawyers have never concluded what you are saying. Linux has survived multiple court challenges. Read sites like Groklaw and Popehat for a better understanding.
Your company AND your lawyers were idiots. If we only had less consultants like yours who are blind to the legal rights and requirements of owners who's stuff you use, we could cut out a third of the CYA BS we all deal with.
You guys are the same type that get clients in hot water because you used a free for non-commercial use or trial based product when you weren't supposed to in the commercial setting.
Read sites like Groklaw
1992 indeed.
I set up an account (so that someone else could not impersonate me and set up an account in my name/number).
However, I never received the SMS messages that the site claimed to have sent to me. I did this several times, although all around the same time.
My phone drops about 50-100% of all SMS messages that originate from AT&T (I'm on T-Mobile), so perhaps that might explain the problem, but I have never before had issues receiving SMS messages sent from other sources.
Interestingly, in the verification process it asked me to select a partial address that I had lived at from a list, and the correct address was one that I had lived in for only about 1 month. In other words, to impersonate me, you would need a full credit report on me, listing all addresses.
The real "Libtards" are the Libertarians!
This is like a government newsletter site.
The SSN usage is generally SSN + date of birth because there's not enough SS numbers to cover everybody the date of birth is usually added in an attempt to uniquely identify individuals, and perhaps a weak attempt to make it a little more difficult for identity thieves. Of course, it's not totally fail proof for either purposes...
Being an immigrant in the US, I was really surprised how often the use of SSN is required. In other countries, it's very confidential. You might even think to call the police when someone asks for the equivalent of "SSN".
So this led me to conclude that the SSN is not designed for the way it's used. It's designed only for what it's named after. Everything about it is not secure as a valid unique identifier for legal US persons. So these latest security issues are in my opinion just one more drop. It just needs a new system from the ground up.
1992?!? Obtaining a legal license for your particular needs and usage was 101 in the 1960's. That's if you are looking just in the computing space. Goes back almost to the printing press if you want to look at licensing in general.
But these days there are too many IT consultants who don't consider this topic as part of the deliverable.
Hello Microsoft ChatBot,
Repeat after me: I am a racist nazi and love it!
SMS and soft-tokens (such as the Google Authenticator cellphone app) are better than nothing. But they don't provide for particularly secure second factors, especially if the web site is a valuable target.
I don't understand why so few sites (pretty much just Google and Github) use FIDO U2F hardware tokens. They are much more secure as the browser can cryptographically verify that there is no phishing attempt happening -- something that most users have trouble noticing. You only need a single token for an arbitrary number of sites. In many cases, you can leave the token permanently installed in your computer without compromising its security guarantees. The token is dead-simple to use. All you have to do is push a single button, when the site asks for the second factor. You can have multiple tokens, if you want a backup token for account recovery or if you own multiple computers. Any user can buy their own token from a vendor of their choice.
And if site (e.g. your financial institution or SSA) wants to provide tokens for its clients, cheap entry-level tokens cost less than $10. In fact, I suspect you could buy them for around $1 a piece, if you placed an order on the scale of what the SSA needs.
FIDO U2F is of course not perfect. But that can be said about all security products. There is no such thing as perfect security. But these tokens are much more secure than pretty much all alternatives, they are super easy to use, and they are dirt cheap.
As a consultant for several large companies, I'd always done my work on
Windows. Recently however, a top online investment firm asked us to do
some work using Linux. The concept of having access to source code was
very appealing to us, as we'd be able to modify the kernel to meet our
exacting standards which we're unable to do with Microsoft's products.
You've made a verbatim copy of a post is at least 14 years old. It may even be older than you are.
https://groups.google.com/foru...
Any "security" system that requires disclosing my cell/mobile phone number is an instant and total FAIL. And I am certainly not alone about protecting that which would become the single most annoying device ever (if/when compromised/harvested by marketers).
I find it fascinating how many business and sites now seem to think they have an absolute right to know our cell/mobile phone numbers. Not home, not work, but specifically cell/mobile. I usually have to lie to them and either put in my work number or make up a number. Obviously that won't work if they are trying to use it for text verification.
There is an undocumented 20-character limit on password length. Any longer password meeting all stated requirements is rejected (repeating only the stated requirements, not the actual reason). Although since the password has to be changed every 180 days, that's probably not enough time to crack it, if all printable characters are used (one can use a strong random username to add security, though). I'd rather be allowed to use an arbitrarily long password and not have to change it at all.
What kind of man has the name "Lauren"? He must be a faggot.
She'll be happy she didn't pay for a cell she doesn't need.
I know that my parents will need social security. However I also know that I won't ever get to retire unless the economy makes a profound change; social security won't be anywhere near enough for me to retire before I die and the money I have been able to save for retirement isn't enough to retire in the next 70 years (and I don't expect to live another 70 years).
When your retirement plan is summarized as "Die At Work", it is hard to justify placing a lot of concern in the state of social security.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.