Slashdot Mirror
Under Fire, US Social Security Site Changes Security Policy Again (vortex.com)
Long-time Slashdot reader Lauren Weinstein writes: I'm told that Social Security Administration has now removed the mandatory cell phone access requirement that was strongly criticized... I appreciate that SSA has done the right thing in this case. Perhaps in the future they'll think these things through better ahead of time!
The web site now describes the "extra security" of two-factor cellphone authentication as entirely optional -- but security researcher Brian Krebs had also warned that the bigger risk was how easy it was to impersonate somebody else when creating an account online. He wrote Thursday that now "the SSA is mailing letters if you sign up online, but they don't take that opportunity to deliver a special code to securely complete the sign up. Go figure."
The web site now describes the "extra security" of two-factor cellphone authentication as entirely optional -- but security researcher Brian Krebs had also warned that the bigger risk was how easy it was to impersonate somebody else when creating an account online. He wrote Thursday that now "the SSA is mailing letters if you sign up online, but they don't take that opportunity to deliver a special code to securely complete the sign up. Go figure."
I've tried changing things before as well.
Consulting for several large companies, I'd always done my work on Windows. Recently however, a top online investment firm asked us to do some work using Linux. The concept of having access to source code was very appealing to us, as we'd be able to modify the kernel to meet our exacting standards which we're unable to do with Microsoft's products.
Although we met several technical challenges along the way (specifically, Linux's lack of support for some things and the fact that we were unable to defrag some stuff), all in all the process went smoothly. Everyone was very pleased with Linux, and we were considering using it for a great deal of future internal projects.
So you can imagine our suprise when we were informed by a lawyer that we would be required to publish our source code for others to use. It was brought to our attention that Linux is copyrighted under something called the GPL, or the Gnu Protective License. Part of this license states that any changes to the kernel are to be made freely available. Unfortunately for us, this meant that the great deal of time and money we spent "touching up" Linux to work for this investment firm would now be available at no cost to our competitors.
Furthermore, after reviewing this GPL our lawyers advised us that any products compiled with GPL'ed tools - such as gcc - would also have to its source code released. This was simply unacceptable.
Although we had planned for no one outside of this company to ever use, let alone see the source code, we were now put in a difficult position. We could either give away our hard work, or come up with another solution. Although it was tought to do, there really was no option: We had to rewrite the code, from scratch, for Windows 10.
I think the biggest thing keeping Linux from being truly competitive with Microsoft is this GPL. Its draconian requirements virtually guarantee that no business will ever be able to use it. After my experience with Linux, I won't be recommending it to any of my associates. I may reconsider if Linux switches its license to something a little more fair, then maybe. Until then its attempts to socialize the software market will insure it remains only a bit player.
Hello,
As a consultant for several large companies, I'd always done my work on
Windows. Recently however, a top online investment firm asked us to do
some work using Linux. The concept of having access to source code was
very appealing to us, as we'd be able to modify the kernel to meet our
exacting standards which we're unable to do with Microsoft's products.
Although we met several technical challenges along the way
(specifically, Linux's lack of Token Ring support and the fact that we
were unable to defrag its ext2 file system), all in all the process
went smoothly. Everyone was very pleased with Linux, and we were
considering using it for a great deal of future internal projects.
So you can imagine our surprise when we were informed by a lawyer that
we would be required to publish our source code for others to use. It
was brought to our attention that Linux is copyrighted under something
called the GPL, or the Gnu Protective License. Part of this license
states that any changes to the kernel are to be made freely available.
Unfortunately for us, this meant that the great deal of time and money
we spent "touching up" Linux to work for this investment firm would
now be available at no cost to our competitors.
Furthermore, after reviewing this GPL our lawyers advised us that any
products compiled with GPL'ed tools - such as gcc - would also have to
its source code released. This was simply unacceptable.
Although we had planned for no one outside of this company to ever
use, let alone see the source code, we were now put in a difficult
position. We could either give away our hard work, or come up with
another solution. Although it was tough to do, there really was no
option: We had to rewrite the code, from scratch, for Windows 2000.
I think the biggest thing keeping Linux from being truly competitive
with Microsoft is this GPL. Its draconian requirements virtually
guarantee that no business will ever be able to use it. After my
experience with Linux, I won't be recommending it to any of my
associates. I may reconsider if Linux switches its license to
something a little more fair, such as Microsoft's "Shared Source".
Until then its attempts to socialize the software market will insure
it remains only a bit player.
Thank you for your time.
Told by who? Via what channel? Have you verified this? How? How can someone else verify it?
I seriously hope that they have removed that requirement, but I'd like to verify it for myself.
"I was told by a little bird that was told by his friend that heard it from his garbage man that he heard it in a restaurant by a waitress who ......." is useless.
"donÃ(TM)t" just like /. editors taking opportunity to read the summaries.
AC: Hey EditorDavid, how many lines of coke did you just snort?
EditorDavid: Yes.
Let me tell you a story...
I've tried changing things before as well.
Consulting for several large companies, I'd always done my work on Windows. Recently however, a top online investment firm asked us to do some work using Linux. The concept of having access to source code was very appealing to us, as we'd be able to modify the kernel to meet our exacting standards which we're unable to do with Microsoft's products.
Although we met several technical challenges along the way (specifically, Linux's lack of support for some things and the fact that we were unable to defrag some stuff), all in all the process went smoothly. Everyone was very pleased with Linux, and we were considering using it for a great deal of future internal projects.
So you can imagine our suprise when we were informed by a lawyer that we would be required to publish our source code for others to use. It was brought to our attention that Linux is copyrighted under something called the GPL, or the Gnu Protective License. Part of this license states that any changes to the kernel are to be made freely available. Unfortunately for us, this meant that the great deal of time and money we spent "touching up" Linux to work for this investment firm would now be available at no cost to our competitors.
Furthermore, after reviewing this GPL our lawyers advised us that any products compiled with GPL'ed tools - such as gcc - would also have to its source code released. This was simply unacceptable.
Although we had planned for no one outside of this company to ever use, let alone see the source code, we were now put in a difficult position. We could either give away our hard work, or come up with another solution. Although it was tought to do, there really was no option: We had to rewrite the code, from scratch, for Windows 10.
I think the biggest thing keeping Linux from being truly competitive with Microsoft is this GPL. Its draconian requirements virtually guarantee that no business will ever be able to use it. After my experience with Linux, I won't be recommending it to any of my associates. I may reconsider if Linux switches its license to something a little more fair, then maybe. Until then its attempts to socialize the software market will insure it remains only a bit player.
How is it supposed to work for Americans living outside the US that are unable to travel? The damn consulate better have some good answers!
And you have to have a cell phone? Fuck Jesus on a stick! How cruel can they be?!
Pinche gringos culeros! We need the fucking 2nd Amendment to enforce contracts and collect what is owed!
I set up an account (so that someone else could not impersonate me and set up an account in my name/number).
However, I never received the SMS messages that the site claimed to have sent to me. I did this several times, although all around the same time.
My phone drops about 50-100% of all SMS messages that originate from AT&T (I'm on T-Mobile), so perhaps that might explain the problem, but I have never before had issues receiving SMS messages sent from other sources.
Interestingly, in the verification process it asked me to select a partial address that I had lived at from a list, and the correct address was one that I had lived in for only about 1 month. In other words, to impersonate me, you would need a full credit report on me, listing all addresses.
The real "Libtards" are the Libertarians!
This is like a government newsletter site.
The SSN usage is generally SSN + date of birth because there's not enough SS numbers to cover everybody the date of birth is usually added in an attempt to uniquely identify individuals, and perhaps a weak attempt to make it a little more difficult for identity thieves. Of course, it's not totally fail proof for either purposes...
Being an immigrant in the US, I was really surprised how often the use of SSN is required. In other countries, it's very confidential. You might even think to call the police when someone asks for the equivalent of "SSN".
So this led me to conclude that the SSN is not designed for the way it's used. It's designed only for what it's named after. Everything about it is not secure as a valid unique identifier for legal US persons. So these latest security issues are in my opinion just one more drop. It just needs a new system from the ground up.
Long-time Slashdot reader Lauren Weinstein writes:
Right-Wing Internet Sites in Panic over FBI Smartphone App Solicitation (vortex.com)
Submitted by Lauren Weinstein on Monday August 08, 2016 @01:41PM
Lauren Weinstein writes:
Right-wing sites are spinning this as “the government is going to turn all our smartphones into bugs!” That clearly is not the goal here.
First, we know that there are already a large number apps available for these phones that provide many of the capabilities asked for in this solicitation. We can be sure that governments are already using these off-the-shelf apps for surveillance purposes.
But the solicitation technical requirements reveal the government’s main “problems” in this regard: authentication and chain of custody.
Slashdot is not even trying to hide it now.
SMS and soft-tokens (such as the Google Authenticator cellphone app) are better than nothing. But they don't provide for particularly secure second factors, especially if the web site is a valuable target.
I don't understand why so few sites (pretty much just Google and Github) use FIDO U2F hardware tokens. They are much more secure as the browser can cryptographically verify that there is no phishing attempt happening -- something that most users have trouble noticing. You only need a single token for an arbitrary number of sites. In many cases, you can leave the token permanently installed in your computer without compromising its security guarantees. The token is dead-simple to use. All you have to do is push a single button, when the site asks for the second factor. You can have multiple tokens, if you want a backup token for account recovery or if you own multiple computers. Any user can buy their own token from a vendor of their choice.
And if site (e.g. your financial institution or SSA) wants to provide tokens for its clients, cheap entry-level tokens cost less than $10. In fact, I suspect you could buy them for around $1 a piece, if you placed an order on the scale of what the SSA needs.
FIDO U2F is of course not perfect. But that can be said about all security products. There is no such thing as perfect security. But these tokens are much more secure than pretty much all alternatives, they are super easy to use, and they are dirt cheap.
Any "security" system that requires disclosing my cell/mobile phone number is an instant and total FAIL. And I am certainly not alone about protecting that which would become the single most annoying device ever (if/when compromised/harvested by marketers).
I find it fascinating how many business and sites now seem to think they have an absolute right to know our cell/mobile phone numbers. Not home, not work, but specifically cell/mobile. I usually have to lie to them and either put in my work number or make up a number. Obviously that won't work if they are trying to use it for text verification.
There is an undocumented 20-character limit on password length. Any longer password meeting all stated requirements is rejected (repeating only the stated requirements, not the actual reason). Although since the password has to be changed every 180 days, that's probably not enough time to crack it, if all printable characters are used (one can use a strong random username to add security, though). I'd rather be allowed to use an arbitrarily long password and not have to change it at all.
She'll be happy she didn't pay for a cell she doesn't need.
I know that my parents will need social security. However I also know that I won't ever get to retire unless the economy makes a profound change; social security won't be anywhere near enough for me to retire before I die and the money I have been able to save for retirement isn't enough to retire in the next 70 years (and I don't expect to live another 70 years).
When your retirement plan is summarized as "Die At Work", it is hard to justify placing a lot of concern in the state of social security.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.