TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Shocking Poor Security at the Social Security Administration

54 点作者 watchdogtimer超过 8 年前

7 条评论

patio11超过 8 年前
They also have more than 60 million lines of COBOL in production.<p>Cite: <a href="http:&#x2F;&#x2F;oig.ssa.gov&#x2F;sites&#x2F;default&#x2F;files&#x2F;audit&#x2F;full&#x2F;pdf&#x2F;A-14-11-11132_0.pdf" rel="nofollow">http:&#x2F;&#x2F;oig.ssa.gov&#x2F;sites&#x2F;default&#x2F;files&#x2F;audit&#x2F;full&#x2F;pdf&#x2F;A-14-1...</a>
评论 #13404257 未加载
GICodeWarrior超过 8 年前
What login rate-limiting, account lock-out, and password expiry policies do they have though?<p>Based on the password requirements, they have something like 2.6 trillion possible passwords. If your account is locked out after 3 failed login attempts, if they limit to one attempt per second, or if they have a forced password change every month, etc. there are a number of ways to tighten this up.<p>Their password policy is anachronistic, and this &#x2F;could&#x2F; be a symptom of other issues. However by itself, it seems more like a usability issue than a security issue.<p>In fact, they could be attempting to discourage password reuse with other sites. That would be a security bonus if it worked (I doubt it works).
评论 #13403754 未加载
评论 #13402756 未加载
RichardHeart超过 8 年前
This sounds like someone tazering a guard at the SSA. *shockingly<p>If you&#x27;re mad about 8 char mandatory case insensitive password rules maybe leaking data, you&#x27;ll probably be super mad when they just lose the whole db on their end to hacks. Perhaps they should code a 2fa option through one of the many useful api&#x27;s, as so many other companies have.
tomschlick超过 8 年前
This is why the government desperately needs to keep 18F&#x2F;US Digital Service so they can keep modernizing these sites.
评论 #13402806 未加载
tomohawk超过 8 年前
What else would you expect? They can&#x27;t go out of business. They are so sacred that they appear immune to any sort of political reform. There&#x27;s no chance of anyone getting fired for keeping things as they are. To change things would paradoxically be more risky.
loopbacker超过 8 年前
Some banks do this too. They store the password in the clear then at login ask for the Nth character of your password (rather than the whole password).<p>That obviously means that the whole password is rarely sent over the network. It also means that they can use the same validation system over the phone for telephone banking.<p>The system is however far from ideal of course.
coldcode超过 8 年前
Bad security no longer shocks me at all.