>Typically the SS number is used for identification, and you have password + one-time code on top of that. Isn't that what this was addressing? The attacker ha

>Typically the SS number is used for identification, and you have password + one-time code on top of that. Isn't that what this was addressing? The attacker has to get both your password and one-time codes before you change either. All the ID related stuff is used like usernames, not keys. If an attacker does get both, you presumably go in to a government office, have your fingerprints taken, choose a new password, and get given a new set of codes.