4 ms·

Name+DOB+SSN=FAFSA Data Gold Mine

86 points by tareqak 9y ago

tareqak 9y ago
Techmeme summary: Brian Krebs / Krebs on Security: How SSNs plus birthdates can still be leveraged to access tons more data via US FAFSA site, after an IRS tool with a similar flaw was disabled in March
dboreham 9y ago
Surprising that someone like Krebs wouldn't require more solid proof of an exploit/leak, such as performing the demo in a new clean VM (the information leak reported in the headline doesn't actually happen, and appeared to happen in the demo session he viewed because the user was already authenticated and it was displaying the data they entered). I think you could argue though that the site perhaps should not display all the detailed financial information even to the user who entered it, after some time has been allowed to review it for correctness.
- jacquesm 9y ago
  From the comments to the article: "Try the “I forgot my Save Key” option. It goes to a page that asks for the Student zip code. That’s it. you reset the save key and plow right through all the data fields!"
  - dboreham 9y ago
    There's no accounting for stupidity.
colemannugent 9y ago
I don't really get this article. If you have someones full name, date of birth and SSN in the Federal Government's eyes you are them. There is no national ID system, and AFAIK SSNs are the only real thing that identifies you to the Federal Government (yes I know that it's only supposed to be used for Social Security benefits, but lets be real here). What other piece of info could they ask for that gives them more confidence that you are who you say you are? I understand that this service allows you to get all the other info, but that seems trivial compared to the SSN which Krebs states that you can already buy online. Is is really news saying that once someone knows your SSN then you're screwed?
- lostcolony 9y ago
  Kinda. Because the way your identity is verified in such situations (and oftentimes used along with asking for SSN#, to prove identity) tends to be via other associations. "Where have you lived previously" and the like. Which presents us with the real issue. To verify data means you must also store that data. So every service designed to allow verification of that data becomes a new vulnerability. Or as succinctly as a prof once said, "Trust is hard".
  - dragontamer 9y ago
    If only there was a government agency that was tasked with hand-delivering memos to every single American, every single workday of the year.... Such an agency might be able to prove that somebody lives at a particular address with ease. https://www.usps.com/ https://www.usps.com/ ---------- Post Office is seeing a decline in its usability due to Emails. Okay, that's a problem, so give them other work to do. Other useful work, like verification of identities. (IE: send a letter to the address and prove that such and such lives where they say they live).

86 points by tareqak 9y ago

Techmeme summary: Brian Krebs / Krebs on Security: How SSNs plus birthdates can still be leveraged to access tons more data via US FAFSA site, after an IRS tool with a similar flaw was disabled in March

dboreham 9y ago

Surprising that someone like Krebs wouldn't require more solid proof of an exploit/leak, such as performing the demo in a new clean VM (the information leak reported in the headline doesn't actually happen, and appeared to happen in the demo session he viewed because the user was already authenticated and it was displaying the data they entered). I think you could argue though that the site perhaps should not display all the detailed financial information even to the user who entered it, after some time has been allowed to review it for correctness.

jacquesm 9y ago
From the comments to the article: "Try the “I forgot my Save Key” option. It goes to a page that asks for the Student zip code. That’s it. you reset the save key and plow right through all the data fields!"
- dboreham 9y ago
  There's no accounting for stupidity.

colemannugent 9y ago

I don't really get this article. If you have someones full name, date of birth and SSN in the Federal Government's eyes you are them. There is no national ID system, and AFAIK SSNs are the only real thing that identifies you to the Federal Government (yes I know that it's only supposed to be used for Social Security benefits, but lets be real here). What other piece of info could they ask for that gives them more confidence that you are who you say you are? I understand that this service allows you to get all the other info, but that seems trivial compared to the SSN which Krebs states that you can already buy online. Is is really news saying that once someone knows your SSN then you're screwed?

lostcolony 9y ago
Kinda. Because the way your identity is verified in such situations (and oftentimes used along with asking for SSN#, to prove identity) tends to be via other associations. "Where have you lived previously" and the like. Which presents us with the real issue. To verify data means you must also store that data. So every service designed to allow verification of that data becomes a new vulnerability. Or as succinctly as a prof once said, "Trust is hard".
- dragontamer 9y ago
  If only there was a government agency that was tasked with hand-delivering memos to every single American, every single workday of the year.... Such an agency might be able to prove that somebody lives at a particular address with ease. https://www.usps.com/ https://www.usps.com/ ---------- Post Office is seeing a decline in its usability due to Emails. Okay, that's a problem, so give them other work to do. Other useful work, like verification of identities. (IE: send a letter to the address and prove that such and such lives where they say they live).