4 ms·

I reported previously on PG&E's new sign up page exposing last 4 of SSN through Experian. PG&E removed it, but Experian kept it in their product. I kept researc

I reported previously on PG&E's new sign up page exposing last 4 of SSN through Experian. PG&E removed it, but Experian kept it in their product. I kept researching & found the Illinois IDPH Vax Verify site exposing last 4 SSN & 2 other sites, scoop by Tonya Riley

toomuchtodo 4y ago
The IDPH identity proofing vulnerability is particularly annoying as I have been repeatedly pestering them and the IL governor’s office to move Vax Verify to Login.gov to no avail. Thanks for red teaming this!