5 ms·

The US military does not use the SSN as a username or a password. They've had smartcards, even on Linux, as far back as 20 years ago or more. Users without sm

The US military does not use the SSN as a username or a password. They've had smartcards, even on Linux, as far back as 20 years ago or more. Users without smartcards have to go through 2FA with a username/password combination and codes over SMS or proper TOTP (depending on agency). The problem is that the entire Department of Defense is still very much a paper-oriented organization, and they got rid of service numbers in the 1970s, leaving the SSN as the only meaningful unique identifier. As a result it gets put on every piece of paperwork associated with a service member. Their own recordkeeping practices have the consequence that if you get almost any paperwork regarding a soldier, it has enough information to gain access to other personal information.

swells34 3y ago
You've hit the nail mostly on the head. Paper is a problem, for obvious reasons, especially the amount of triplicate hand filled forms that require all of your PII every time. The second issue is access control vs. expediency. Millions of people, all over the world, can digitally access huge amounts of your personal information at a whim, by only having your name, or your military email address. This is an important requirement for quickly checking on a person or their orders or their training status, but at the sacrifice of personal information security for you. It gets even worse going to the VA, which I can say from personal experience, will happily allow just about anyone to have whatever information they want about you. I got a happy surprise letter from them stating that my DD-214, a super identity document, containing information found on a birth certificate, a social security card, a driver's license, plus so much more, had been put on a thumb drive by a third party contractor, along with thousands of other service members info, and sold to a dark web information broker. So, the problem is just that it's to the military's benefit to not protect you.
LtWorf 3y ago
I wasn't talking about the military per se. I was talking about how you can open a bank account just by knowing someone else's ssn
hindsightbias 3y ago
You should sit in on a call to dfas.mil sometime. Where they ask an 80 year old over a dozen obscure questions on their service record and hang up when you get one of them wrong, resetting the clock 24 hours.

swells34 3y ago

You've hit the nail mostly on the head. Paper is a problem, for obvious reasons, especially the amount of triplicate hand filled forms that require all of your PII every time. The second issue is access control vs. expediency. Millions of people, all over the world, can digitally access huge amounts of your personal information at a whim, by only having your name, or your military email address. This is an important requirement for quickly checking on a person or their orders or their training status, but at the sacrifice of personal information security for you. It gets even worse going to the VA, which I can say from personal experience, will happily allow just about anyone to have whatever information they want about you. I got a happy surprise letter from them stating that my DD-214, a super identity document, containing information found on a birth certificate, a social security card, a driver's license, plus so much more, had been put on a thumb drive by a third party contractor, along with thousands of other service members info, and sold to a dark web information broker. So, the problem is just that it's to the military's benefit to not protect you.

LtWorf 3y ago

I wasn't talking about the military per se. I was talking about how you can open a bank account just by knowing someone else's ssn

hindsightbias 3y ago

You should sit in on a call to dfas.mil sometime. Where they ask an 80 year old over a dozen obscure questions on their service record and hang up when you get one of them wrong, resetting the clock 24 hours.