3 ms·
A lot of financial things in the US are “secured” or anchored by SSN, that’s the only reason why. That and mother’s maiden name and first vacation and other sec
by browningstreet 2y ago
A lot of financial things in the US are “secured” or anchored by SSN, that’s the only reason why. That and mother’s maiden name and first vacation and other security questions. It’d be less important with MFA now but SSN is also needed when opening new credit, so having it allows you to pretty easily fake someone else’s identity for credit. KYC hasn’t removed it from the equation.
- madcaptenor 2y ago"Mother's maiden name" won't work for my kids - my wife kept her name and the kids' last name is hyphenated, so you just have to guess whose name we put first.
- Auracle 2y agoIt's also probably increasing easy to look up. We need a national (preferably RFID-ish) password system.
- athenot 2y agoOne mitigation is to make your mother's maiden name the output of: head -c 20 /dev/random | base64 And keep track of the result in your favorite password manager. Fortunately, fewer and fewer orgs are using security questions, but there are still some important ones that only use that and no MFA.
- theluketaylor 2y agoThe problem with that plan is social engineering attacks. CSRs are often careless and will accept 'a bunch of random letters and numbers' as the answer rather than validating each character. Better to randomly select a long dictionary word or hypenate a few together. Equally unguessable but easily verified, so it won't be weakened during a phone conversation.