3 ms·
The fact that the writer could even get a used system that had not been wiped by the previous owner is a huge attack vector. This coupled with the fact that emp
by bcohen5055 12y ago
The fact that the writer could even get a used system that had not been wiped by the previous owner is a huge attack vector. This coupled with the fact that employee SSN's were stored in plain text makes a huge incentive for anyone interested in buying these things up on Ebay. Even if 1/10 wasn't wiped I bet it would still be worth it.
- Someone1234 12y agoI legitimately don't understand why a machine like this would ever need to know an employee's SSN. I can understand why the employer might need to know it for tax reasons or similar, but why does the POS terminal?
- kemayo 12y agoI'd guess that they'd want to give each employee a unique id, and they used the SSN because it's something that every employee has to have, so they didn't have to generate a new id number and sync it up with their accounting software. This has obvious security issues, as we see here, of course. They'd need it integrated per-employee with accounting, since it'd be tracking tips via credit cards which have to make it into payrolls and taxes etc.