4 ms·

I went to a University in Virginia and ours, and other surrounding VA universities were equally insecure. We each had a 9 digit code that looked like 10XXXXXXX

I went to a University in Virginia and ours, and other surrounding VA universities were equally insecure. We each had a 9 digit code that looked like 10XXXXXXX. These numbers were incremented from one student or faculty to the next. The only track that mattered was track 2. It had your 9 digit code, followed by a the school code (3 digits), followed by a "lost card digit" that was incremented each time a card was lost (obviously mod 10 here). So if my ID was 100000001, I went to school 002, had lost my card two times, my current card's Track 2 would say: 1000000010022 Needless to say there are tons of things that can be done here. From getting access to rooms does not, to getting free lunches. Pretty interesting things. I told my school and they didn't really care at all (as expected). The potential loss from this is so low that it they didn't bother since abusing these issues would get you arrested and expelled pretty quick. In reality, it is probably pretty serious. This student id is used somewhat as a School social security number. You can take tests as other students or impersonate other students in a lot of different situations.

scuba7183 12y ago
What do you mean by "school code"? Wouldn't they all be the same for everyone at your university?
- steakejjs 12y ago
  Yes the school code was the same for everyone at the University. It differs from college to college, since this is a "solution" that the university purchases from a company.
- gresrun 12y ago
  There are many schools in a university. School of Engineering, School of Music, etc. In most U.S. universities there is a hierarchy: university contains colleges which contain schools.
  - davb 12y ago
    And for comparison, my experience of Scottish (and possibly other UK country) universities has been: University -> Faculty (e.g. Faculty of Technology) -> School (e.g. School of Engineering) -> Department. But this does vary from institution to institution.
    - smcl 12y ago
      Not sure about the rest of the unis down south, but I definitely remember Cambridge and Oxford have some sort of "college" system which had no real relation to your subject (i.e. you could read Philosophy at Foo College, Oxford, or Bar College, Oxford). Maybe someone oxbridge-y can clarify.
gombotzd 12y ago
if the school lets you take tests without a more secure way of authorizing yourself that speaks for itself i personally teach a course at a university of applied science and it makes me always wonder how bad the whole online-systems are - and that starts with identification of the student identity is the base of trust but it is by heart not dependent on technology (which we all think so much about) a modern digital signature cannot be forged easily, a "normal" signature can be done easily - but still we believe the analogue medium is more secure because it is a norm of our society one of the best examples for use of non-secure technology is usage of two-channel communication for authorization using TEXT Messages via SS7 protocol, one of the most unsecure protocols but considered okay in combination with the first channel running via TLS
GauntletWizard 12y ago
Back in 2005, I was at Rochester Institute of Technology, and our ID cards encoded our student ID... which was also our social security number. The Student Government made you take attendence by student ID number for certain functions, so at one point as officer of one of the campus's major clubs I was sitting with a spreadsheet of the names and socials of >1000 students. They were also low-cap magstripes, and the checksums were predictable. Inventive students had a database of a few all-access keycards that were used to sneak into the tunnels under the academic buildings at all hours of the night...
- 8ig8 12y ago
  Get off my lawn. :) When I was in college, 91-95, your SS# was your identifier. It was the unique code that everyone used when they needed a way to identify people. I gotta dig it out, but I think my SS# was printed right on my school ID (and the state issued card allowing me to buy alcohol with my out of state driver's license -- Vermont).
  - pavel_lishin 12y ago
    My university (UT Dallas) once hosted a talk about privacy and security, during which they emphasized that it was important to keep your social security number as secret as possible. Then they passed out sign-in sheets and asked us to sign in with our student IDs - which were our social security numbers. The sign-in sheet made it through approximately half the room before someone pointed out what was happening. The organizers looked completely baffled.

scuba7183 12y ago

What do you mean by "school code"? Wouldn't they all be the same for everyone at your university?

steakejjs 12y ago
Yes the school code was the same for everyone at the University. It differs from college to college, since this is a "solution" that the university purchases from a company.
gresrun 12y ago
There are many schools in a university. School of Engineering, School of Music, etc. In most U.S. universities there is a hierarchy: university contains colleges which contain schools.
- davb 12y ago
  And for comparison, my experience of Scottish (and possibly other UK country) universities has been: University -> Faculty (e.g. Faculty of Technology) -> School (e.g. School of Engineering) -> Department. But this does vary from institution to institution.
  - smcl 12y ago
    Not sure about the rest of the unis down south, but I definitely remember Cambridge and Oxford have some sort of "college" system which had no real relation to your subject (i.e. you could read Philosophy at Foo College, Oxford, or Bar College, Oxford). Maybe someone oxbridge-y can clarify.

gombotzd 12y ago

if the school lets you take tests without a more secure way of authorizing yourself that speaks for itself i personally teach a course at a university of applied science and it makes me always wonder how bad the whole online-systems are - and that starts with identification of the student identity is the base of trust but it is by heart not dependent on technology (which we all think so much about) a modern digital signature cannot be forged easily, a "normal" signature can be done easily - but still we believe the analogue medium is more secure because it is a norm of our society one of the best examples for use of non-secure technology is usage of two-channel communication for authorization using TEXT Messages via SS7 protocol, one of the most unsecure protocols but considered okay in combination with the first channel running via TLS

GauntletWizard 12y ago

Back in 2005, I was at Rochester Institute of Technology, and our ID cards encoded our student ID... which was also our social security number. The Student Government made you take attendence by student ID number for certain functions, so at one point as officer of one of the campus's major clubs I was sitting with a spreadsheet of the names and socials of >1000 students. They were also low-cap magstripes, and the checksums were predictable. Inventive students had a database of a few all-access keycards that were used to sneak into the tunnels under the academic buildings at all hours of the night...

8ig8 12y ago
Get off my lawn. :) When I was in college, 91-95, your SS# was your identifier. It was the unique code that everyone used when they needed a way to identify people. I gotta dig it out, but I think my SS# was printed right on my school ID (and the state issued card allowing me to buy alcohol with my out of state driver's license -- Vermont).
- pavel_lishin 12y ago
  My university (UT Dallas) once hosted a talk about privacy and security, during which they emphasized that it was important to keep your social security number as secret as possible. Then they passed out sign-in sheets and asked us to sign in with our student IDs - which were our social security numbers. The sign-in sheet made it through approximately half the room before someone pointed out what was happening. The organizers looked completely baffled.