Shocking News of the Day: Social Security Numbers Suck

Posted on by

The firm’s annual Banking Identity Safety Scorecard looked at the consumer-security practices of 25 large banks and credit unions. It found that far too many still rely on customers’ Social Security numbers for authentication purposes — for instance, to verify a customer’s identity when he or she wants to speak to a bank representative over the telephone or re-set a password.

All banks in the report used some version of the Social Security number as a means of authenticating the customer, Javelin found. The pervasive use of Social Security numbers was surprising, given the importance of Social Security numbers as a tool for identity theft, said Phil Blank, managing director of security, risk and fraud at Javelin. (“Banks Rely Too Heavily On Social Security Numbers, Report Finds“, Ann Carrns, New York Times)

Previously here: “Social Security Numbers are Worthless as Authenticators” (2009), or “Bad advice on SSNs” (2005).

Twitter Weekly Updates for 2012-01-08

Posted on by

Powered by Twitter Tools

Twitter Weekly Updates for 2012-01-01

Posted on by
  • RT @timoreilly Amazon patents inferring religion from choice of wrapping paper http://t.co/MmCMx2OO << Over the "creepy" line #
  • RT @kevinmitnick Did you ever want a blue box to make free calls? Now you can in the Apple app store. Search for "blue box". EPIC!!! #
  • I wonder what Woz thinks of being able to get a blue box on his apple phone? (cc @kevinmitnick) #
  • I'm super-happy to see @rmogull, @Beaker, @nselby & more arguing over quality & speed of breach disclosure. #AVeryNewSchoolChristmas :) #
  • It's cool that Skype's preferences uses a segment of 1984 as the sample chat when showing that logs are kept. #
  • Very interesting history of names at #28c3 http://t.co/dL1ztjmL /cc @_nomap @privacyint #
  • RT @doctorow Adversarial stylometry data-set/research https://t.co/SPtQ72XX #28C3 < Totally rad! #
  • RT @jeremiahg New blog post: "Terrified" http://t.co/AlorWtcd << Kudos on speaking up! #
  • RT @Beaker Easy, because "outcomes" require analysis, modeling & understanding. Controls can be bought, installed & checked off #
  • So has anyone written up an analysis of the GoD dump? (mm.txt) #
  • RT @evilcyber I can probably narrow the GOOG stuff down to about a 6 month window in 2003. :) << There's stuff when Aleph1 was at SFocus #
  • RT @argvee @evilcyber @adamshostack we got it down to 3. #

Powered by Twitter Tools

Twitter Weekly Updates for 2011-12-25

Posted on by

Powered by Twitter Tools

Niels Bohr was right about predictions

Posted on by

There’s been much talk of predictions lately, for some reason. Since I don’t sell anything, I almost never make them, but I did offer two predictions early in 2010, during the germination phase of a project a colleague was working on. Since these sort of meet Adam’s criteria by having both numbers and dates, I figured I’d share.

With minor formatting changes, the following is from my email of April, 2010.

Prediction 1

Regulation E style accountholder liability limitation will be extended
to commercial accountholders with assets below some reasonably large
value by 12/31/2010.

Why:  ACH and wire fraud are an increasingly large, and increasingly
public, problem.  Financial institutions will accept regulation in order
to preserve confidence in on-line channel.

WRONG!

Prediction 2

An episode of "state-sponsored SSL certificate fraud/forgery" will make
the public press.

Why: There is insufficient audit of the root certs that browser vendors
innately trust, making it sufficiently easy for a motivated attacker to
"build insecurity in" by getting his untrustworthy root cert trusted by
default.  The recent Mozilla kerfuffle over CNNIC is an harbinger of
this[1].  Similarly, Chris Soghoian's recent work[2] will increase
awareness of this issue enough to result in a governmental actor who has
done it being exposed.

Right!

But only because for this one I forgot to put in a date (I meant to also say “by 12/31/2010″, which makes this one WRONG! too.

I was motivated to make this post because I once again came across Soghoian’s paper just the other day (I think he cited it in a blog post I was reading). He really nailed it. I predict he’ll do so again in 2012.

The Pre-K underground?

Posted on by

Not my headline, but the New York Times:

Beyond the effort was the challenge of getting different families to work together. When matters as personal as education, values and children are at stake, intense emotions are sure to follow, whether the issue is snacks (organic or not?), paint (machine washable?) or what religious holidays, if any, to acknowledge. Oh, and in many cases, forming a co-op school is illegal, because getting the required permits and passing background checks can be so prohibitively expensive and time-consuming that most co-ops simply don’t. (“The Pre-K Underground“, The New York Times, December 16)

Read the whole thing, and then give some thought to how effectively those policies, combined with the drug war, are de-legitimizing governments, and convincing people that to live their lives involves avoiding government rules. Eventually, even legitimate and necessary functions of government like courts will fall apart.

Think I’m exaggerating?

“There’s a fairly stringent code and byzantine process for getting certified and code-compliant,” said City Councilman Brad Lander, a Democrat from Brooklyn, whose office held a meeting over the summer for any co-ops interested in pooling their resources and securing permits. “Some are genuinely for the safety of kids, and some are more debatable.”

There’s a city councilman driving doubt over the system. What does that do to the legitimacy? What happens to the social contract?

Will the war on coop kindergardens join the war on drugs?

Twitter Weekly Updates for 2011-12-18

Posted on by

Powered by Twitter Tools