REPORT: Social Security Administration cutting off users who can't receive text messages
https://plus.google.com/+LaurenWeinstein/posts/DuRiEN9X43j REPORT - NOT FULLY CONFIRMED: If you don't have a cell phone, or some other means to receive SMS text messages (and have them enabled, and know how to deal with them), you won't be able to access your Social Security Administration "My Social Security" account starting next month. There is a rumor rapidly spreading on the Net, brought to my attention this morning, claiming that SSA users have been receiving warnings that they MUST receive an SMS text message with a two-factor authentication code to access their accounts starting next month. While I cannot find an official SSA statement regarding this, there is testimony at the House Oversight Committee from late May that appears to confirm the essence of this report: "Additionally, to protect citizens' personally identifiable information further, we continue to improve authentication for our online services. In compliance with Executive Order 13681 ("Improving the Security of Consumer Financial Transactions"), we are changing our current multifactor authentication process for my Social Security from optional to mandatory for all users. Upon implementation this summer, all customers must enter a username, password, and a one-time passcode texted to a registered cell phone in order to access their my Social Security account. In the future, we expect to offer additional multi-factor options, pursuant to Federal guidelines. The National Institute of Standards of Technology is working on a revised guideline, and we are providing input into that process." While the "expectation" of other two-factor options in the future is interesting, the move to block users who do not have cell phones, or text message capable cell phones, or do not have text messaging enabled, or do not know how to access and read text messages -- IS UNACCEPTABLE, especially on such short notice. Two-factor authentication systems are important, but keep in mind that SSA by definition is dealing mostly with older users who may have only recently become comfortable with online services at all, and may not make any use of text messaging. Many do not have cell phones or somebody to receive text messages for them. Additionally -- and ironically -- text messaging is considered to be a substandard means of receiving two-factor authentications. And -- get this boys and girls -- NIST just a few days ago officially declared that text messaging based two-factor should no longer be used at all -- it's simply not safe and secure. It appears that SSA has really mucked this one up. This isn't secure two-factor, it's a three-ring circus. And if deployed as reported, it's going to leave many SSA users out in the cold. --Lauren-- Lauren Weinstein ([email protected]): http://www.vortex.com/lauren Founder: - Network Neutrality Squad: http://www.nnsquad.org - PRIVACY Forum: http://www.vortex.com/privacy-info Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info Member: ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com Google+: http://google.com/+LaurenWeinstein Twitter: http://twitter.com/laurenweinstein Tel: +1 (818) 225-2800 / Skype: vortex.com I have consulted to Google, but I am not currently doing so -- my opinions expressed here are mine alone. _______________________________________________ pfir mailing list https://lists.pfir.org/mailman/listinfo/pfir
