5

At my workplace, my employer has a web based timeclock. At each location, we have a shared computer at the counter that employees use to clock in.

The user ID that each person is assigned is their full social security number. To clock in, you must enter your full social security number in cleartext along with a universal password.

I feel that there is a big security risk in entering your social in cleartext. Anyone standing behind you can simply write it down.

The higher ups don't really seem to see the security flaws. How and where can I go about reporting this in an appropriate manner?

If it's at all relevant, I live in the US (hence the social security numbers).

Improve this question
6
  • New York State's Restrictions on the use of SSN: mondaq.com/unitedstates/x/72542/… i.e. no displaying of SSNs. Your state may have similar laws. In addition, displaying SSNs may be in violation of various state and Federal privacy laws.
    – Vietnhi Phuvan
    May 19, 2014 at 18:00
  • Is they something they built themselves or a commercial product?
    – user8365
    May 19, 2014 at 18:40
  • @JeffO It's a commercial product, but the company we work with suggested that username scheme so management went with it.
    – user12985
    May 20, 2014 at 0:07
  • On top of people shoulder surfing and seeing your SSN, this also means a lot more people have access to it. Instead of just the HR/accounting people, now the people who manage user accounts see your SSN, and probably the company that set the software up for you as well. I would be unhappy about that.
    – Grant
    May 20, 2014 at 1:31
  • @Grant well the company that does the payroll ends up seeing the SSN anyway, but I see your point. It's a big mess. Security isn't really a top priority obviously.
    – user12985
    May 20, 2014 at 1:35

4 Answers 4

Reset to default
14

I am always amazed that in this day and age someone out there still thinks using a SSN as an ID for anything is a good idea.

A little light reading:

US government report on why you shouldn't do this: http://www.gao.gov/new.items/d051016t.pdf

Another list of reasons why you shouldn't do this:
http://privacyguidance.com/blog/please-dont-tell-me-youre-still-using-ssns-as-ids/

Depending on where you live, using SSN's for time clock entry might be illegal. You could certainly read the above links and have a nice conversation with management letting them know that they are possibly violating federal and state laws by doing this.

You might also let them know that continued use of SSNs in this way might be opening themselves up to lawsuits... However taking this tact is difficult as you want to appear to be on their side, and not as someone who is about to get litigious with them. When a company starts going down the wrong path sometimes those who point that out aren't treated very well.

Regardless, you might consider consulting an attorney just to make sure of where you stand and you need to continue letting them know what's wrong here.

Improve this answer
1
  • 14
    One way to help reduce the likelihood they see this as you prepping to litigate is to make it clear you are on their side using phrases like "we need to fix this before someone sues us" or "we need to address this security issue before it comes back to bite us" simply adding yourself into the potentially affected party goes a long way for calming nerves.
    – Eric J Fisher
    May 19, 2014 at 18:49
3

It's clearly a bad idea for an employer to do this in an age of rampant identity theft. There's no doubt about that.

May I suggest that you say something like this to your employer: "I am concerned about having my identity stolen. I'm concerned about using my social used so much. May I arrange to have my ID in your system changed from my actual SSN to some other identifying number?"

Improve this answer
0

Advising on the handling of sensitive information, such as PII in this case, is something I do as part of my work as an IT auditor. I would suggest you first consult any official company policy, if they exist. Most decent sized companies have internal policies over confidentiality and data protection, specifying how sensitive data is to be handled and protected if distributed. You should consult your IT Security team, or IT in general if a dedicated Security function does not exist.

I feel that there is a big security risk in entering your social in cleartext

Correct. The two biggest risks I see are shoulder - surfing and sniffing, the latter depending on how the web environment is configured such as whether encryption is enable (Ex: TLS) or SSH in the case of remote access. Given that the password is universal, (and probably not masked) and the User ID is your SSN, the is very vulnerable to shoulder surfing.

To summarize, this seems like a ID theft waiting to happen...

Improve this answer
-1

This sounds rather appalling to me. I would be upset about it as well. If it were me I would go to my nearest state employment office and ask for advice. I don't know anything about the legality of it, but they probably would.

You should also decide how far you are prepared to go to set things right. This is an issue for every potential whistle blower. Companies do not like to be dictated to, nor threatened with legal action. Are you prepared to risk being fired over it, if you find out that what they are doing is illegal as well as unsafe (and unprofessional, IMO)?

Improve this answer

You must log in to answer this question.