At my workplace, my employer has a web based timeclock. At each location, we have a shared computer at the counter that employees use to clock in.
The user ID that each person is assigned is their full social security number. To clock in, you must enter your full social security number in cleartext along with a universal password.
I feel that there is a big security risk in entering your social in cleartext. Anyone standing behind you can simply write it down.
The higher ups don't really seem to see the security flaws. How and where can I go about reporting this in an appropriate manner?
If it's at all relevant, I live in the US (hence the social security numbers).