Re: Use of Partial SSN as Authenticator

[Charlie Reitsma <reitsmac () DENISON EDU>]

As an identifier, it's not unique in large populations
as a password, being short and only digits goes against most password rules.

Quoting Gary Flynn <flynngn () JMU EDU>:

> I've been asked to back up my assertion that the use of
> a portion of the SSN ( e.g. last four digits ) as an
> authenticator should be avoided as much as the use of
> the entire SSN.
>
> Can anyone point me to regulations, best practice studies,
> or other material which may back up or refute this
> assertion?
>
> thanks,
>
> --
> Gary Flynn
> Security Engineer
> James Madison University
> www.jmu.edu/computing/security