Security News > 2020 > July > E-Verify’s “SSN Lock” is Nothing of the Sort

Enabling this lock is supposed to mean that for the next year thereafter, if an unauthorized individual attempts to fraudulently use a SSN for employment authorization, he or she cannot use the SSN in E-Verify, even if the SSN is that of an employment authorized individual.

Password reset questions selected, the site proceeded to ask four, multiple-guess "Knowledge-based authentication" questions to verify my identity.

The U.S. Federal Trade Commission's primer page on preventing job-related ID theft says people who have placed a security freeze on their credit files with the major credit bureaus will need to lift or thaw the freeze before being able to answer these questions successfully at myE-Verify.

After successfully answering the KBA questions, the site declared I'd successfully created my account! I could then see that I had the option to place a "Self Lock" on my SSN within the E-Verify system.

A 2015 study by Google titled "Secrets, Lies and Account Recovery" found that secret questions generally offer a security level that is far lower than just user-chosen passwords.

News URL

https://krebsonsecurity.com/2020/07/e-verifys-ssn-lock-is-nothing-of-the-sort/