RE: Social Security Number in Hidden field

In this day in age the SSN should never be a hidden variable. SSN should =
be treated nearly like a password. If an application needs the ssn for =
some sort of operations it should be masked and index on the back end. =
(Ie. if the application is providing the ssn number it should look =
something like xxx-xx-1234 at a min and the variable within the html =
should be should be a reference point that translates to the true value =
on the backend.) The only time a ssn should be transmitted is from the =
user. No application should transmit it to the user.

-----Original Message-----
From: [email protected] [mailto:[email protected]] =
On Behalf Of Abhay Rana
Sent: Sunday, November 23, 2014 6:54 PM
To: [email protected]
Subject: Re: Social Security Number in Hidden field

No, putting it in a hidden field is same as showing it to a tech-savvy =
admin. Unless admins are supposed to see the SSN (and are authorized =
to), there is no reason for it to be in a hidden field.

If you really need it there (for some future requests in the form), it =
might be better to instead put the SSN's unique ID from the database
(1,2,3) in the hidden field, and using it to get the SSN in the next =
request on the server side.

--
Nemo



This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now!=20
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------





This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now! 
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------