Can I trust formi9.com with my SSN?
May 11, 2015 2:50 PM   Subscribe

Can I Trust formi9.com with my US Social Security Number and other Personal Information?

I do some side-work for a previous employer that classes me as a part-time temporary employee. They've asked me to update my I-9 (Employment Eligibility Verification form) using a Web site called formi9.com.

To be honest I'm wary about trusting my Social Security Number and other personal information with a 3rd party due to identity theft.

Anyone familiar with the service, or aware of how iform.com can and will use my data?
posted by zaphod to Computers & Internet (4 answers total) 1 user marked this as a favorite
 
Basic inspection of the SSL certificate on their login page shows that they are using long obsolete cryptography (SHA1). Clearly nobody bothered to click on the little green icon on their own site, and that's just web hosting 101. Does not bode well for the rest of their security.
posted by rada at 3:03 PM on May 11, 2015 [3 favorites]


Rada's observation is spot on:
Your connection to www.formi9.com is encrypted with obsolete cryptography.

The connection uses TLS 1.0.

The connection is encrypted using AES_128_CBC, with SHA1 for message authentication and RSA as the key exchange mechanism.
I would look for other alternatives.
posted by Nerd of the North at 10:39 PM on May 11, 2015


Response by poster: >I would look for other alternatives.

I don't have that choice as this is what the employer has selected, and arguments about SHA1 are probably not going to work with HR as they won't understand what the problem is. A Google search doesn't return much useful information about the site.

SSLLabs does claim the site is vulnerable to the Poodle attack and other SSL issues, see this screenshot.
posted by zaphod at 9:19 AM on May 12, 2015


Best answer: They updated their SSL certs (or their SSL settings) and don't appear vulnerable to the Poodle attack anymore.

I ended up using the site and haven't had any problems, but still had to go to the employer in person to show proof of identity. And this is the funny part, the HR folks told me the site was down and I had fill out a paper I-9 ...
posted by zaphod at 1:21 PM on June 11, 2015


« Older Crime novels like The City and the City   |   Quirky they certainly are...reliable? Not so much. Newer »
This thread is closed to new comments.