【I Am a Plaything】

When it comes to United States Senate email accounts,I Am a Plaything you'd think the powers that be would enact a basic security feature that even Yahoo Mail and AOL have down.

Shocker: You would be wrong.

SEE ALSO: The best thing you can do to protect yourself from hackers

As an April 20 open letter from Oregon Senator Ron Wyden makes clear, Senate email accounts lack the option to enable two-factor authentication. Like, senators can't turn it on even if they want to.

"As you know, the cybersecurity and foreign intelligence threats directed at Congress aresignificant," wrote Wyden in the letter addressed to two Senate colleagues. "However, the Senate is far behind when it comes to implementing basic cybersecurity practices like two-factor authentication."

What exactly is two-factor authentication (2FA), and why does this matter? Let's let the experts over at the Electronic Frontier Foundation explain.

"Login systems that require only a username and password risk being broken when someone else can obtain (or guess) those pieces of information," notes the organization. "Services that offer two-factor authentication also require you to provide a separate confirmation that you are who you say you are. The second factor could be a one-off secret code, a number generated by a program running on a mobile device, or a device that you carry and that you can use to confirm who you are."

An easy-to-grasp example of 2FA is your bank ATM card. In order to withdraw cash, you need the PIN (something you know) and the card itself (something you have). Those two factors combine to allow you, and hopefully only you, to access to your hard-earned dollars.

Sen. Ron Wyden just can't believe this. Credit: Chip Somodevilla /Getty Images

With 2FA turned on, even if someone gains your email password (like maybe just possibly through a phishing attack) they still lack the necessary credentials to get into your inbox. This seems like something sitting members of the United States Senate and their staff would be interested in, right?

Mashable Light Speed Want more out-of-this world tech, space and science stories? Sign up for Mashable's weekly Light Speed newsletter. By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy. Thanks for signing up!

And yet.

"Today, the Senate neither requires nor offers two-factor authentication as an additionalprotection for desktop computers and email accounts," writes Wyden. "The Senate Sergeant at Arms does require two-factor authentication for staff who wish to log in to Senate IT systems from home, using a Virtual Private Network. This is a good first step, but the Senate must go further and embrace two-factor authentication for the workplace, and not just for staff connecting from home."

Offering 2FA is often viewed as one of several basic security litmus tests for online services. Gmail, Twitter, Facebook, AOL, and even the much-maligned Yahoo Mail make it easy to turn this on — meaning your grandmother's email account is potentially more secure than your senator's.

As that depressing little nugget of information sinks in, Wyden hits us with a jaw-dropping follow. The executive branch, you see, offers employees Personal Identity Verification (PIV) cards which contain smart chips. The chips work as part of a 2FA system for employees to log into computers. The senate also offers PIV cards, Wyden tells us, but these don't have smart chips.

What do they have instead?

"[In] contrast to the executive branch's widespread adoption of PIV cards with a smartchip, most senate staff ID cards have a photo of a chip printed on them, rather than a real chip."

That's right, a photo of a chip printed on them.

So, to recap: Senate email accounts aren't protected by 2FA, and most Senate staff ID cards have fake smart chips.

Next on the agenda, we assume, is the revelation that the password to each and every senators' personal voicemail account is just "0000."

---

Featured Video For You

---

Edward Snowden says Russians probably hacked the NSA

---

Topics Cybersecurity Yahoo

• Tech
• Deals
• Games
• Life
• Shopping
• Science
• Entertainment
• Digital Culture

• The EPA axed its climate change websites, but NASA's are still intact
• How to Remotely Sign Out of Gmail on Multiple Devices
• Wombat butt biting sex habits could be helpful for its survival
• SpaceX's BFR has a new name. Elon Musk is calling it Starship.
• Amazon Big Spring Sale 2025: Best Apple deals on iPads, MacBooks, and more still live
• Amazon Big Spring Sale 2025: Save $170 on Dyson Hot+Cool
• Productivity Boost: Enable 'Night Mode' on All Your Devices
• New Zealand will ban plastic bags for good
• Sunday's Fat Bear Week match pits two fat favorites against each other
• Best tablet deal: Get the Google Pixel Tablet for $120 off at Amazon

• Chrissy Teigen feels the wrath of the internet after proclaiming her fondness for Ed Sheeran
• A beefier Motorola Razr with 5G is reportedly dropping in the fall
• Why some people masturbate about people they hate
• 10 beautifully weird comedy shows you can stream right now
• Celebrate 40 years of 'The Shining' with the horrors of isolation
• Donald Trump made history with his flight from Saudi Arabia to Israel
• Realme Watch looks like Apple Watch, costs $50
• Little boy gives rude hand gesture at Pippa Middleton's wedding, steals the show
• Taiwan becomes the first place in Asia to recognise same
• 17 gorgeous photos of iced coffee for anyone who desperately misses iced coffee

• 8 Years Later: Does the GeForce GTX 580 Still Have Game in 2018?
• The EPA axed its climate change websites, but NASA's are still intact
• Diseases from mosquitos and ticks have tripled in the U.S., CDC finds
• 'Severance' Season 3 gets confirmed by Apple
• Amazon Big Spring Sale 2025: Best portable speaker deal
• Gmail search just got a lot smarter, thanks to AI
• Comparing Team Communication Apps: What Do You Get for Free?
• Things AMD Needs to Fix
• The Bose QuietComfort Ultra headphones are on sale for $100 off
• Best robot vacuum deal: Get the Shark Matrix Plus 2

• Why Building a Gaming PC Right Now is a Bad Idea, Part 3: Bad Timing
• Best travel deal: Score the Frontier Go Wild! summer pass for just $399
• Best travel deal: Score the Frontier Go Wild! summer pass for just $399
• We Test a $1,000 CPU From 2010 vs. Ryzen 3
• Final Fantasy XV Mega CPU Battle
• Trump delays TikTok ban for another 75 days
• Shop the iPad Air and iPad 11th generation for their lowest
• You won't see Elon Musk smoking weed in public again, NASA admin says
• Best robot vacuum deal from the Amazon Big Spring Sale
• Best travel deal: Score the Frontier Go Wild! summer pass for just $399