This is a function of how schools are funded in the US.
Not just schools. A lot of government-related sectors.
Transit is a big one. Back when I used to follow this sort fo thing, I would see a lot of municipalities turning down federal grants because the money could only be spent on buses, trains, an related infrastructure; and the towns and cities didn't have the money to pay for the people involved.
Maybe when self-driving vehicles become common, this won't be so much of a problem anymore.
Several years ago, one of our competitors implemented a public-facing web-based form for a local ISD. When the form loaded, the user was prompted with two pieces of info: a student's last 4 digits of SSN and their birthdate. The form then performed an AJAX request to the server, which did a DB lookup and pulled in ALL the transcript data of the matching student record to send back to the front-end.
Said competitor then presented this "solution" at a vendor conference and bragged about how amazing and easy to use it was and how the parents loved it because they no longer had to call the school to request transcripts yadda yadda. When casually asked about security/privacy concerns, their engineer basically said "well, how likely is it that an unauthorized party will know both a student's birthdate and the last 4 digits of SSN? Probably not very."
Comments
This is a function of how schools are funded in the US.
Not just schools. A lot of government-related sectors.
Transit is a big one. Back when I used to follow this sort fo thing, I would see a lot of municipalities turning down federal grants because the money could only be spent on buses, trains, an related infrastructure; and the towns and cities didn't have the money to pay for the people involved.
Maybe when self-driving vehicles become common, this won't be so much of a problem anymore.
Don't forget contractors.
Several years ago, one of our competitors implemented a public-facing web-based form for a local ISD. When the form loaded, the user was prompted with two pieces of info: a student's last 4 digits of SSN and their birthdate. The form then performed an AJAX request to the server, which did a DB lookup and pulled in ALL the transcript data of the matching student record to send back to the front-end.
Said competitor then presented this "solution" at a vendor conference and bragged about how amazing and easy to use it was and how the parents loved it because they no longer had to call the school to request transcripts yadda yadda. When casually asked about security/privacy concerns, their engineer basically said "well, how likely is it that an unauthorized party will know both a student's birthdate and the last 4 digits of SSN? Probably not very."
...yeah.