They use passwords to login into secure federal systems. what a surprise.
https://arstechnica.com/information-tec ... comments=1
When Congress held hearings following the breach of the systems of the Office of Personnel Management (OPM) in 2015, one of the issues that caused great consternation among lawmakers was that the OPM had failed to implement two-factor authentication for employees, particularly when using virtual private networks. Federal information security standards in place at the time called for strong user authentication for any federal information system, but the OPM hadn't figured out how to implement two-factor authentication principles—something users know (a password), plus something they have (which, in government, is typically a "smartcard" ID with digital authentication keys programmed onto a chip).
The OPM wasn't alone. While the Department of Defense began issuing Common Access Cards in 2008 to be used for two-factor authentication on DOD systems and to control physical access to DOD facilities, most of the civilian agencies of the US federal government still hadn't implemented their own smartcard (Personal Identity Verification, or PIV) systems at the time of the OPM breach.
The Government Accountability Office repeatedly warned of gaps in federal information security, including the lack of two-factor authentication on critical federal systems like those at OPM. And during President Barack Obama's "cyber-sprint," many more agencies did roll out smartcards for authentication.
But apparently Congress never took its own advice. A letter from Senator Ron Wyden (D-Ore.) to the Senate's Committee on Rules and Administration last week pointed out that while many executive branch employees now have PIV cards with chips embedded in them, Senate employees get ID cards with a picture of a chip on them:
By mid-2016, eighty percent of all agencies were using PIV cards to log into federal IT systems. Today, the Senate neither requires nor offers two-factor authentication as an additional protection for desktop computers and e-mail accounts. The Senate Sergeant at Arms does not require two-factor authentication for staff who wish to log into Senate IT systems from home, using a Virtual Private Network... Moreover, in contrast to the executive branch's widespread adoption of PIV cards with a smart chip, most Senate staff ID cards have a photo of a chip printed on them, rather than a real chip. Given the significant investment by the executive branch in smart-chip based two-factor authentication, we should strongly consider issuing our staff real chip-based ID cards and then using those chips as a second factor.
Senate staff members frequently have access to classified information. And members of the House of Representatives and Senate and their staff have already been affected by cyber-espionage. In March, Republican Sen. Marco Rubio of Florida revealed that his presidential campaign staff was targeted by hackers operating from Russia twice—in July of 2016 and again in March. Also in March, Sen. Ben Sasse (R-Neb,) reported that there had been hacking attempts on "basically every device, every platform, personal and government" associated with him or his office following his criticism of WikiLeaks. So having more than a photo of a chip on ID cards might be a prudent security measure.