Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UK Government's Payment Infrastructure Is Now Open Source

govukpay-docs.cloudapps.digital

Post reply on HN
Print view View original

51–60 of 111 posts

Re: UK Government's Payment Infrastructure Is Now Open Source

#51

Post by robin_reala »

watermanio wrote: post #48
robin_reala wrote: post #22

Earlier quoted context omitted.

Right, but those companies don’t know what services people are trying to use Verify for (in the same way that the services don’t know which identity provider you used). The part of Verify that uses Piwik is the hub in the middle that brokers the identity flow.

But you still have to give the Verify companies enough data that a breach of their systems would be very serious. Eg. If the Post Office (an organisation that recently falsely sent a load of employees to prison due to their own cocked up IT project) gets hacked, they have (or could have) dates of birth, 6 years of addresses, email addresses, etc. of a good number of gov.uk users.

You don’t give the majority of those details to the Post Office (or other providers), they ask you questions about the data they already hold on you. The passport and driving licence information is checked via APIs provided from the government to accredited companies, and the system is designed such that that data isn’t stored by the identity providers (beyond a flag to say that that form of identity has been verified).

Re: UK Government's Payment Infrastructure Is Now Open Source

#52

Post by robin_reala »

Matt3o12_ wrote: post #47
TheHeasman wrote: post #36

Earlier quoted context omitted.

>Google self-anonymises with a flag in their API Even if they could, they wouldn't be able to find it.

At what point is it, though? From the Client or when it hits the server. If it is the later, we can’t know if three letter agencies intercept the traffic before it gets anonymized. Furthermore, it is often possible to de-anonymize data especially if you have an extensive knowledge of users and their data such as google. But even then, you can also de-anonymize data https://www.cs.utexas.edu/~shmat/shmat_oak08netflix.…

The client can’t anonymise the IP as it connects to the Google server which then will implicitly know it. What the flag does is tell the server to anonymise it from that point onwards. From my original link:

When a customer of Analytics requests IP address anonymization, Analytics anonymizes the address as soon as technically feasible at the earliest possible stage of the collection network. The IP anonymization feature in Analytics sets the last octet of IPv4 user IP addresses and the last 80 bits of IPv6 addresses to zeros in memory shortly after being sent to the Analytics Collection Network. The full IP address is never written to disk in this case.

Re: UK Government's Payment Infrastructure Is Now Open Source

#53

Post by sametmax »

dchest wrote: post #33
robin_reala wrote: post #11

Earlier quoted context omitted.

GDS’s GA Premium account contractually prevents Google from investigating the data, and Google self-anonymises with a flag in their API[1]. If you don’t trust them then that’s fine, but for functionality vs cost it seems to be the best option. For what it’s worth, for extremely sensitive projects like GOV.UK Verify other options are fine; Verify uses a local Piwik instance. You’re also welcome to block that specific…

GDS’s GA Premium account contractually prevents Google from investigating the data Does it prevent US government from getting this data with a court order?

This guy is asking the right thing.

It's not about you trusting somebody to handle the data. It's just that the data should not exist at all outside of you and the gov.

As soon as the data exists somewhere else, there is a way to misuse it and a chance it will happen. In todays word, those don't even require a lot of imagination to find because it already happened and is currently happening.

Re: UK Government's Payment Infrastructure Is Now Open Source

#54

Post by sametmax »

Nursie wrote: post #8

Still got Google Analytics on the page. I do not feel that reporting every online interaction I have with my government in the UK, back to a huge corporate in the US, is in any way appropriate. But I can't even get anyone to engage on the issue. When I tried to raise it I got directed to a helpdesk ticket on a site run by an SV helpdesk-as-a-service company. I appreciate that gov.uk have done some great stuff getting…

Well that's the point of making it open source. So you can point that out. I just hope people will finally get than opening is just half of the work, the other half is actually properly interacting with people crossing the door you just opened.

Re: UK Government's Payment Infrastructure Is Now Open Source

#55

Post by dsfyu404ed »

monort wrote: post #43
coffeedoughnuts wrote: post #14

Earlier quoted context omitted.

Is it sad? I'm quite proud to pay taxes of many different kinds, and I think that the (admittedly quite imperfect) tax system is necessary to a functioning society. I'd also mention that it's been part of British society since the Roman occupation, so not sure when in time you allude to with your comment but if you're sad about it I suggest investigating a move to one of the functional libertarian nations with no tax…

Imagine you are a Roman and arguing that slave owning is necessary to a functioning society. You are probably even correct and Roman state wouldn't be possible without slaves. Nevertheless, we know that it wasn't an ethical state order. Taxes are similar - they are involuntary, they are required to have a modern state and they are status quo. Looking at the past, we see that more and more ways to force people do thin…

That said, taxes in their various forms are as old as slavery and it took several centuries for nongovernmental ownership of slaves to become something that society did not approve of. We still have various forms of slavery even without getting into philosophical debates about free will and false choices.

While taxation may change dramatically in the future that type of fundamental change is not really one that can be forecast so far in advance.

Re: UK Government's Payment Infrastructure Is Now Open Source

#56

Post by eeZah7Ux »

dchest wrote: post #33
robin_reala wrote: post #11

Earlier quoted context omitted.

GDS’s GA Premium account contractually prevents Google from investigating the data, and Google self-anonymises with a flag in their API[1]. If you don’t trust them then that’s fine, but for functionality vs cost it seems to be the best option. For what it’s worth, for extremely sensitive projects like GOV.UK Verify other options are fine; Verify uses a local Piwik instance. You’re also welcome to block that specific…

GDS’s GA Premium account contractually prevents Google from investigating the data Does it prevent US government from getting this data with a court order?

> Does it prevent US government from getting this data with a court order?

Of course not. Also it does not prevent governments and other organizations from illegally extracting that data from Google, as it happened.

Re: UK Government's Payment Infrastructure Is Now Open Source

#57

Post by dsfyu404ed »

duncan_bayne wrote: post #17
nepotism2018 wrote: post #13

"Most people have to pay government money at some point or another"...its sad that this is a given now

Things I've learned not to criticise on HN: socialism, Apple, Steve Jobs, compulsory taxation. Aren't you just forming a mental image of the downvoters right now? ;)

I would add to that list:

Tesla and anything with wheels powered by an electric motor.

The government of CA except in cases where they can't/won't do something that the various SV special interests would greatly benefit from.

Boondoggle environmental projects.

Government and non-government organizations that align fairly well with HN's ideological bent but have outlived their usefulness to society (e.g. CARB).

Re: UK Government's Payment Infrastructure Is Now Open Source

#58

Post by urbanj »

duncan_bayne wrote: post #39
coffeedoughnuts wrote: post #28

Earlier quoted context omitted.

"That bit"? That was their whole comment! I'm afraid you accused me of 'trotting out a line' when in fact the 'overall sentiment' was implied entirely by yourself. My advice for next time - less pouncing on comments to shoe-horn in some great ideological stance. Specific discussion is better than generic argument in my book. Good day to you :)

This is the line I was criticising: "I suggest investigating a move to one of the functional libertarian nations with no taxes." If I've misinterpreted you, feel free to correct me. (Also, +1m Internet Points for your pleasant tone, sir. You are a gentleman and a scholar.)

Passive aggressive whining from a libertarian who has been schooled.

What a surprise

Re: UK Government's Payment Infrastructure Is Now Open Source

#59

Post by Angostura »

duncan_bayne wrote: post #23
Angostura wrote: post #20

Earlier quoted context omitted.

> Yes, taxation is necessary for a civilised society. No, it doesn't have to be compulsory I think you may have to explain that to me

The necessity bit, or the not being compulsory bit? No snark intended; I'm unsure whether you're an anarchist asking for a defence of the State, or a Statist asking for a defence of voluntary taxation :)

If it is a necessity (I think it is), it's not clear to me how it can not be compulsory.

If it's not compulsory it is charitable giving, not taxation.

Re: UK Government's Payment Infrastructure Is Now Open Source

#60

Post by duncan_bayne »

orf wrote: post #30
duncan_bayne wrote: post #23

Earlier quoted context omitted.

The necessity bit, or the not being compulsory bit? No snark intended; I'm unsure whether you're an anarchist asking for a defence of the State, or a Statist asking for a defence of voluntary taxation :)

How about you just try and reconcile both contradictory points as best you can. I bet it will be some ideological Libertarian fantasy, but please do have a go.

I imagine it'd be the same as every other vital service that's paid for voluntarily. Food, water, medicine, transport... none of which I think are figments of an elaborate Libertarian fantasy ;)

Perhaps you could explain why you believe the provision of Government services is an exception that requires compulsion?

Post reply on HN