Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Government launches login.gov to simplify access to public services

18f.gsa.gov

Post reply on HN
Print view View original

71–80 of 173 posts

Re: Government launches login.gov to simplify access to public services

#71

Post by KGIII »

spencerhakim wrote: post #36
pdabbadabba wrote: post #31

This appears valuable and well executed, but I worry that private businesses will be eager to outsource their authentication to this service, if they are allowed to. And once it's fully stood up, I suspect the government would be all too eager to oblige. This might be convenient, but might also mark the beginning of a major new point of U.S. government control over the Internet, with all the surveillance and other ci…

Given the alternative of handing out my SSN and hoping for the best, I'd be more than happy to use this for banking and related services. Presumably, third-party use would be covered by some form of ToS, and maybe we'd see actual repercussions for leaking data that originated here.

Repercussions? For the OPM hack, I got a form letter and a year (I think, I didn't use it) of credit monitoring. That was some of my most intimate information. That was a huge invasion of my privacy. I didn't even get a phone call. I didn't even get a sincere apology.

Re: Government launches login.gov to simplify access to public services

#72

Post by simplify »

ineptech wrote: post #52
pdabbadabba wrote: post #31

This appears valuable and well executed, but I worry that private businesses will be eager to outsource their authentication to this service, if they are allowed to. And once it's fully stood up, I suspect the government would be all too eager to oblige. This might be convenient, but might also mark the beginning of a major new point of U.S. government control over the Internet, with all the surveillance and other ci…

> Now seems like the time to set the expectation that this service may not ever be used by private websites. Wha-huh? Why? What specifically is wrong with login.gov (or any government agency) running an oauth server and private websites allowing users to authenticate with it? How does that result in "a major new point of U.S. government control over the Internet"?

What happens when important websites start requiring login.gov, and then the government shuts down your account? Can't just sign up for a new one, can you?

Re: Government launches login.gov to simplify access to public services

#73

Post by jeremyevans »

In case you are wondering how it handles password encryption and storage, it appears to use a custom password hash based on SHA256 and scrypt: https://github.com/18F/identity-idp/blob/980c2aa26397f530673...

Passwords appear to be stored in the users table in the "encrypted_password" column, and it does not appear that any database-based security is used. This is one RCE/SQLI vulnerability away from exposing the password hashes for all users. To be fair, that's probably true of most sites that store password hashes, but I would have expected better from 18F.

Re: Government launches login.gov to simplify access to public services

#74

Post by [deleted] »

simplify wrote: post #72
ineptech wrote: post #52

Earlier quoted context omitted.

> Now seems like the time to set the expectation that this service may not ever be used by private websites. Wha-huh? Why? What specifically is wrong with login.gov (or any government agency) running an oauth server and private websites allowing users to authenticate with it? How does that result in "a major new point of U.S. government control over the Internet"?

What happens when important websites start requiring login.gov, and then the government shuts down your account? Can't just sign up for a new one, can you?

[deleted]

Re: Government launches login.gov to simplify access to public services

#75

Post by wyager »

ineptech wrote: post #52
pdabbadabba wrote: post #31

This appears valuable and well executed, but I worry that private businesses will be eager to outsource their authentication to this service, if they are allowed to. And once it's fully stood up, I suspect the government would be all too eager to oblige. This might be convenient, but might also mark the beginning of a major new point of U.S. government control over the Internet, with all the surveillance and other ci…

> Now seems like the time to set the expectation that this service may not ever be used by private websites. Wha-huh? Why? What specifically is wrong with login.gov (or any government agency) running an oauth server and private websites allowing users to authenticate with it? How does that result in "a major new point of U.S. government control over the Internet"?

It's bad enough when sites require you to use Facebook to log in. At least Facebook can't send you to jail and you can have (with some effort) a pseudonymous Facebook account.

Sites will use such a service to invade your privacy even further, and the government has a record of every site you've logged into and when.

Re: Government launches login.gov to simplify access to public services

#76

Post by scott00 »

Created an account. It asks for and confirms email and phone number. Interestingly it does not ask for name or SSN. So it doesn't really represent an identity as a person but rather as a recipient of communications.

Security-wise, starts with using the phone for 2fa, allows setting up TOTP. Generates backup codes and tests for retention. Big problem though: there's no option to disable the phone as a 2fa option. A lesser sin is no U2F support.

Re: Government launches login.gov to simplify access to public services

#77

Post by losteric »

castis wrote: post #34
forforthought wrote: post #18

Given that this is a typical identity provider, I'm curious there's interest to make this service available to the saas industry at large. For example, I'd rather NOT have to manage login credentials for my bank, mortgage car payment, and various airlines. I'd rather let login.gov handle it. Moreover, as a saas provider, I wouldn't mind deferring this liability to someone other than google or facebook.

Over the past few years, I have been conditioned to be weary of handing even more control over my personal life to the government than they already have. Assuming they open this up to private businesses (which I don't believe they're planning to), I wouldn't use any business that uses this service. I apologize if this sounds futile or like I'm donning my tinfoil hat, but my guard is way up these days.

I would use this if it was implemented as a federated state-level service, expanding on drivers license/ID card programs. Not everything, but certainly for applications that already require a drivers license (eg airlines, banks, apartment applications).

Re: Government launches login.gov to simplify access to public services

#78

Post by gumby »

spencerhakim wrote: post #36
pdabbadabba wrote: post #31

This appears valuable and well executed, but I worry that private businesses will be eager to outsource their authentication to this service, if they are allowed to. And once it's fully stood up, I suspect the government would be all too eager to oblige. This might be convenient, but might also mark the beginning of a major new point of U.S. government control over the Internet, with all the surveillance and other ci…

Given the alternative of handing out my SSN and hoping for the best, I'd be more than happy to use this for banking and related services. Presumably, third-party use would be covered by some form of ToS, and maybe we'd see actual repercussions for leaking data that originated here.

Even if you're not concerned that the government might get a list of all the sites you log into, what about arbitrary login revocation? Suddenly someone gets a brain fart and decides that everyone on the terrorist watch list shouldn't be able to use this service? Now you're locked out of all the accounts you used this for, even if you're not a "bad guy".

This is why I don't use "log in with google" or log in with Facebook" -- I don't think those companies are evil (I use them both) but I can't afford for them to accidentally or absentmindedly deny me access to other services.

Re: Government launches login.gov to simplify access to public services

#79

Post by zackbloom »

jeremyevans wrote: post #73

In case you are wondering how it handles password encryption and storage, it appears to use a custom password hash based on SHA256 and scrypt: https://github.com/18F/identity-idp/blob/980c2aa26397f530673... Passwords appear to be stored in the users table in the "encrypted_password" column, and it does not appear that any database-based security is used. This is one RCE/SQLI vulnerability away from exposing the passw…

Can you elaborate on what you were hoping for?

Re: Government launches login.gov to simplify access to public services

#80

Post by ineptech »

simplify wrote: post #72
ineptech wrote: post #52

Earlier quoted context omitted.

> Now seems like the time to set the expectation that this service may not ever be used by private websites. Wha-huh? Why? What specifically is wrong with login.gov (or any government agency) running an oauth server and private websites allowing users to authenticate with it? How does that result in "a major new point of U.S. government control over the Internet"?

What happens when important websites start requiring login.gov, and then the government shuts down your account? Can't just sign up for a new one, can you?

Er, why not? Why would the government shut down the account you use to identify yourself, if not because there was something wrong with it, in which case presumably they'd want you to create a new one?
Post reply on HN