Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Government launches login.gov to simplify access to public services

18f.gsa.gov

Post reply on HN
Print view View original

91–100 of 173 posts

Re: Government launches login.gov to simplify access to public services

#91

Post by antimatter »

andrefrancisco wrote: post #45
djwbrown wrote: post #42

Impressive response to the HealthCare.gov fiasco: https://en.wikipedia.org/wiki/18F Some other interesting projects here: https://github.com/18f

Our repos can be a lot to wade through. You can see examples of our specific projects here https://18f.gsa.gov/what-we-deliver/ (and each project links to the right repos if you want to see the code/docs) *I work for 18F

I know elsewhere in the thread you mentioned that you're not on the login.gov team but would you mind passing U2F support and removing SMS as a second-factor auth as a feature request? Thanks :)

Re: Government launches login.gov to simplify access to public services

#92

Post by ineptech »

wyager wrote: post #75
ineptech wrote: post #52

Earlier quoted context omitted.

> Now seems like the time to set the expectation that this service may not ever be used by private websites. Wha-huh? Why? What specifically is wrong with login.gov (or any government agency) running an oauth server and private websites allowing users to authenticate with it? How does that result in "a major new point of U.S. government control over the Internet"?

It's bad enough when sites require you to use Facebook to log in. At least Facebook can't send you to jail and you can have (with some effort) a pseudonymous Facebook account. Sites will use such a service to invade your privacy even further, and the government has a record of every site you've logged into and when.

> Sites will use such a service to invade your privacy even further,

That's not how OAuth works. https://en.wikipedia.org/wiki/OAuth

> the government has a record of every site you've logged into

Only the ones where you chose to use their service. Or are we imaginging a future where this service has been made mandatory, and logins and passwords have been abolished?

Honestly, the amount of FUD in this thread is absurd. The government already has an enormous amount of information about your online activity! If they want more, their strategy will probably not be writing open source software and hoping you opt in to it!

Re: Government launches login.gov to simplify access to public services

#93

Post by skybrian »

dkhenry wrote: post #3
ocdtrekkie wrote: post #2

This is kinda cool, but it's also a little concerning. One of the ways our government protects our privacy is specifically by not centralizing information. Just because you pay taxes or have healthcare doesn't mean the police has that info, for example. The efficiency of connecting a large number of governmental agencies to a single account for you is pretty concerning, it puts all the data in one spot that can be ex…

Its important to remember that login.gov isn't an account its an Identity Provider. It will allow you to prove to an agency that you are who you say you are, but all the account information will be stored by the agency.

Will it? Apparently login.gov doesn't even ask for your real name?

Re: Government launches login.gov to simplify access to public services

#94

Post by toomuchtodo »

Edmond wrote: post #48
throwawaythrow1 wrote: post #37

It's interesting that no one here has yet mentioned the UK government system "Verify". Fundamentally there are different authentication mechanisms and idealogies at work, but it's the same UK CESG GPG implementation as Verify. I genuinely wonder if the US people understand the privacy implications of a central authenticating party as opposed to many federated ones?

Yeah I think USDS is taking motivation from Verify. I actually contacted the Verify folks about leveraging a privacy-preserving approached as outlined here: https://www.cipheredtrust.com/doc/ I believe they were involved in some sort of porn regulation effort launched in the house of commons with a lot of privacy implication, a mechanism as described above would address all of that privacy problem.

USDS does take motivation from and works with the UK version of the USDS.

Source: Interviewed with USDS.

Re: Government launches login.gov to simplify access to public services

#95

Post by 52-6F-62 »

pdabbadabba wrote: post #31

This appears valuable and well executed, but I worry that private businesses will be eager to outsource their authentication to this service, if they are allowed to. And once it's fully stood up, I suspect the government would be all too eager to oblige. This might be convenient, but might also mark the beginning of a major new point of U.S. government control over the Internet, with all the surveillance and other ci…

This is part of the reason why I see value in something like BlockOne ID (by Thomson-Reuters)[0].

I think it's a noble pursuit (what the US Digital Service is trying to do here[1]), making the internet easier and more accessible for people. For many people, involving themselves in the constant updates of what service is secure versus what service is not and "I have to sign up for a different email now to log in to the thing I used to log in to" is a nightmare -- and this isn't restricted to the elderly.

I think it's noble, because I really think it shouldn't be arcane. To a lot of people the nuances still are, unfortunately.

But a service that translates blockchain addresses into WWW accounts and back has some value, no? Couldn't it do a better job of this? I'd love to know if anybody has any more insight or thoughts. I haven't dug too deeply yet, but it keeps coming back to me. Perhaps BlockOne ID isn't the ultimate execution, but maybe one could be developed. Something that requires one sign up, and can be used as ubiquitously as you like.

---

[0] https://blockoneid.thomsonreuters.com/

[1] For instance, with Canadian Government services I require an account for every single service, often with different password and username requirements and age limits. I understand why, but for somebody who doesn't spend so much of their career(s) on and around and familiar with computers and how they work, it could be prohibitive.

Re: Government launches login.gov to simplify access to public services

#96

Post by finnn »

weddpros wrote: post #88

Why it's a privacy nightmare: you delegate authentication to an oauth service. You trust it to check the authenticity of the login/password. The code is open source, but it doesn't mean login.gov runs exactly this code. Now imagine the NSA forks the code, adds a master password "IworkForTheNSA,LetMeIn!" and runs the fork instead on login.gov. Now the government can impersonate you in seconds. Use Auth0 if you don't w…

Is it even possible to use this for a private business? The title literally says that it is "to simplify access to public services"

Re: Government launches login.gov to simplify access to public services

#97

Post by bobthecowboy »

weddpros wrote: post #88

Why it's a privacy nightmare: you delegate authentication to an oauth service. You trust it to check the authenticity of the login/password. The code is open source, but it doesn't mean login.gov runs exactly this code. Now imagine the NSA forks the code, adds a master password "IworkForTheNSA,LetMeIn!" and runs the fork instead on login.gov. Now the government can impersonate you in seconds. Use Auth0 if you don't w…

> It's probably more difficult to coerce a private company into hacking its users, than it is for the NSA/FBI/IRS/Whatever to hack it's own system.

This is a fantasy. I'm shocked to find people parroting this argument mere years after Snowden.

Re: Government launches login.gov to simplify access to public services

#98

Post by weddpros »

finnn wrote: post #96
weddpros wrote: post #88

Why it's a privacy nightmare: you delegate authentication to an oauth service. You trust it to check the authenticity of the login/password. The code is open source, but it doesn't mean login.gov runs exactly this code. Now imagine the NSA forks the code, adds a master password "IworkForTheNSA,LetMeIn!" and runs the fork instead on login.gov. Now the government can impersonate you in seconds. Use Auth0 if you don't w…

Is it even possible to use this for a private business? The title literally says that it is "to simplify access to public services"

I sure hope it will be restricted to public services... I was reacting to other comments on HN

Re: Government launches login.gov to simplify access to public services

#99

Post by weddpros »

bobthecowboy wrote: post #97
weddpros wrote: post #88

Why it's a privacy nightmare: you delegate authentication to an oauth service. You trust it to check the authenticity of the login/password. The code is open source, but it doesn't mean login.gov runs exactly this code. Now imagine the NSA forks the code, adds a master password "IworkForTheNSA,LetMeIn!" and runs the fork instead on login.gov. Now the government can impersonate you in seconds. Use Auth0 if you don't w…

> It's probably more difficult to coerce a private company into hacking its users, than it is for the NSA/FBI/IRS/Whatever to hack it's own system. This is a fantasy. I'm shocked to find people parroting this argument mere years after Snowden.

Don't you think it's easier for the government to hack its own code than someone else's ?

Re: Government launches login.gov to simplify access to public services

#100

Post by joshuamorton »

weddpros wrote: post #88

Why it's a privacy nightmare: you delegate authentication to an oauth service. You trust it to check the authenticity of the login/password. The code is open source, but it doesn't mean login.gov runs exactly this code. Now imagine the NSA forks the code, adds a master password "IworkForTheNSA,LetMeIn!" and runs the fork instead on login.gov. Now the government can impersonate you in seconds. Use Auth0 if you don't w…

Wait, but this is for accessing data that the government already has about you. So while sure they could impersonate you, the NSA/FBI/whomever could also just access the government database that stores the information.

The only way to fix this is with something like per-user encryption of data, in which case a master password wouldn't help, although I'm not quite sure how you'd implement oauth and have an encryption password. Maybe the oauth system uses your password to decrypt a personal encryption key, and that is then sent to the client services. That way a master password doesn't get access.

Post reply on HN