Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Government launches login.gov to simplify access to public services

18f.gsa.gov

Post reply on HN
Print view View original

101–110 of 173 posts

Re: Government launches login.gov to simplify access to public services

#101

Post by Maarten88 »

dangero wrote: post #81
jeremyevans wrote: post #73

In case you are wondering how it handles password encryption and storage, it appears to use a custom password hash based on SHA256 and scrypt: https://github.com/18F/identity-idp/blob/980c2aa26397f530673... Passwords appear to be stored in the users table in the "encrypted_password" column, and it does not appear that any database-based security is used. This is one RCE/SQLI vulnerability away from exposing the passw…

what is database-based security?

It's an old craft that died somewhere around the dotcom hype in 2000.

It works with SQL, using language elements like VIEW, PROCEDURE, ROLE and GRANT

SQL Databases can still do it, but people who know how to use it are all retired or work in management now. :-)

Also: no web framework knows how to deal with it.

Re: Government launches login.gov to simplify access to public services

#102

Post by [deleted] »

dangero wrote: post #81
jeremyevans wrote: post #73

In case you are wondering how it handles password encryption and storage, it appears to use a custom password hash based on SHA256 and scrypt: https://github.com/18F/identity-idp/blob/980c2aa26397f530673... Passwords appear to be stored in the users table in the "encrypted_password" column, and it does not appear that any database-based security is used. This is one RCE/SQLI vulnerability away from exposing the passw…

what is database-based security?

[deleted]

Re: Government launches login.gov to simplify access to public services

#103

Post by Johnny555 »

grepthisab wrote: post #53
ProAm wrote: post #38

I would not trust our government to implement this safely, efficiently or well.

This is a US Digital Service project for 18F. Probably the best engineers in the world working on it.

Hmm...you have to move to Washington DC to work for them, they won't pay for relocation, salaries are capped by federal pay grades and are lower than a tech company in SF or Seattle would pay, no bonuses (or stock options, obviously).

I'm sure they have some bright (and altruistic) employees, but I'm not sure the best engineers in the world would work there when they can earn far more compensation at a tech company.

Re: Government launches login.gov to simplify access to public services

#104

Post by Erwin »

forforthought wrote: post #18

Given that this is a typical identity provider, I'm curious there's interest to make this service available to the saas industry at large. For example, I'd rather NOT have to manage login credentials for my bank, mortgage car payment, and various airlines. I'd rather let login.gov handle it. Moreover, as a saas provider, I wouldn't mind deferring this liability to someone other than google or facebook.

The Danish NemID ("easy ID") uses the Danish SSN, a password and strike list for login to the many government services (you can get divorced online if both parties agree ), banks, contracts (e.g. signing deeds to a house), gambling where you need proof of age or other proofs of identity (e.g. you can validate yourself on the eBay/craigslist equivalent to make your buying/selling more credible).

NemID itself is ran by a private party -- the basic pricing is 50 cents per unique user or 15 cents per session if you are a non-government entity.

There are some privacy protections -- as non-government entity you cannot get to the SSN, just another ID, but you can ask the user to enter their SSN and verify it's valid for that user.

It's working pretty well after they finally got rid of the Java encryption applets. However you need to have a Danish SSN to use it, so you either live in DK or are a citizen.

Re: Government launches login.gov to simplify access to public services

#105

Post by k_sh »

Vinnl wrote: post #63
ineptech wrote: post #52

Earlier quoted context omitted.

> Now seems like the time to set the expectation that this service may not ever be used by private websites. Wha-huh? Why? What specifically is wrong with login.gov (or any government agency) running an oauth server and private websites allowing users to authenticate with it? How does that result in "a major new point of U.S. government control over the Internet"?

It allows them to see what you log in to and thus what services you use, much like Facebook can often do as well. (Although luckily I haven't seen that as the only option anywhere yet - that might not be the case for a system that everyone in one's target audience might be forced to use.)

Tinder is Facebook-only, last I checked

Re: Government launches login.gov to simplify access to public services

#106

Post by Erwin »

mizzao wrote: post #61

This looks promising. I'm currently in Denmark and they have this inane two-factor authentication system for all (e.g. banks and not just public) services that uses physical printed cards with 150 codes each; when you are close to using one up you need to get another one in the mail. https://en.wikipedia.org/wiki/NemID Hopefully if this requires 2FA it can use the TOTP open standard, etc.

You can buy a digital keyring to show the code if you want, e.g. https://www.nets.eu/dk-da/l%C3%B8sninger/nemid/nemid-til-pri... -- which has a limited lifetime battery; I don't check my account often enough so I'm not bothered with the paper card.

Re: Government launches login.gov to simplify access to public services

#107

Post by tammer »

pdabbadabba wrote: post #31

This appears valuable and well executed, but I worry that private businesses will be eager to outsource their authentication to this service, if they are allowed to. And once it's fully stood up, I suspect the government would be all too eager to oblige. This might be convenient, but might also mark the beginning of a major new point of U.S. government control over the Internet, with all the surveillance and other ci…

This is an excellent point and highlights the brutal need people of all walks have for a better authentication paradigm.

Re: Government launches login.gov to simplify access to public services

#109

Post by devrand »

weddpros wrote: post #98
finnn wrote: post #96

Earlier quoted context omitted.

Is it even possible to use this for a private business? The title literally says that it is "to simplify access to public services"

I sure hope it will be restricted to public services... I was reacting to other comments on HN

According to the developer registration instructions (https://developers.login.gov/register/) you need to provide what government agency you are registering for. Therefore I don't believe this is open to non-government agencies.

Re: Government launches login.gov to simplify access to public services

#110

Post by wyager »

ineptech wrote: post #92
wyager wrote: post #75

Earlier quoted context omitted.

It's bad enough when sites require you to use Facebook to log in. At least Facebook can't send you to jail and you can have (with some effort) a pseudonymous Facebook account. Sites will use such a service to invade your privacy even further, and the government has a record of every site you've logged into and when.

> Sites will use such a service to invade your privacy even further, That's not how OAuth works. https://en.wikipedia.org/wiki/OAuth > the government has a record of every site you've logged into Only the ones where you chose to use their service. Or are we imaginging a future where this service has been made mandatory, and logins and passwords have been abolished? Honestly, the amount of FUD in this thread is absurd…

I know very well how oauth works, thanks, but I'm not sure why you thought that had anything to do with my comment. The invasion of privacy comes from websites insisting on knowing who I am and refusing to allow me to make anonymous/pseudonymous accounts. If there's a convenient API to do so provided by the government, that's bad for users.

> Only the ones where you chose to use their service.

There are hundreds of websites that require you to use Facebook to log in. With government-sanctioned ID, it will be worse.

> Or are we imaginging a future where this service has been made mandatory, and logins and passwords have been abolished?

This already exists in several countries, including Korea. https://en.m.wikipedia.org/wiki/Resident_registration_number

Hopefully this serves as an indicator that your skepticism on this topic is wildly miscalibrated. There's no "imagination" involved, this is how it is right now in places where this exists.

> their strategy will probably not be writing open source software and hoping you opt in to it!

That is the exact strategy I would use if my goal was to help the government gain more control over the internet. Letting people give their freedom away in exchange for a bit of convenience is one of the oldest tricks in the book.

Post reply on HN