Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Government launches login.gov to simplify access to public services

18f.gsa.gov

Post reply on HN
Print view View original

131–140 of 173 posts

Re: Government launches login.gov to simplify access to public services

#131

Post by pfg »

zaroth wrote: post #111

Login Spec Here: https://github.com/18F/identity-idp/blob/master/docs/encrypt... Many aspects of this make no sense to me... so IF this is actually what they are doing... hash(user, password) { salt = CS-PRNG(160bit) s = scrypt(salt, password) z1 = s[0:32] z2 = s[32:64] R = CS-PRNG(256bit) d = HSM(R) XOR (pad_right(z1, 0x00, 32 bytes)) cek = SHA256(z2 || d) hash = SHA256(cek) save_record(user, d, salt, hash) } First…

> Let's hope that's not literally the encryption key, but the alternative -- it's a token used to lookup the key in their database -- would completely defeat the purpose of encrypting the PII with a PBK in the first place?! And, even if it was the literal encryption key, when you change or update your PII, if they don't also keep it on their side, how would they update their secondary encrypted PII record?

Without having looked at the actual implementation, here's one option that could work: Upon account creation, the server generates a key pair and a random string - the recovery code. The server stores the public key and an encrypted version of the private key, with the encryption key being the recovery code. Any changes to PII can be encrypted using the public key. The server does not need to store the recovery code (which would beat the whole point of this exercise). Instead, it can simply attempt to decrypt the PII with the user-provided recovery code, and if it succeeds, the server knows the entered recovery code was valid.

Re: Government launches login.gov to simplify access to public services

#132

Post by dnautics »

DaiPlusPlus wrote: post #129
arcbyte wrote: post #113

Earlier quoted context omitted.

Don't ever trust anyone who takes your stuff at the threat of violence.

This is the basis for the "taxation is theft" argument. It's very weak and wry. The state exists as the means for ensuring positive societal outcomes, such as providing services that the private competitive market cannot or will not supply (tragedy of the commons, game theory, etc). One such possible service is an identity service - and we already have that through a hodge-podge of things like SSN, driving licenses,…

>The state exists as the means for ensuring positive societal outcomes

This is the moral basis for outcomes like, snuffing out a person for selling loose cigarettes. In the end, the privileged get away with infractions that hurt people en masse, and the disposessed get punished for offending the sensibilities of those who get to define "positivity" on behalf of society.

I'd respect the state position more if there were well defined metrics for "greater utility" and a stronger non self regulating mechanism for accountability, instead of the dogmatic principle that voting constitutes consent.

Re: Government launches login.gov to simplify access to public services

#133

Post by zaroth »

pfg wrote: post #131
zaroth wrote: post #111

Login Spec Here: https://github.com/18F/identity-idp/blob/master/docs/encrypt... Many aspects of this make no sense to me... so IF this is actually what they are doing... hash(user, password) { salt = CS-PRNG(160bit) s = scrypt(salt, password) z1 = s[0:32] z2 = s[32:64] R = CS-PRNG(256bit) d = HSM(R) XOR (pad_right(z1, 0x00, 32 bytes)) cek = SHA256(z2 || d) hash = SHA256(cek) save_record(user, d, salt, hash) } First…

> Let's hope that's not literally the encryption key, but the alternative -- it's a token used to lookup the key in their database -- would completely defeat the purpose of encrypting the PII with a PBK in the first place?! And, even if it was the literal encryption key, when you change or update your PII, if they don't also keep it on their side, how would they update their secondary encrypted PII record? Without ha…

This would indeed work! I'm still studying their code for handling the recovery key, but as of yet I haven't found any asymmetric encryption of PII.

It does look like they are using the recovery key as a second password, and running it through scrypt to verify it, but I haven't traced past that point yet, and Ruby is not my first, second, or 3rd language.

From what I can tell, they do the same key derivation process as with the primary password, but then also encrypt the secondary 'cek' with another key -- perhaps just HSM(R) -- so they can get back 'cek' without needing the token. But I'm not sure I'm reading it right because there are variables called things like 'encryption_key', 'encrypted_code', 'encryption_code', 'encrypted_key', 'encrypted_password', 'personal_code', 'raw_personal_code', 'code', 'hashed_code', ahhhh.....

If there's one good thing to say about all this, the fact it's open source and I can even look at it all, and open issues on GitHub against the US Government's code for authenticating citizens... well just that is pretty awesome.

Re: Government launches login.gov to simplify access to public services

#135

Post by boznz »

dkhenry wrote: post #40
ProAm wrote: post #38

I would not trust our government to implement this safely, efficiently or well.

You don't have to trust them. Its open source https://github.com/18F/identity-idp

Possibly silly question but how can you be sure the code on github is the same code running on the site. Not trolling, just curious.

Re: Government launches login.gov to simplify access to public services

#136

Post by britta »

Johnny555 wrote: post #103
grepthisab wrote: post #53

Earlier quoted context omitted.

This is a US Digital Service project for 18F. Probably the best engineers in the world working on it.

Hmm...you have to move to Washington DC to work for them, they won't pay for relocation, salaries are capped by federal pay grades and are lower than a tech company in SF or Seattle would pay, no bonuses (or stock options, obviously). I'm sure they have some bright (and altruistic) employees, but I'm not sure the best engineers in the world would work there when they can earn far more compensation at a tech company.

You need to move to DC to work for USDS (https://www.usds.gov/join#relocation), but you can work for 18F from anywhere in the US (https://18f.gsa.gov/join/). The login.gov team includes both USDS and 18F team members (as the blog post says).

Also the salary cap is $161,900, as shown in this pay grade table for SF: https://www.opm.gov/policy-data-oversight/pay-leave/salaries... Not a top-of-the-line private sector salary, but not some kind of hardship.

Re: Government launches login.gov to simplify access to public services

#137

Post by [deleted] »

zbentley wrote: post #124
Johnny555 wrote: post #103

Earlier quoted context omitted.

Hmm...you have to move to Washington DC to work for them, they won't pay for relocation, salaries are capped by federal pay grades and are lower than a tech company in SF or Seattle would pay, no bonuses (or stock options, obviously). I'm sure they have some bright (and altruistic) employees, but I'm not sure the best engineers in the world would work there when they can earn far more compensation at a tech company.

Many people want to make software for the public good via the public sector. For some, the opportunity to do that outweighs the benefits of earning top-of-the-line paychecks. It seems deeply cynical to correlate geographic areas with salaries and infer that the best engineers in the world will be drawn there, bar none. There are other incentives. Some might even say that engineering of this sort is better executed, o…

[deleted]

Re: Government launches login.gov to simplify access to public services

#138

Post by adventured »

simplify wrote: post #72
ineptech wrote: post #52

Earlier quoted context omitted.

> Now seems like the time to set the expectation that this service may not ever be used by private websites. Wha-huh? Why? What specifically is wrong with login.gov (or any government agency) running an oauth server and private websites allowing users to authenticate with it? How does that result in "a major new point of U.S. government control over the Internet"?

What happens when important websites start requiring login.gov, and then the government shuts down your account? Can't just sign up for a new one, can you?

Better yet. What if the government shuts off a web site's ability to utilize login.gov and effectively destroys the entire site by wiping out its userbase (in a scenario where a site is heavily using login.gov for authentication).

That's a far greater threat than that they might shut off any given person's access.

Step 1) regulate all speech by vaguely defined hate speech laws, which change based on who has power

Step 2) Start arbitrarily destroying sites based on who is in power, utilizing login.gov + speech controls, to deem a given site in violation of speech codes

Re: Government launches login.gov to simplify access to public services

#139

Post by dragonwriter »

simplify wrote: post #72
ineptech wrote: post #52

Earlier quoted context omitted.

> Now seems like the time to set the expectation that this service may not ever be used by private websites. Wha-huh? Why? What specifically is wrong with login.gov (or any government agency) running an oauth server and private websites allowing users to authenticate with it? How does that result in "a major new point of U.S. government control over the Internet"?

What happens when important websites start requiring login.gov, and then the government shuts down your account? Can't just sign up for a new one, can you?

> What happens when important websites start requiring login.gov, and then the government shuts down your account?

Or, more plausibly, selectively refuses to authenticate you to certain classes of sites, whether “all non-government sites” or something more targeted.

Re: Government launches login.gov to simplify access to public services

#140

Post by Buge »

gumby wrote: post #78
spencerhakim wrote: post #36

Earlier quoted context omitted.

Given the alternative of handing out my SSN and hoping for the best, I'd be more than happy to use this for banking and related services. Presumably, third-party use would be covered by some form of ToS, and maybe we'd see actual repercussions for leaking data that originated here.

Even if you're not concerned that the government might get a list of all the sites you log into, what about arbitrary login revocation ? Suddenly someone gets a brain fart and decides that everyone on the terrorist watch list shouldn't be able to use this service? Now you're locked out of all the accounts you used this for, even if you're not a "bad guy". This is why I don't use "log in with google" or log in with Fa…

With the government you have free speech rights, so you can sue them if they close your account. With private companies you have no free speech rights and they can close your account whenever they want.

So account closure seems like a positive point of government-controlled login.

Post reply on HN