Does this mean I'll be able to regenerate my SSN?
Government launches login.gov to simplify access to public services
141–150 of 173 posts
Re: Government launches login.gov to simplify access to public services
#142Earlier quoted context omitted.
It allows them to see what you log in to and thus what services you use, much like Facebook can often do as well. (Although luckily I haven't seen that as the only option anywhere yet - that might not be the case for a system that everyone in one's target audience might be forced to use.)
> Now seems like the time to set the expectation that this service may not ever be used by private websites. Oh shit! The government knows I bought something from custom-fishing-lures.com! Ruuuuun! Seriously, what you just listed is a reason not to use the government's Oauth for every website and ban all other implementations. What OP seemed to say, and what I disputed, is the idea that this service should not ever b…
Yeah, they know you were browsing custom-fishing-lures.com on your phone just before those girls were strangled with fishing line one block away. The guy who did it wasn't using his imperial login at the time, so you're the only suspect at the moment. As long as you have a good alibi, they won't be able to hold you more than 72 hours and you should be able to get your job back.
Re: Government launches login.gov to simplify access to public services
#143Singapore launched SingPass in the early 2000s. There was a breach a few years ago and they have since implemented 2FA.
It's really convenient, but scary at the same time.
Re: Government launches login.gov to simplify access to public services
#144Earlier quoted context omitted.
> Now seems like the time to set the expectation that this service may not ever be used by private websites. Oh shit! The government knows I bought something from custom-fishing-lures.com! Ruuuuun! Seriously, what you just listed is a reason not to use the government's Oauth for every website and ban all other implementations. What OP seemed to say, and what I disputed, is the idea that this service should not ever b…
Yeah, they know you were browsing custom-fishing-lures.com on your phone just before those girls were strangled with fishing line one block away. The guy who did it wasn't using his imperial login at the time, so you're the only suspect at the moment. As long as you have a good alibi, they won't be able to hold you more than 72 hours and you should be able to get your job back.
> As long as you have a good alibi, they won't be able to hold you more than 72 hours and you should be able to get your job back.
The US does not have legally-mandated job-protected leave for pre-trial detention, people have been terminated (for cause, and so not eligible for unemployment, either) for missing one day of work due to an arrest for which no charges were ever filed.
Re: Government launches login.gov to simplify access to public services
#145Earlier quoted context omitted.
This is a US Digital Service project for 18F. Probably the best engineers in the world working on it.
Arguable, and they are still working within/for the government. I have little to no faith.
Fine.
The only person I know who works for USDS is one of the most talented engineers I've ever met. He's a foreign national but was recently naturalized.
He made boatloads of money off of stock options and loves the idea of solving these kinds of problems.
He owns a house in a western state but maintains an apartment in DC and jokes that he "loses money" by working for the government.
I'm sure not everybody's like him, but come on, give USDS a chance.
Re: Government launches login.gov to simplify access to public services
#146Earlier quoted context omitted.
Yeah, they know you were browsing custom-fishing-lures.com on your phone just before those girls were strangled with fishing line one block away. The guy who did it wasn't using his imperial login at the time, so you're the only suspect at the moment. As long as you have a good alibi, they won't be able to hold you more than 72 hours and you should be able to get your job back.
> As long as you have a good alibi, they won't be able to hold you more than 72 hours and you should be able to get your job back. The US does not have legally-mandated job-protected leave for pre-trial detention, people have been terminated (for cause, and so not eligible for unemployment, either) for missing one day of work due to an arrest for which no charges were ever filed.
Thanks, yes, it was the uncertainty about getting the job back that I was hinting at with "should".
BTW in case anyone thinks it was a ridiculously contrived example, I was just trying to illustrate that what one person thinks is totally innocuous can appear damning to someone else.
Re: Government launches login.gov to simplify access to public services
#147This appears valuable and well executed, but I worry that private businesses will be eager to outsource their authentication to this service, if they are allowed to. And once it's fully stood up, I suspect the government would be all too eager to oblige. This might be convenient, but might also mark the beginning of a major new point of U.S. government control over the Internet, with all the surveillance and other ci…
In many countries (e.g. Denmark), this is already the case. https://en.wikipedia.org/wiki/NemID
Netherlands has DigiD. Banks here are rolling out iDIN which can be used to authenticate elsewhere as well. Banks here have been using TOTP for ages for online banking, with a physical authenticator. Tho iDIN is more recent.
Belgium has eID.
Re: Government launches login.gov to simplify access to public services
#148This appears valuable and well executed, but I worry that private businesses will be eager to outsource their authentication to this service, if they are allowed to. And once it's fully stood up, I suspect the government would be all too eager to oblige. This might be convenient, but might also mark the beginning of a major new point of U.S. government control over the Internet, with all the surveillance and other ci…
With the help of all the awesome new crypto algorithms isn't it possible to create a protocol for authentication via a central server without disclosing to the central server where the login goes?
Re: Government launches login.gov to simplify access to public services
#149Earlier quoted context omitted.
Given the alternative of handing out my SSN and hoping for the best, I'd be more than happy to use this for banking and related services. Presumably, third-party use would be covered by some form of ToS, and maybe we'd see actual repercussions for leaking data that originated here.
Even if you're not concerned that the government might get a list of all the sites you log into, what about arbitrary login revocation ? Suddenly someone gets a brain fart and decides that everyone on the terrorist watch list shouldn't be able to use this service? Now you're locked out of all the accounts you used this for, even if you're not a "bad guy". This is why I don't use "log in with google" or log in with Fa…
Government action could let you sue under (say ) free speech protections.
You can't sue FB for account termination
Re: Government launches login.gov to simplify access to public services
#150Earlier quoted context omitted.
Well, yeah. I can choose to not use Facebook (for the most part). I can't choose to not use the federal government. Plus, disliking and being wary of government is quintessentially American—it goes back to our roots as a country. As an example that just popped into my head, look at DACA: a bunch of undocumented persons told the federal government about their undocumented status (in exchange for something good) and no…
Those are valid points, but I think they miss the point of the question: are you more scared about data security in an online identity provider provided by the government or Facebook et. al.? Your answers were more about things the government can do to screw you over. It can do those things if your data is stored in Facebook as well: search warrants, compliance orders, subpoenas, etc. will all result in the governmen…
The point is, a warrant is a tiny bit more difficult to get than no warrant. Having all that data on their own site bypasses the need for one.