Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Government launches login.gov to simplify access to public services

18f.gsa.gov

Post reply on HN
Print view View original

151–160 of 173 posts

Re: Government launches login.gov to simplify access to public services

#151

Post by mdpopescu »

latchkey wrote: post #130

A total nit pick, but why do people have such a hard time consistently naming something as simple as a boolean variable? If we remember that naming is one of the hardest things in software engineering, why don't we put more thought into it? From the documentation in the README: https://github.com/18F/identity-idp disable_email_sending: ‘true’ enable_load_testing_mode: ‘true’ telephony_disabled: ‘true’ Multiple direct…

I agree with having positive names in booleans (email_enabled vs disable_email_sending), but not with having verbs as booleans. send_email is an action; the corresponding flag should be email_enabled or is_email_enabled.

Re: Government launches login.gov to simplify access to public services

#152

Post by hvvvggg »

grzm wrote: post #9
oh_sigh wrote: post #6

Earlier quoted context omitted.

I know I'm not supposed to say this, but you obviously either didn't read the article or read it but didn't understand it, and perhaps you would be better off reading it more closely before commenting. The article lays out that this is not centralizing information, but is merely allowing a bunch of different agencies to use it as an identity provider. The same way I can, say, connect to my spotify via my Google+ acco…

> I know I'm not supposed to say this, but you obviously either didn't read the article If you're referring to the guidelines, they also show how leaving out sentiments like these doesn't diminish the clarification you're adding: > Please don't insinuate that someone hasn't read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that." [0] https://news.ycombinator.…

Christ. Are you a moderator yet?

Re: Government launches login.gov to simplify access to public services

#153

Post by denzil_correa »

mizzao wrote: post #62
pdabbadabba wrote: post #31

This appears valuable and well executed, but I worry that private businesses will be eager to outsource their authentication to this service, if they are allowed to. And once it's fully stood up, I suspect the government would be all too eager to oblige. This might be convenient, but might also mark the beginning of a major new point of U.S. government control over the Internet, with all the surveillance and other ci…

In many countries (e.g. Denmark), this is already the case. https://en.wikipedia.org/wiki/NemID

But do these countries have the same laws, processes like the USA? If not, there's no point in mentioning some other country has it.

For example, in Norway you can see everyone's tax returns [0]. The caveat is that if you see someone else's tax return - the person will be notified. Now, if you just make tax returns public without the notification - it would be a different policy and not comparable to Norway. Therefore, comparisons/mentions should be complete and apt.

[0] https://www.theguardian.com/money/blog/2016/apr/11/when-it-c...

Re: Government launches login.gov to simplify access to public services

#154

Post by sheeshkebab »

7imon7ays wrote: post #27
rhencke wrote: post #22

For those interested, development is done in the open here: https://github.com/18F/identity-idp

A rails app?? That's kinda awesome.

Rails app?? I’d think something go-based would be more appropriate for this kind of service.

Re: Government launches login.gov to simplify access to public services

#155

Post by rhencke »

sheeshkebab wrote: post #154
7imon7ays wrote: post #27

Earlier quoted context omitted.

A rails app?? That's kinda awesome.

Rails app?? I’d think something go-based would be more appropriate for this kind of service.

Why? Rails powers many huge, important things.

Like GitHub.

Re: Government launches login.gov to simplify access to public services

#156

Post by Johnny555 »

britta wrote: post #136
Johnny555 wrote: post #103

Earlier quoted context omitted.

Hmm...you have to move to Washington DC to work for them, they won't pay for relocation, salaries are capped by federal pay grades and are lower than a tech company in SF or Seattle would pay, no bonuses (or stock options, obviously). I'm sure they have some bright (and altruistic) employees, but I'm not sure the best engineers in the world would work there when they can earn far more compensation at a tech company.

You need to move to DC to work for USDS ( https://www.usds.gov/join#relocation ), but you can work for 18F from anywhere in the US ( https://18f.gsa.gov/join/ ). The login.gov team includes both USDS and 18F team members (as the blog post says). Also the salary cap is $161,900, as shown in this pay grade table for SF: https://www.opm.gov/policy-data-oversight/pay-leave/salaries... Not a top-of-the-line private sector…

160k is a run of the mill senior engineer salary.... The best engineers in the world can earn 300k or more in Silicon Valley. It takes an altruistic engineer to give up half his salary to work for the public.

Re: Government launches login.gov to simplify access to public services

#157

Post by ineptech »

wyager wrote: post #110
ineptech wrote: post #92

Earlier quoted context omitted.

> Sites will use such a service to invade your privacy even further, That's not how OAuth works. https://en.wikipedia.org/wiki/OAuth > the government has a record of every site you've logged into Only the ones where you chose to use their service. Or are we imaginging a future where this service has been made mandatory, and logins and passwords have been abolished? Honestly, the amount of FUD in this thread is absurd…

I know very well how oauth works, thanks, but I'm not sure why you thought that had anything to do with my comment. The invasion of privacy comes from websites insisting on knowing who I am and refusing to allow me to make anonymous/pseudonymous accounts. If there's a convenient API to do so provided by the government, that's bad for users. > Only the ones where you chose to use their service. There are hundreds of w…

> your skepticism on this topic is wildly miscalibrated

The reason I'm not worried about the government finding out which websites I visit is because they already know, from traffic inspection at the ISP level. Don't think I'm the one miscalibrated here.

Beyond that, the problem with this "but they might do something bad!" argument is not that it's false, it's that it's always true in every case. Literally every government policy could be the precursor to something terrible. Sure, they could introduce an optional OAuth to try to stop identity theft and then later use it to censor the internet, but they could also just censor the internet straightaway.

Re: Government launches login.gov to simplify access to public services

#158

Post by jrminton »

Thanks for all of the passionate comments on login.gov!

First, my name is Joel Minton and I lead login.gov. All of us who came here to build this did so to drive higher Security, Privacy and Usability for all Americans. This is a core building block that we believe will benefit millions of Americans and the government agencies that serve them.

Second, the tradeoffs that we have been considering for over 18 months are very similar to those that all of you are bringing up as well. We have made a lot of progress on balancing these tradeoffs, which are primarily focused on Security, Privacy and Usability. Since we are constantly iterating to improve login.gov, we welcome any future feedback that you and others provide.

Third, for anyone who has a background in identity and/or large scale platforms and is interested in serving our country by helping to build this critical platform, please consider joining us. Your salary would not likely be as high as the private sector, but trust me, the amount of positive impact you would have on our country is tremendous. You can DM me either on Linked In or my lightly used twitter Account (jrminton).

Thanks again!

Re: Government launches login.gov to simplify access to public services

#159

Post by gumby »

Buge wrote: post #140
gumby wrote: post #78

Earlier quoted context omitted.

Even if you're not concerned that the government might get a list of all the sites you log into, what about arbitrary login revocation ? Suddenly someone gets a brain fart and decides that everyone on the terrorist watch list shouldn't be able to use this service? Now you're locked out of all the accounts you used this for, even if you're not a "bad guy". This is why I don't use "log in with google" or log in with Fa…

With the government you have free speech rights, so you can sue them if they close your account. With private companies you have no free speech rights and they can close your account whenever they want. So account closure seems like a positive point of government-controlled login.

Look up the secrecy and lack of oversight over the so-called "terrorist" watchlist and the calls for scope creep, and see if you are so confident about those first amendment rights. I'm sure failure to log in would not be considered a first amendment right.

I agree that the government should be a far more dependable provider than any private sector organization. But the recent (last 20 years) enthusiasm for scope creep has not been encouraging.

Post reply on HN