Great so now we can be sure some hacker working at an intelligence agency or criminal syndicate reads this and now knows how to hack DigiD, which is basically the Dutch government's SSO. After you get in you can do all kinds of things like apply for student loans, passport taxes etc. There will be another layer of security but still.. this is not great. Don't get me wrong I am not against publishing source code but they ought to think about what they publish.
Source code for Dutch DigiD app released under Dutch Open Government Act
111–120 of 161 posts
Re: Source code for Dutch DigiD app released under Dutch Open Government Act
#112Speaking as an immigrant from America, I really like DigiD! I wish the US had something even remotely similar. The fact that we do not have a standardized national ID easily available to everyone is embarrassing. DigiD has some minor annoyances, but it's a helluva lot better than some alternatives I could think of.
> The fact that we do not have a standardized national ID easily available to everyone is embarrassing.
Surely that's hyperbole. State IDs are pretty standardized, and even more so with the REAL ID system (if the mandates for it ever go into effect). When have you ever had a problem using one state's ID in another state?
Re: Source code for Dutch DigiD app released under Dutch Open Government Act
#113Great so now we can be sure some hacker working at an intelligence agency or criminal syndicate reads this and now knows how to hack DigiD, which is basically the Dutch government's SSO. After you get in you can do all kinds of things like apply for student loans, passport taxes etc. There will be another layer of security but still.. this is not great. Don't get me wrong I am not against publishing source code but t…
It's the frontend app. Even script kiddies can download it from the Play Store and decompile it.
Re: Source code for Dutch DigiD app released under Dutch Open Government Act
#114Great so now we can be sure some hacker working at an intelligence agency or criminal syndicate reads this and now knows how to hack DigiD, which is basically the Dutch government's SSO. After you get in you can do all kinds of things like apply for student loans, passport taxes etc. There will be another layer of security but still.. this is not great. Don't get me wrong I am not against publishing source code but t…
It's the frontend app. Even script kiddies can download it from the Play Store and decompile it.
There was a request (foia/woo) made to obtain source code for frontend and backend. The latter is still being considered to be released as well.
Re: Source code for Dutch DigiD app released under Dutch Open Government Act
#115Question: can you modify, compile, and run that code and still have it work for the same uses?
It appears any important strings have been replaced with 'S' characters.
So you definitely can't use this unless you pull the strings from the compiled APK theyve published.
Re: Source code for Dutch DigiD app released under Dutch Open Government Act
#116"...This code has been disclosed in response to a request under the Dutch Open Government Act ("Wet open Overheid")..."' Sounds like it was not voluntary. Also not sure what kind of transparency is expected here, since there is no way to find if the source code published is the same used to build the app. Maybe decompilation is the way to go...
It's semi-voluntary; the request to open source the application came from the Dutch congress/2nd chamber if I recall, but took a while due to private information leaking concerns.
It was released as the result of a Freedom of Information (WOO/WOB) request made by serial "WOBBER/WOOOER" @BugBlauw, check his twitter (use google translate, works well with Dutch).
Re: Source code for Dutch DigiD app released under Dutch Open Government Act
#117This function is interesting: https://twitter.com/jeroenfrijters/status/161520407458818048...
It's easy to read, simple to maintain, and performant code. Maybe one of those newer switch expressions would make the code even clearer, but they already left the redundant lower bound checks in so I think the way this looks is quite intentional. Much easier to read than `int count = (int)Math.Floor(percentage / 10); return new String("#", count) + new String("-", 10 - count));` in my opinion and not worth writing a…
I agree; there are things in the code base that I personally dislike (a number of classes which could be decomposed into smaller units) but overall it's pretty good.
I had the honour of being able to review this under NDA before it was made public (pro bono, and limited to static analysis and an hour poking around suspicious looking classes). I've seen a lot of .Net code in my time and this was surprisingly good. Sure there are things which could be improved, but you'll find an order of magnitude more issues in most other code (especially dynamic languages, which are magnets inadvertent issues affecting correctness).
Re: Source code for Dutch DigiD app released under Dutch Open Government Act
#118Earlier quoted context omitted.
> btw I see that attaching an nfc reader to your computer is also supported. Theoretically supported, or actually possible? As it stands, DigiD must be used with either the Android or the IOS app in the 'Substantieel' mode of authenticity verification when accessing health care records. This is likely to be pushed to other uses of DigiD as well eventually.
The 'Hoog' level seems to allow computer-connected readers, though. This should theoretically be a superset of 'Substantieel'. Windows and Mac only, though. https://www.logius.nl/domeinen/toegang/digid/hoe-werkt-het
That might change when the new EIDAS regulation is released (the levels come from that legislation).
Re: Source code for Dutch DigiD app released under Dutch Open Government Act
#119Great so now we can be sure some hacker working at an intelligence agency or criminal syndicate reads this and now knows how to hack DigiD, which is basically the Dutch government's SSO. After you get in you can do all kinds of things like apply for student loans, passport taxes etc. There will be another layer of security but still.. this is not great. Don't get me wrong I am not against publishing source code but t…
So now we’ll know if it’s _actually_ secure. This is a good thing as far as I’m concerned.
Trusting it’s safe because you don’t know if its not sounds like a bad idea.
Re: Source code for Dutch DigiD app released under Dutch Open Government Act
#120Earlier quoted context omitted.
maybe EU countries could save a bundle and co-develop these apps. might also improve quality / ensure best practises are available to all etc.
Such a collaboration has the potential to save time, money, effort, and increase quality. But in reality it either ends up being "design by committee", or a few of the countries are the drivers and the rest are the followers who try all kinds of maneuvers to retain some control. Even if this is done under the umbrella of an EU institution, the politics work the same way except now every other country is trying all ki…
Power games happen in every large scale collaboration that does anything of value. This is not a reason to refuse doing it altogether.