Live data from Hacker News

Source code for Dutch DigiD app released under Dutch Open Government Act

github.com

121–130 of 161 posts

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#121
post #94

As a Dutch person this is the only bit I was never able to get/register for since it got introduced. Requested it since like 2003/2004 or something.

Living overseas it took them several yesrs to realize that making a trip to an embassy overseas just to get a registration code was not a feasible way.

Luckily Corona made them realize you can also do it over a Skype call.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#122

Earlier quoted context omitted.

This is the baffling side of the EU to all outsiders/newcomers. When I first moved here, that was my first thought as well. There is just so much in common, why repeat everything everywhere instead of single effort with branches everywhere?! (police force, consular services, Identity services, and pretty much any Government paperwork one can think of, transportation services etc). However, the population is very loca…

> I do wish doing things at EU level becomes the norm, and individualities slowly disappear. Unless you reach an economic moment where you can pay the same to a policeman in Sweden and a policeman in Greece there is never going to be a socioeconomic identity that would allow you to aggregate all these people in some sort of federation police force. Same for rail, same for most anything where there is a cost or expens…

Unless you reach an economic moment where you can pay the same to a policeman in Sweden and a policeman in Greece there is never going to be a socioeconomic identity that would allow you to aggregate all these people in some sort of federation police force.

Why?

Localized pay has been a thing for literally centuries, across a wide swath of fields.

This is not about standardized pay, but about resource sharing.

Imagine a study about an uptick in a certain type of crime. Easier on one big force, than 20 little ones.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#123

Earlier quoted context omitted.

It's the frontend app. Even script kiddies can download it from the Play Store and decompile it.

There was a request (foia/woo) made to obtain source code for frontend and backend. The latter is still being considered to be released as well.

I know, that will take some time though as it will need multiple deep reviews before it's released (as it's critical infrastructure and releasing it will increase the visibility).

Overall this will improve the security of the system, if only from the people I've seen offer their time (for nothing!) to ensure that this process is a success.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#125
post #91

Earlier quoted context omitted.

This is real and a serious threat. Both the company I work in and I (personal account) have been targeted with this specific method. I got tens of random notification pop-ups on my phone in different days and I almost approved it once. It didn’t stop until I disabled login using that specific email address altogether. Edit: I received the notifications for Microsoft Authenticator app

Wouldn't a password prompt before sending the message effectively put an end to that as well?

YYMV: I'm on an OnePlus 8 using the Microsoft Authenticator App. OS update changed the PIN pad, which in turn soft-broke the M$ authenticator app's PIN lock security, rather than presenting a PIN pad to enter my PIN code, it now presents a full QWERTY keyboard... making it excedingly annoying to enter my PIN - to the point where I simply disabled the PIN lock on the app (not on my phone, obviously).

So yeah, MFA fatigue is a thing and a PIN lock on the notification is not going to survive for very long given these OEM shenanigans...

Edit: Also M$ Auth app offers no proper export of my MFA keys, so I am stuck in this walled garden :')

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#127

Speaking as an immigrant from America, I really like DigiD! I wish the US had something even remotely similar. The fact that we do not have a standardized national ID easily available to everyone is embarrassing. DigiD has some minor annoyances, but it's a helluva lot better than some alternatives I could think of.

It's was on purpose. Americans traditionally don't like the idea of a standard, mandatory national ID. But SSNs have basically been re-appropriated to serve that purpose, to get around that, despite them being explicitly listed as "not intended as a means of general identification."

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#128
post #78

Earlier quoted context omitted.

It's a great app, doesn't do "much" except sending some government news from time to time. It was used a lot during Covid because it showed your negative QR code.

Well, apart from sending highly targeted updates to citizens, it is also used for: 1. receiving payment request for car tickets that you can pay right away with the credit card you saved in the app 2. receiving pending tax payments for local and national taxes that, again you can pay right away in the app 3. it was used for the national cashback program as a mean to enroll citizens, register the payment cards that co…

How is the working environment in PA tech? Would you recommend working there?

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#129

Earlier quoted context omitted.

The 'Hoog' level seems to allow computer-connected readers, though. This should theoretically be a superset of 'Substantieel'. Windows and Mac only, though. https://www.logius.nl/domeinen/toegang/digid/hoe-werkt-het

That might change when the new EIDAS regulation is released (the levels come from that legislation).

The page I linked states that DigiD ‘Hoog’ conforms to the highest eIDAS level.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#130

Great so now we can be sure some hacker working at an intelligence agency or criminal syndicate reads this and now knows how to hack DigiD, which is basically the Dutch government's SSO. After you get in you can do all kinds of things like apply for student loans, passport taxes etc. There will be another layer of security but still.. this is not great. Don't get me wrong I am not against publishing source code but t…

Which would you rather trust?

1. A safe that's been sitting on a public square for ten years, which the best safe-crackers in the world have tried – and failed – to break.

2. A safe hidden in a secret room that no one is allowed to access, but the manufacturer claims it's safe without real evidence beyond "trust me".

Post reply on HN