Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Source code for Dutch DigiD app released under Dutch Open Government Act

github.com

Post reply on HN
Print view View original

61–70 of 161 posts

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#61

Post by noirscape »

belter wrote: post #50

"...This code has been disclosed in response to a request under the Dutch Open Government Act ("Wet open Overheid")..."' Sounds like it was not voluntary. Also not sure what kind of transparency is expected here, since there is no way to find if the source code published is the same used to build the app. Maybe decompilation is the way to go...

It's semi-voluntary; the request to open source the application came from the Dutch congress/2nd chamber if I recall, but took a while due to private information leaking concerns.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#62

Post by krono »

lucumo wrote: post #39

I find the DigiD app to be one of the most annoying implementations of 2FA out there. You have to unlock the app with a pin code, then enter an app-generated code on the site, then scan a QR with the app, and then grant permission to login to that site. If you compare that to 2FA for Office 365 for example, where you just have a push notification where you press a button to allow, then you can't help but think that s…

For an app that cost in the tens of millions to produce[1], and for which the company (gov-owned and operated) behind it charges implementors/users (not end-users ofc)[2] for each and every single successful DigID authentication event €0.13, DigID authorization event €0.88, and even for every digital message delivered into your "berichtenbox" €0.32, it could.. no rather it should indeed provide a much better experience than what we have now.

1: https://www.rijksfinancien.nl/memorie-van-toelichting/2019/O...

2: https://logius.nl/onze-organisatie/zakendoen-met-logius/door...

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#63

Post by ryukafalz »

Denvercoder9 wrote: post #55
lucumo wrote: post #39

I find the DigiD app to be one of the most annoying implementations of 2FA out there. You have to unlock the app with a pin code, then enter an app-generated code on the site, then scan a QR with the app, and then grant permission to login to that site. If you compare that to 2FA for Office 365 for example, where you just have a push notification where you press a button to allow, then you can't help but think that s…

That's a bad comparison, as you're comparing a full authentication process against just one step: with Office 365 (and SMS verification for DigiD) you additionally need to provide a username and password, which you don't need to do with the app. I think the only part that can reasonably be simplified without compromising security is to use a push notification instead of having to scan the QR-code.

What's the purpose of the code you're entering from the app? Isn't that a bit superfluous/couldn't the app open a communications channel with the server via the QR code you scan and provide that itself?

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#64

Post by ArnoVW »

sambe wrote: post #46
lucumo wrote: post #39

I find the DigiD app to be one of the most annoying implementations of 2FA out there. You have to unlock the app with a pin code, then enter an app-generated code on the site, then scan a QR with the app, and then grant permission to login to that site. If you compare that to 2FA for Office 365 for example, where you just have a push notification where you press a button to allow, then you can't help but think that s…

If you leave the country without setting up SMS you can’t ever use 2FA. They claim to support adding foreign numbers, support people being abroad, support adding new DigiD accounts from abroad, but oh no you can’t just add a number. Not even by going to an office or doing a virtual interview. I would think this violates EU law on discrimination. If you live in the UK post-Brexit it’s now totally impossible, I believe…

Holder of Dutch passport here. I created a DigiD account from France, using a French phone number.

You plan a video conf using their web app, connect at the right time, and show your passport when asked.

As an aside, I login without using their app, as my Android phone does not support Google Play.

Don't know what happens if you don't have a dutch passport though. I guess they are under no obligation to render services to people that are neither citizen nor national.

A bit like when I got married and the French state wanted proof that I wasn't already married before, during the period I had lived in the UK. The UK services wouldn't give me the time of day, since I was neither British nor living there. I ended up getting an official looking note from the Dutch embassy to the UK, stating that "to the best of their knowledge I wasn't married" =)

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#65

Post by nixpulvis »

matsemann wrote: post #21

The Norwegian welfare agency publish most of their code on github: https://github.com/navikt/ It's the organization you use if you're sick, lost your job, where you get your social security etc. Basically a huge behemoth of all kinds of social or labor services. While most of the code probably has little value for others (2000 different repos), I think it's quite noble that it's public, given it's made with tax payer…

Just curious, since it's been a dream of mine to have public services powered by open software: How often do bugs in the services get reported either, with direct references to the underlying software (function names, line numbers, etc.), or as changesets/PRs with proposal fixes?

Especially for simpler things like style/accessibility issues, I could see this being somewhat common honestly.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#66

Post by himlion »

jb1991 wrote: post #41
throwaway71271 wrote: post #8

In order to verify your ID with the app your phone must have NFC support to scan the passport/id, and on the screen where you do the verification it says: if your phone doesnt have support find a friend with a phone that supports it, I kid you not.. edit, found it in the code: https://github.com/MinBZK/woo-besluit-broncode-digid-app/blo...

For what it’s worth, what you describe is optional, there are other ways to verify if you do not have such a device.

I recently bought a car second hand, and for this flow logging in with ID verificiaton was mandatory.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#69

Post by ryokeken »

reacharavindh wrote: post #52
college_physics wrote: post #45

Earlier quoted context omitted.

maybe EU countries could save a bundle and co-develop these apps. might also improve quality / ensure best practises are available to all etc.

This is the baffling side of the EU to all outsiders/newcomers. When I first moved here, that was my first thought as well. There is just so much in common, why repeat everything everywhere instead of single effort with branches everywhere?! (police force, consular services, Identity services, and pretty much any Government paperwork one can think of, transportation services etc). However, the population is very loca…

sounds like USA and it's relation to its members states

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#70

Post by PestoDiRucola »

gorbypark wrote: post #48
cloudify wrote: post #36

Italy does the same: https://github.com/pagopa/io-app This is the official government app (you can get benefits, pay taxes, etc...), downloaded by 30+ million citizens, stack is React Native + Typescript

Wow, looks pretty nice from the screenshots. Do you have experience using it? Does it work well/do what it claims? I recently moved to Spain, who has a digital identity system, but is a pretty disjointed attempt.

Yeah it works pretty well. Italy also has a digital identity system called SPID which can be used to log in for all governmental services which also works pretty well.
Post reply on HN