Source code for Dutch DigiD app released under Dutch Open Government Act • Hacker News Board

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#71

Post by icoder » Wed, Jan 18, 2023, 2:05 PM UTC

geraldwhen wrote: post #54

sam_lowry_ wrote: post #7

Earlier quoted context omitted.

It's been extensively discussed on twitter, and the general conclusion seems to be that yes, this particular snippet is good code.

It’s not, though. To confirm the method works you need to check every single comparison operator and value to ensure the range is bounded correctly. It’s code that stops you in your tracks. Pull request denied.

If that's the intended behaviour (having those boundaries and those results), how can you ever confirm that behaviour without checking them all?

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#72

Post by rileymat2 » Wed, Jan 18, 2023, 2:06 PM UTC

krono wrote: post #62

lucumo wrote: post #39

I find the DigiD app to be one of the most annoying implementations of 2FA out there. You have to unlock the app with a pin code, then enter an app-generated code on the site, then scan a QR with the app, and then grant permission to login to that site. If you compare that to 2FA for Office 365 for example, where you just have a push notification where you press a button to allow, then you can't help but think that s…

For an app that cost in the tens of millions to produce[1], and for which the company (gov-owned and operated) behind it charges implementors/users (not end-users ofc)[2] for each and every single successful DigID authentication event €0.13, DigID authorization event €0.88, and even for every digital message delivered into your "berichtenbox" €0.32, it could.. no rather it should indeed provide a much better experien…

If the money is going back into the public coffers supplanting other tax revenue, a fee for delivery must help prevent spam? I don't know enough about the topic but at first glance it seems there could be worse things.

I suppose it would hinge on your view of regressive use fees as well.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#73

Post by noirscape » Wed, Jan 18, 2023, 2:10 PM UTC

bondarchuk wrote: post #30

Freak_NL wrote: post #24

Earlier quoted context omitted.

> btw I see that attaching an nfc reader to your computer is also supported. Theoretically supported, or actually possible? As it stands, DigiD must be used with either the Android or the IOS app in the 'Substantieel' mode of authenticity verification when accessing health care records. This is likely to be pushed to other uses of DigiD as well eventually.

I didn't get that from the app, I just went to mijn.belastingdienst.nl > "Inloggen op Mijn Belastingdienst" > "Inloggen met DigiD" > "Met mijn identiteitskaart", there you have to choose a device and you can pick either a smartphone or a computer with NFC reader. Didn't verify that it works but since the option is there...

To my memory, the way that works is that there is a second app that you can use to scan document IDs (it's the same one used to transfer ID verification to a non-NFC supported phone actually) and you can scan the document with that and it'll act as a password during the regular login flow.

It does require a separate one-time activation of that specific ID card with the government (a physical letter gets mailed to your address with a code to activate that card on next login), but after that it's mostly painless.

If I'm gonna guess, it's intended for people that for whatever reason can't have a consistent DigiD app to login with (ie. Developer devices that are frequently reset over and over and would lose their regular login).

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#74

Post by tijsvd » Wed, Jan 18, 2023, 2:11 PM UTC

ryukafalz wrote: post #63

Denvercoder9 wrote: post #55

Earlier quoted context omitted.

That's a bad comparison, as you're comparing a full authentication process against just one step: with Office 365 (and SMS verification for DigiD) you additionally need to provide a username and password, which you don't need to do with the app. I think the only part that can reasonably be simplified without compromising security is to use a push notification instead of having to scan the QR-code.

What's the purpose of the code you're entering from the app? Isn't that a bit superfluous/couldn't the app open a communications channel with the server via the QR code you scan and provide that itself?

Then the app relies purely on the ssl cert of the server, for mitm mitigation. This way, the qr can contain a signed reply to the code, which adds a layer.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#75

Post by googlryas » Wed, Jan 18, 2023, 2:15 PM UTC

lucumo wrote: post #34

pelorat wrote: post #17

Earlier quoted context omitted.

I'm triggered by the lack of brackets after every if-expression. Sure it looks nicer this way but the default Visual Studio code style settings will complain if you don't do it, hence I'm used to it.

I've started to remove them from my own code. It's widely mentioned as The Right Way, but I feel the reasons why are obsolete. The stated reason is always that you could forget to add braces when adding a second statement. That was useful in a time where a text editor was "smart" when it copied your indentation to a new line. But nowadays any tooling will warn you when indentation doesn't match the bracing. The odds…

You don't know what tooling anyone editing your code is using though.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#76

Post by sandos » Wed, Jan 18, 2023, 2:15 PM UTC

lucumo wrote: post #39

I find the DigiD app to be one of the most annoying implementations of 2FA out there. You have to unlock the app with a pin code, then enter an app-generated code on the site, then scan a QR with the app, and then grant permission to login to that site. If you compare that to 2FA for Office 365 for example, where you just have a push notification where you press a button to allow, then you can't help but think that s…

The Swedish "Bankid" is very nice to use, imho. Its very similar to the MS authhenticator.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#77

Post by DoingIsLearning » Wed, Jan 18, 2023, 2:16 PM UTC

reacharavindh wrote: post #52

college_physics wrote: post #45

Earlier quoted context omitted.

maybe EU countries could save a bundle and co-develop these apps. might also improve quality / ensure best practises are available to all etc.

This is the baffling side of the EU to all outsiders/newcomers. When I first moved here, that was my first thought as well. There is just so much in common, why repeat everything everywhere instead of single effort with branches everywhere?! (police force, consular services, Identity services, and pretty much any Government paperwork one can think of, transportation services etc). However, the population is very loca…

> I do wish doing things at EU level becomes the norm, and individualities slowly disappear.

Unless you reach an economic moment where you can pay the same to a policeman in Sweden and a policeman in Greece there is never going to be a socioeconomic identity that would allow you to aggregate all these people in some sort of federation police force. Same for rail, same for most anything where there is a cost or expense or transaction.

The diversity of systems reflects a diversity of arbitrage. Brute forcing that into a single entity or federal body is ivory tower thinking.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#78

Post by mdrzn » Wed, Jan 18, 2023, 2:20 PM UTC

gorbypark wrote: post #48

cloudify wrote: post #36

Italy does the same: https://github.com/pagopa/io-app This is the official government app (you can get benefits, pay taxes, etc...), downloaded by 30+ million citizens, stack is React Native + Typescript

Wow, looks pretty nice from the screenshots. Do you have experience using it? Does it work well/do what it claims? I recently moved to Spain, who has a digital identity system, but is a pretty disjointed attempt.

It's a great app, doesn't do "much" except sending some government news from time to time. It was used a lot during Covid because it showed your negative QR code.