Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coding Horror: Your Internet Driver's License

codinghorror.com

Post reply on HN
Print view View original

81–90 of 101 posts

Re: Coding Horror: Your Internet Driver's License

#81

Post by city41 »

waterhouse wrote: post #60

> It always pained me greatly that every rinky-dink website on the entire internet demanded that I create a special username and password just for them. ... For the vast, silent majority of normals, who know nothing of security but desire convenience above all, this means one thing: using the same username and password over and over. And it's probably a simple password, too. > This is the status quo of identity on th…

I do this too. This system fails pretty badly when you encounter a site that insists on certain formats for their passwords. For example not allowing special characters.

Generally that's a red flag and I just don't use the site, but I don't always have that luxury. The service my company uses for performance evaluations has this limitation. Hmmm, a website I go to at most 3 times a year, requires a significantly complex password due to the site's nature, and yet won't let me use special characters making all my memorized "hard" passwords impossible? Yup, I have to request a new password everytime I visit it. Very annoying.

Re: Coding Horror: Your Internet Driver's License

#82

Post by dionysiac »

IMO, A big danger of implementing centralized authentication across multiple sites is that will make social engineering schemes aimed at stealing a user's credentials more plausible and effective.

I know that systems such as OpenID and others perform authentication directly between the user and thetrusted provider (google, facebook, twitter, etc), and that the site ends up with a one-time token that confirms the user's identity. The site requesting authentication never gets the actual password to the openID account, which makes this approach viable in a technical security sense.

But here's the thing: general users are getting used to entering their centralized credentials to perform actions on untrusted sites. Technical users understand the design. We can confirm that, yes, TwitScoop does indeed direct us to twitter.com/oauth/... (no HTTPS, but that's another story).

Regular users posting a comment on a blog, though, don't see any difference between giving their credentials to a trusted Google login site and entering their credentials into some form on a blog.

If, for example, logging in with Facebook credentials becomes common, it would be trivial to create a rogue blog which collects login information. Fill it with a few incendiary posts, possibly create an official-looking Facebook login page that doesn't display its URL, and it would be possible to capture quite a few sets of credentials.

Re: Coding Horror: Your Internet Driver's License

#83

Post by anamax »

rbanffy wrote: post #49
anamax wrote: post #44

Earlier quoted context omitted.

> However Jeff Atwood is from the USA which has a strangley low number of passport holders. It's not strangely low; Americans can travel to far more than the equivalent of the EU without one. (We can go to all 50 plus Canada and Mexico.)

This notion of equivalence is a very interesting concept.

The US is is geographically larger than Europe, has a comparable number of people, and is arguably as diverse.

Yes, it looks like we speak the same language, but the diversity in "American" is at least as broad as the difference between the middle of "American" and "received English". (Yes, I'm aware that there's a lot of diversity in UK English.)

Yes, Americans mostly watch the same TV, but our exports and castoffs are not unknown in Europe.

Re: Coding Horror: Your Internet Driver's License

#84

Post by stoney »

rmc wrote: post #25
patio11 wrote: post #2

I am not sanguine on the idea, but the marketing for the idea is beyond terrible. The IDL is a leaky abstraction because the most salient features of drivers licenses are a) you have to apply to the government to get one, b) the government can take yours away with as much ease as they can do anything else, and c) if you lose your license, you will be denied the ability to use one or more critical goods/services (driv…

Perhaps a more accurate metaphore would be "Internet Passport". Government's can't take it away and it has no real entitlements. However Jeff Atwood is from the USA which has a strangley low number of passport holders. Perhaps they are used to using a driving licence instead of passport as general ID.

I think the point is that few people carry their passport around with them on a day to day basis even in countries where they are very common.

I've lived in the UK and Oz and in both countries my drivers license stays in my wallet ready for when an over eager bouncer to ask me to prove my age or for when I sign up to a new video store on a whim. My passport pretty much stays at home unless I'm going to the airport.

Re: Coding Horror: Your Internet Driver's License

#85

Post by kleiba »

arethuza wrote: post #53
rbanffy wrote: post #47

Earlier quoted context omitted.

Who issued your driver's license?

But not everyone had a drivers license or a passport - so they wanted everyone to have a separate ID card. Generally, having a formal ID has only been required in the UK during dire emergencies (i.e. World Wars) and contrary to what the government of the time thought we are not in the middle of such a crisis.

Every German older than 16 is required by law to have an ID card or passport. As of November 2010, ID cards carry RFID chips with the same data that's written on the card plus an optional fingerprint. Passports have had the chip for a while already, but the fingerprint is mandatory there. Driver's licenses are not considered a valid means of identification outside traffic.

Re: Coding Horror: Your Internet Driver's License

#86

Post by alextgordon »

lmkg wrote: post #68
patio11 wrote: post #2

I am not sanguine on the idea, but the marketing for the idea is beyond terrible. The IDL is a leaky abstraction because the most salient features of drivers licenses are a) you have to apply to the government to get one, b) the government can take yours away with as much ease as they can do anything else, and c) if you lose your license, you will be denied the ability to use one or more critical goods/services (driv…

Personally, the idea I have in my mind of a (US) driver's license is a universally-accepted form of ID that anyone can get. The facts that it has a test, or that it can be revoked, or that some people don't have one, don't actually register in my head until someone points it out. If it weren't in the name, I wouldn't even connect it with driving. Furthermore, it's the only abstraction I have in my head for a universa…

Personally, the idea I have in my mind of a (US) driver's license is a universally-accepted form of ID that anyone can get.

Don't you have to take a test to obtain a licence? Here in the UK the test is relatively difficult and expensive, so not everybody has a licence. Passports are much cheaper, easier to obtain and don't come with age limits, so they are a more universal form of ID (though they are also bulky and hardly something you would carry around on you).

When most people think of driver's licenses, do they really think government certification, or do they think universal ID? I would be honestly interested in the answer.

When I think of driver's licences, I think of driving a car. Universal ID doesn't occur.

Re: Coding Horror: Your Internet Driver's License

#87

Post by stoney »

The problem is, a lot of the time I don't want my various internet IDs linked together - I want something more like the coffee club loyalty card for each website I visit. I definitely don't want facebook knowing which sites I use (frankly I don't trust them enough) and I'm not too keen on Google knowing either.

The crucial difference between a drivers license and some kind of centralised internet ID is that anyone can verify a drivers licence with a reasonable degree of accuracy - they don't need to contact the government each time to see if it's genuine.

With an internet ID the provider gets to collect a lot of information about me and what I'm doing (not saying they would, just saying they could), which makes me nervous.

Re: Coding Horror: Your Internet Driver's License

#88

Post by URSpider94 »

lmkg wrote: post #68
patio11 wrote: post #2

I am not sanguine on the idea, but the marketing for the idea is beyond terrible. The IDL is a leaky abstraction because the most salient features of drivers licenses are a) you have to apply to the government to get one, b) the government can take yours away with as much ease as they can do anything else, and c) if you lose your license, you will be denied the ability to use one or more critical goods/services (driv…

Personally, the idea I have in my mind of a (US) driver's license is a universally-accepted form of ID that anyone can get. The facts that it has a test, or that it can be revoked, or that some people don't have one, don't actually register in my head until someone points it out. If it weren't in the name, I wouldn't even connect it with driving. Furthermore, it's the only abstraction I have in my head for a universa…

I agree with you that a driver's license is more a form of ID than a public safety credential, if you live in the USA.

Why?

-- You have to take a test to get it, but you do that when you are 16 or 17, and never again. In most states, the test is ridiculously easy.

-- In an average year, you probably use it hundreds of times for its ID value (to buy beer at the grocery store or drinks at a bar, to cash a check, to check in for an airline flight), and (hopefully) zero times for the public safety function (showing it to a police officer after being pulled over).

-- Outside of NYC, the fraction of people over the legal driving age who don't have a license has to be less than 10%

Re: Coding Horror: Your Internet Driver's License

#89

Post by masklinn »

arethuza wrote: post #38
wazoox wrote: post #18

Earlier quoted context omitted.

That, and the concept of the driver's license as the definitive ID document is quasi exclusively and strongly connoted as a funny US peculiarity.

I'm in the UK and my driver's license is the only form of "official" ID I normally carry. Much to my delight, we canceled the silly project to issue government ID cards.

In France, the driver's license isn't even allowed as an ID, passport or ID card yes, license no.

Re: Coding Horror: Your Internet Driver's License

#90

Post by masklinn »

alextgordon wrote: post #86
lmkg wrote: post #68

Earlier quoted context omitted.

Personally, the idea I have in my mind of a (US) driver's license is a universally-accepted form of ID that anyone can get. The facts that it has a test, or that it can be revoked, or that some people don't have one, don't actually register in my head until someone points it out. If it weren't in the name, I wouldn't even connect it with driving. Furthermore, it's the only abstraction I have in my head for a universa…

Personally, the idea I have in my mind of a (US) driver's license is a universally-accepted form of ID that anyone can get. Don't you have to take a test to obtain a licence? Here in the UK the test is relatively difficult and expensive, so not everybody has a licence. Passports are much cheaper, easier to obtain and don't come with age limits, so they are a more universal form of ID (though they are also bulky and h…

See his next phrase.
Post reply on HN