Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Source code for Dutch DigiD app released under Dutch Open Government Act

github.com

Post reply on HN
Print view View original

81–90 of 161 posts

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#81

Post by lucumo »

Denvercoder9 wrote: post #55
lucumo wrote: post #39

I find the DigiD app to be one of the most annoying implementations of 2FA out there. You have to unlock the app with a pin code, then enter an app-generated code on the site, then scan a QR with the app, and then grant permission to login to that site. If you compare that to 2FA for Office 365 for example, where you just have a push notification where you press a button to allow, then you can't help but think that s…

That's a bad comparison, as you're comparing a full authentication process against just one step: with Office 365 (and SMS verification for DigiD) you additionally need to provide a username and password, which you don't need to do with the app. I think the only part that can reasonably be simplified without compromising security is to use a push notification instead of having to scan the QR-code.

> That's a bad comparison, as you're comparing a full authentication process against just one step: with Office 365 (and SMS verification for DigiD) you additionally need to provide a username and password, which you don't need to do with the app.

I hadn't even noticed that app login doesn't require username and password. With a password manager that doesn't add a lot of friction. Even when accounting for that extra step, I still find Office 365 and SMS verification much easier.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#82

Post by geraneum »

noirscape wrote: post #60
lucumo wrote: post #39

I find the DigiD app to be one of the most annoying implementations of 2FA out there. You have to unlock the app with a pin code, then enter an app-generated code on the site, then scan a QR with the app, and then grant permission to login to that site. If you compare that to 2FA for Office 365 for example, where you just have a push notification where you press a button to allow, then you can't help but think that s…

On the other side of this, push-phishing through MFA fatigue has become extremely frequently used to hack into enterprise O365 instances (as well as Google Cloud accounts and the like). People don't generally read it when their phone apps send them a "please login" notification after the 200th one that day, they tend to approve it without thinking (or worse, accidentally approve a phishing notification while trying t…

This is real and a serious threat. Both the company I work in and I (personal account) have been targeted with this specific method. I got tens of random notification pop-ups on my phone in different days and I almost approved it once. It didn’t stop until I disabled login using that specific email address altogether.

Edit: I received the notifications for Microsoft Authenticator app

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#83

Post by conviencefee999 »

matsemann wrote: post #21

The Norwegian welfare agency publish most of their code on github: https://github.com/navikt/ It's the organization you use if you're sick, lost your job, where you get your social security etc. Basically a huge behemoth of all kinds of social or labor services. While most of the code probably has little value for others (2000 different repos), I think it's quite noble that it's public, given it's made with tax payer…

[dead]

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#84

Post by c7DJTLrn »

kf wrote: post #2

Example: https://imgur.com/a/9cIDQtk

It's pretty pathetic how many people feel the need to dunk on this bit of code just because it's not how they would write it. There's nothing really wrong with it. I'm sure the author was aware of alternative, perhaps more concise solutions using a string builder but they chose to be clear instead.

So many big egos in software.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#85

Post by camgunz »

reacharavindh wrote: post #52
college_physics wrote: post #45

Earlier quoted context omitted.

maybe EU countries could save a bundle and co-develop these apps. might also improve quality / ensure best practises are available to all etc.

This is the baffling side of the EU to all outsiders/newcomers. When I first moved here, that was my first thought as well. There is just so much in common, why repeat everything everywhere instead of single effort with branches everywhere?! (police force, consular services, Identity services, and pretty much any Government paperwork one can think of, transportation services etc). However, the population is very loca…

My partner and I just moved to the Netherlands and I mildly disagree. For one, we really like the diversity and appreciate the different cultures and histories. But I also think there's something to different member states getting to experiment on their own. Like, the Finns are onto something with their school system for sure, but the Dutch have a lot of Montessori schools--what are the pros and cons of each approach?

But, yeah not that we're wild about international train travel--that's a sore spot for sure. But generally we view the differences as a kind of richness and less of an inconvenience.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#86

Post by melvinmelih »

sambe wrote: post #46
lucumo wrote: post #39

I find the DigiD app to be one of the most annoying implementations of 2FA out there. You have to unlock the app with a pin code, then enter an app-generated code on the site, then scan a QR with the app, and then grant permission to login to that site. If you compare that to 2FA for Office 365 for example, where you just have a push notification where you press a button to allow, then you can't help but think that s…

If you leave the country without setting up SMS you can’t ever use 2FA. They claim to support adding foreign numbers, support people being abroad, support adding new DigiD accounts from abroad, but oh no you can’t just add a number. Not even by going to an office or doing a virtual interview. I would think this violates EU law on discrimination. If you live in the UK post-Brexit it’s now totally impossible, I believe…

After moving to the States and losing my Dutch mobile number I was also not able to use it for more than 10 years.

During covid the government provided an ability to schedule a zoom call to verify identity remotely and set up Digid with a foreign number so I finally have it.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#87

Post by lucumo »

dr_dshiv wrote: post #44
lucumo wrote: post #39

I find the DigiD app to be one of the most annoying implementations of 2FA out there. You have to unlock the app with a pin code, then enter an app-generated code on the site, then scan a QR with the app, and then grant permission to login to that site. If you compare that to 2FA for Office 365 for example, where you just have a push notification where you press a button to allow, then you can't help but think that s…

On mobile, you just use pin. So easy! On desktop, you use pin, type code, then scan. I find the flow quite smooth.

> On desktop, you use pin, type code, then scan. I find the flow quite smooth.

I find the constant back and forth between devices annoying. 2FA is already annoying because you have to switch from desktop to mobile and back, but that can't be helped. There's no need to make it 6 times, though: desktop (on site) -> mobile (start app + pin) -> desktop (fill in code) -> mobile (get camera) -> desktop (scan QR) -> mobile (press allow) -> desktop (continue on site)

That's just being irritating.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#88

Post by eugenekolo »

seydor wrote: post #80
melvinmelih wrote: post #79

This function is interesting: https://twitter.com/jeroenfrijters/status/161520407458818048...

LLMs can do better

This one's pretty fancy from the big GPT.

``` Here is an example of Python code that can print a loading bar at different completion percentages:

def print_loading_bar(percent): bar_length = 20 hashes = '#' * int(percent * bar_length / 100) spaces = ' ' * (bar_length - len(hashes)) print(f'\rLoading... [{hashes}{spaces}] {percent}%', end='')

for i in range(101): print_loading_bar(i) time.sleep(0.1) ```

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#89

Post by doodlesdev »

rsynnott wrote: post #20
kf wrote: post #2

Example: https://imgur.com/a/9cIDQtk

I vaguely suspect that this is a product of the sort of environment where you have to fill out a form in triplicate to get the static analyser to let you concatenate strings (which, to be clear, may not be inappropriate for something like this). I do object to the variable being called ‘percentage’ tho, as it clearly isn't one.

I have no idea where all of you got the idea that percentages go up to 100. It's in the name: PER centage, meaning x/100 [0].

For instance if you want 20% that could also be expressed as a fraction such as 20/100, which turns out is the same as 2/10 or 0.2.

I do think they should remove the redundant statements in the conditions and also have an assertion that guarantees percentage to be [0, 1].

> The term "percent" is derived from the Latin per centum, meaning "hundred" or "by the hundred". The sign for "percent" evolved by gradual contraction of the Italian term per cento, meaning "for a hundred". The "per" was often abbreviated as "p."—eventually disappeared entirely. The "cento" was contracted to two circles separated by a horizontal line, from which the modern "%" symbol is derived.

This might be a little more obvious for me since my first language is derived from Latin, but anyhow it still keeps the meaning in english.

[0]: https://en.m.wikipedia.org/wiki/Percentage

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#90

Post by yurishimo »

rsynnott wrote: post #20
kf wrote: post #2

Example: https://imgur.com/a/9cIDQtk

I vaguely suspect that this is a product of the sort of environment where you have to fill out a form in triplicate to get the static analyser to let you concatenate strings (which, to be clear, may not be inappropriate for something like this). I do object to the variable being called ‘percentage’ tho, as it clearly isn't one.

This is likely an effect of translation more than anything. While the Dutch are generally very competent English speakers and writers, their expertise tends to end the conversational level. Anything technical in its conception takes decades of intense every day use to intuit.

Source: native English speaker working in the Netherlands with a team of Dutch people. They are all really smart people, but they tend to err on the side of simple vocabulary when forced to think in English.

Post reply on HN