Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Source code for Dutch DigiD app released under Dutch Open Government Act

github.com

Post reply on HN
Print view View original

91–100 of 161 posts

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#91

Post by lucumo »

geraneum wrote: post #82
noirscape wrote: post #60

Earlier quoted context omitted.

On the other side of this, push-phishing through MFA fatigue has become extremely frequently used to hack into enterprise O365 instances (as well as Google Cloud accounts and the like). People don't generally read it when their phone apps send them a "please login" notification after the 200th one that day, they tend to approve it without thinking (or worse, accidentally approve a phishing notification while trying t…

This is real and a serious threat. Both the company I work in and I (personal account) have been targeted with this specific method. I got tens of random notification pop-ups on my phone in different days and I almost approved it once. It didn’t stop until I disabled login using that specific email address altogether. Edit: I received the notifications for Microsoft Authenticator app

Wouldn't a password prompt before sending the message effectively put an end to that as well?

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#92

Post by yurishimo »

jsiepkes wrote: post #38
Dobbs wrote: post #22

Earlier quoted context omitted.

I don't think I've ever used DigiD to verify my passport, I was vaguely aware it had the capability though. On the other hand I use DigiD all the time to login to websites. My health insurance, government websites, etc. Super efficient and simple. The passport feature is a new one to provide an alternative safer method of verifying ID for the times you need it. It isn't the default use of DigiD and is meant as an alt…

The passport NFC scan is only intended to authenticate with DigiD once. Basically to connect your DigiD account to "you". In the past this was done by them mailing you a letter with a password in it to your registered place of living.

This is still how it works for people without a Dutch passport but they live in Nederland. Eg. me :)

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#93

Post by cloudify »

mdrzn wrote: post #78
gorbypark wrote: post #48

Earlier quoted context omitted.

Wow, looks pretty nice from the screenshots. Do you have experience using it? Does it work well/do what it claims? I recently moved to Spain, who has a digital identity system, but is a pretty disjointed attempt.

It's a great app, doesn't do "much" except sending some government news from time to time. It was used a lot during Covid because it showed your negative QR code.

Well, apart from sending highly targeted updates to citizens, it is also used for:

1. receiving payment request for car tickets that you can pay right away with the credit card you saved in the app 2. receiving pending tax payments for local and national taxes that, again you can pay right away in the app 3. it was used for the national cashback program as a mean to enroll citizens, register the payment cards that could be used to accumulate points, setup banking details to get the prizes, etc... 4. distribute several government incentives (e.g. holiday bonus, bonus for young citizens, etc...)

After I left the project, the team was working on implementing a full digital signature solution that could be used to sign official requests to the public administration and they were also working on supporting legally valid communications from the government (vs just informational).

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#95

Post by doodlesdev »

icoder wrote: post #71
geraldwhen wrote: post #54

Earlier quoted context omitted.

It’s not, though. To confirm the method works you need to check every single comparison operator and value to ensure the range is bounded correctly. It’s code that stops you in your tracks. Pull request denied.

If that's the intended behaviour (having those boundaries and those results), how can you ever confirm that behaviour without checking them all?

You could have one check such as

  if(percentage  1) 
  {
      // Throw error here
  }
Also the checks in the if statements in the linked code are redundant since they simply disregard the previous check, they could simply check if percentage x - 1/10.

To be fair though, this is the kind of code where "if it's stupid and it works, it's not stupid" applies perfectly. While I would make these changes if I had to approve a PR I wouldn't change this in a live codebase just for refactoring purposes, specially because there are better ways to show progress to a user than using Unicode characters, which I think is the real smell here.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#96

Post by yurishimo »

Speaking as an immigrant from America, I really like DigiD! I wish the US had something even remotely similar. The fact that we do not have a standardized national ID easily available to everyone is embarrassing.

DigiD has some minor annoyances, but it's a helluva lot better than some alternatives I could think of.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#97

Post by yurishimo »

wdb wrote: post #94

As a Dutch person this is the only bit I was never able to get/register for since it got introduced. Requested it since like 2003/2004 or something.

Do you live in Nederland still? You can request the verification via post instead of using your passport. If you lose your DigiD login, you can also create/request another. The account acts as a pointer to your official ID. My wife made a mistake and had to attempt the process 3 times. Not a problem.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#98

Post by miohtama »

krono wrote: post #62
lucumo wrote: post #39

I find the DigiD app to be one of the most annoying implementations of 2FA out there. You have to unlock the app with a pin code, then enter an app-generated code on the site, then scan a QR with the app, and then grant permission to login to that site. If you compare that to 2FA for Office 365 for example, where you just have a push notification where you press a button to allow, then you can't help but think that s…

For an app that cost in the tens of millions to produce[1], and for which the company (gov-owned and operated) behind it charges implementors/users (not end-users ofc)[2] for each and every single successful DigID authentication event €0.13, DigID authorization event €0.88, and even for every digital message delivered into your "berichtenbox" €0.32, it could.. no rather it should indeed provide a much better experien…

“ This code has been disclosed in response to a request under the Dutch Open Government Act ("Wet open Overheid"). This implies that publication is primarily driven by the need for transparence, not re-use. Re-use is permitted under the EUPL-license, with the exception of source files that contain a different license.”

It sounds like they might not been very keen to maintain the app.

Can there be alternative better implementations or DigID “hardcoded” to one provider?

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#99

Post by doodlesdev »

c7DJTLrn wrote: post #84
kf wrote: post #2

Example: https://imgur.com/a/9cIDQtk

It's pretty pathetic how many people feel the need to dunk on this bit of code just because it's not how they would write it. There's nothing really wrong with it. I'm sure the author was aware of alternative, perhaps more concise solutions using a string builder but they chose to be clear instead. So many big egos in software.

I'm pretty sure they weren't because of the redundant conditionals which simply defy logic. If there was only one check for every if statement, honestly I could give this a pass since it's at the very least simple, but by adding one extra redundant check for every statement you just created 9 new places where a bug could appear.

Furthermore, using Unicode characters to represent progress is the true smell here. There simply are better ways to do this.

In the grand scheme of things, does it matter? No. But this is Hacker News LOL, someone has to discuss it.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#100

Post by jpcrs »

melvinmelih wrote: post #79

This function is interesting: https://twitter.com/jeroenfrijters/status/161520407458818048...

I don't know why so many people are saying that this is bad code.

Besides the redundant checks, it's really simple, so simple that an intern, maybe even someone who doesn't code, can understand and update it.

It's performant, most compilers will cache the strings.

People trying to justify more complex one-liners with "what if you change the symbol, or just show 5 characters" etc. These scenarios wouldn't take more than 5 minutes to adapt this code, and anyone could do it.

For me, this code with a good set of tests doesn't get much better.

Post reply on HN