7 ms·

This appears valuable and well executed, but I worry that private businesses will be eager to outsource their authentication to this service, if they are allowe

This appears valuable and well executed, but I worry that private businesses will be eager to outsource their authentication to this service, if they are allowed to. And once it's fully stood up, I suspect the government would be all too eager to oblige. This might be convenient, but might also mark the beginning of a major new point of U.S. government control over the Internet, with all the surveillance and other civil liberties issues that this might raise, to say nothing of the issues that could arise from this degree of centralization. Now seems like the time to set the expectation that this service may not ever be used by private websites. Of course, we tried that with Social Security numbers too, for all the good it did us. http://www.nytimes.com/1998/07/26/weekinreview/the-nation-not-for-identification-purposes-just-kidding.html?mcubz=1 http://www.nytimes.com/1998/07/26/weekinreview/the-nation-no...

spencerhakim 9y ago
Given the alternative of handing out my SSN and hoping for the best, I'd be more than happy to use this for banking and related services. Presumably, third-party use would be covered by some form of ToS, and maybe we'd see actual repercussions for leaking data that originated here.
- KGIII 9y ago
  Repercussions? For the OPM hack, I got a form letter and a year (I think, I didn't use it) of credit monitoring. That was some of my most intimate information. That was a huge invasion of my privacy. I didn't even get a phone call. I didn't even get a sincere apology.
  - ylem 9y ago
    Just as an FYI, I think they extended the period to 10 years. I agree that it was handled poorly!
    - KGIII 9y ago
      I froze my credit. I am in a position where I don't need credit and can get credit by virtue of assets if I did need to. I was, for lack of a better phrase, pretty pissed off. I got a form letter and something about credit monitoring in one of those weird security envelopes, as I recall. Ten years? Yeah, that'll help. I pretty much admitted to everything I'd ever done, on those forms. It wasn't just me impacted, it had names of my friends and family. Then, I'm guessing it had all the notes I didn't see, from things like the interviews. I don't have any real enemies, or any reason to be afraid, but that makes me no less angry and feel no less violated. Meh... I try to let the anger go, so it only pops up when I discuss it. There's nothing I can do to change it. I do consider it the greatest violation of trust ever enacted on me by the government. There was no reason for me to even be in the system any more, I am retired. [redacted] Oh well... If you can get away with it, freeze your credit. This does, curiously, impact your credit score. The peace of mind is worth it. Sorry for the novella.
- gumby 9y ago
  Even if you're not concerned that the government might get a list of all the sites you log into, what about arbitrary login revocation? Suddenly someone gets a brain fart and decides that everyone on the terrorist watch list shouldn't be able to use this service? Now you're locked out of all the accounts you used this for, even if you're not a "bad guy". This is why I don't use "log in with google" or log in with Facebook" -- I don't think those companies are evil (I use them both) but I can't afford for them to accidentally or absentmindedly deny me access to other services.
  - Buge 9y ago
    With the government you have free speech rights, so you can sue them if they close your account. With private companies you have no free speech rights and they can close your account whenever they want. So account closure seems like a positive point of government-controlled login.
    - gumby 9y ago
      Look up the secrecy and lack of oversight over the so-called "terrorist" watchlist and the calls for scope creep, and see if you are so confident about those first amendment rights. I'm sure failure to log in would not be considered a first amendment right. I agree that the government should be a far more dependable provider than any private sector organization. But the recent (last 20 years) enthusiasm for scope creep has not been encouraging.
      - Buge 9y ago
        Does the government deny passports or driver licenses/IDs to people on those lists? Because that would be the equivalent here. I'm not saying the government wouldn't do it. I'm saying you would have constitutional basis to sue, which you don't have for companies. Some lawsuits against the no fly list have been successful. https://www.aclu.org/blog/national-security/victory-no-fly-list-process-ruled-unconstitutional?redirect=blog/victory-no-fly-list-process-ruled-unconstitutional https://www.aclu.org/blog/national-security/victory-no-fly-l...
- yohui 9y ago
  This thread is the digital equivalent of why every attempt so far to set up a sane ID system in the US has floundered, leaving us stuck with the worst possible solution, SSNs.
- jasikpark 9y ago
  Wouldn't it be entertaining if the SSN leak was just a really clever PR boost for the Trump administration? I'm certainly entertaining conspiracy theory level ludicrousy, but it is entertaining.
  - DaiPlusPlus 9y ago
    The EquiFax thing would only be good PR for Trump's administration if they used it as an attempt to push through legislation that would prevent these kinds of things from happening in future - like a reasoned and functional (and minimum privilege) national identification service - while Alex Jones-types would normally be up in arms I think they would support it it Trump sold it as the system additionally to make it easy to identify illegal immigrants and members of the "alt-left".
ineptech 9y ago
> Now seems like the time to set the expectation that this service may not ever be used by private websites. Wha-huh? Why? What specifically is wrong with login.gov (or any government agency) running an oauth server and private websites allowing users to authenticate with it? How does that result in "a major new point of U.S. government control over the Internet"?
- Vinnl 9y ago
  It allows them to see what you log in to and thus what services you use, much like Facebook can often do as well. (Although luckily I haven't seen that as the only option anywhere yet - that might not be the case for a system that everyone in one's target audience might be forced to use.)
  - beaconstudios 9y ago
    I'm pretty certain they can already do that though.
    - ISL 9y ago
      How?
      - beaconstudios 9y ago
        Through all the drag net surveillance the NSA performs and using tools like those unveiled by Snowden and other whistleblowers.
  - ineptech 9y ago
    > Now seems like the time to set the expectation that this service may not ever be used by private websites. Oh shit! The government knows I bought something from custom-fishing-lures.com! Ruuuuun! Seriously, what you just listed is a reason not to use the government's Oauth for every website and ban all other implementations. What OP seemed to say, and what I disputed, is the idea that this service should not ever be used by any private website even as one of several options.
deleted 9y ago
[deleted]
mizzao 9y ago
In many countries (e.g. Denmark), this is already the case. https://en.wikipedia.org/wiki/NemID https://en.wikipedia.org/wiki/NemID
- Fnoord 9y ago
  Netherlands has DigiD. Banks here are rolling out iDIN which can be used to authenticate elsewhere as well. Banks here have been using TOTP for ages for online banking, with a physical authenticator. Tho iDIN is more recent. Belgium has eID.
- denzil_correa 9y ago
  But do these countries have the same laws, processes like the USA? If not, there's no point in mentioning some other country has it. For example, in Norway you can see everyone's tax returns [0]. The caveat is that if you see someone else's tax return - the person will be notified. Now, if you just make tax returns public without the notification - it would be a different policy and not comparable to Norway. Therefore, comparisons/mentions should be complete and apt. [0] https://www.theguardian.com/money/blog/2016/apr/11/when-it-comes-to-tax-transparency-norway-leads-the-field https://www.theguardian.com/money/blog/2016/apr/11/when-it-c...
52-6F-62 9y ago
This is part of the reason why I see value in something like BlockOne ID (by Thomson-Reuters)[0]. I think it's a noble pursuit (what the US Digital Service is trying to do here[1]), making the internet easier and more accessible for people. For many people, involving themselves in the constant updates of what service is secure versus what service is not and "I have to sign up for a different email now to log in to the thing I used to log in to" is a nightmare -- and this isn't restricted to the elderly. I think it's noble, because I really think it shouldn't be arcane. To a lot of people the nuances still are, unfortunately. But a service that translates blockchain addresses into WWW accounts and back has some value, no? Couldn't it do a better job of this? I'd love to know if anybody has any more insight or thoughts. I haven't dug too deeply yet, but it keeps coming back to me. Perhaps BlockOne ID isn't the ultimate execution, but maybe one could be developed. Something that requires one sign up, and can be used as ubiquitously as you like. --- [0] https://blockoneid.thomsonreuters.com/ https://blockoneid.thomsonreuters.com/ [1] For instance, with Canadian Government services I require an account for every single service, often with different password and username requirements and age limits. I understand why, but for somebody who doesn't spend so much of their career(s) on and around and familiar with computers and how they work, it could be prohibitive.
tammer 9y ago
This is an excellent point and highlights the brutal need people of all walks have for a better authentication paradigm.
korzun 9y ago
> This appears valuable and well executed How can you tell? You are looking at a PR piece that links to a web site that mentions 'security experts' in every other sentence. It's not proven to be valuable or well executed.
zby 9y ago
With the help of all the awesome new crypto algorithms isn't it possible to create a protocol for authentication via a central server without disclosing to the central server where the login goes?
Eridrus 9y ago
It's much easier to technically enforce that this doesn't get used with private sites than tell people not to use SSNs

spencerhakim 9y ago

Given the alternative of handing out my SSN and hoping for the best, I'd be more than happy to use this for banking and related services. Presumably, third-party use would be covered by some form of ToS, and maybe we'd see actual repercussions for leaking data that originated here.

KGIII 9y ago
Repercussions? For the OPM hack, I got a form letter and a year (I think, I didn't use it) of credit monitoring. That was some of my most intimate information. That was a huge invasion of my privacy. I didn't even get a phone call. I didn't even get a sincere apology.
- ylem 9y ago
  Just as an FYI, I think they extended the period to 10 years. I agree that it was handled poorly!
  - KGIII 9y ago
    I froze my credit. I am in a position where I don't need credit and can get credit by virtue of assets if I did need to. I was, for lack of a better phrase, pretty pissed off. I got a form letter and something about credit monitoring in one of those weird security envelopes, as I recall. Ten years? Yeah, that'll help. I pretty much admitted to everything I'd ever done, on those forms. It wasn't just me impacted, it had names of my friends and family. Then, I'm guessing it had all the notes I didn't see, from things like the interviews. I don't have any real enemies, or any reason to be afraid, but that makes me no less angry and feel no less violated. Meh... I try to let the anger go, so it only pops up when I discuss it. There's nothing I can do to change it. I do consider it the greatest violation of trust ever enacted on me by the government. There was no reason for me to even be in the system any more, I am retired. [redacted] Oh well... If you can get away with it, freeze your credit. This does, curiously, impact your credit score. The peace of mind is worth it. Sorry for the novella.
gumby 9y ago
Even if you're not concerned that the government might get a list of all the sites you log into, what about arbitrary login revocation? Suddenly someone gets a brain fart and decides that everyone on the terrorist watch list shouldn't be able to use this service? Now you're locked out of all the accounts you used this for, even if you're not a "bad guy". This is why I don't use "log in with google" or log in with Facebook" -- I don't think those companies are evil (I use them both) but I can't afford for them to accidentally or absentmindedly deny me access to other services.
- Buge 9y ago
  With the government you have free speech rights, so you can sue them if they close your account. With private companies you have no free speech rights and they can close your account whenever they want. So account closure seems like a positive point of government-controlled login.
  - gumby 9y ago
    Look up the secrecy and lack of oversight over the so-called "terrorist" watchlist and the calls for scope creep, and see if you are so confident about those first amendment rights. I'm sure failure to log in would not be considered a first amendment right. I agree that the government should be a far more dependable provider than any private sector organization. But the recent (last 20 years) enthusiasm for scope creep has not been encouraging.
    - Buge 9y ago
      Does the government deny passports or driver licenses/IDs to people on those lists? Because that would be the equivalent here. I'm not saying the government wouldn't do it. I'm saying you would have constitutional basis to sue, which you don't have for companies. Some lawsuits against the no fly list have been successful. https://www.aclu.org/blog/national-security/victory-no-fly-list-process-ruled-unconstitutional?redirect=blog/victory-no-fly-list-process-ruled-unconstitutional https://www.aclu.org/blog/national-security/victory-no-fly-l...
yohui 9y ago
This thread is the digital equivalent of why every attempt so far to set up a sane ID system in the US has floundered, leaving us stuck with the worst possible solution, SSNs.
jasikpark 9y ago
Wouldn't it be entertaining if the SSN leak was just a really clever PR boost for the Trump administration? I'm certainly entertaining conspiracy theory level ludicrousy, but it is entertaining.
- DaiPlusPlus 9y ago
  The EquiFax thing would only be good PR for Trump's administration if they used it as an attempt to push through legislation that would prevent these kinds of things from happening in future - like a reasoned and functional (and minimum privilege) national identification service - while Alex Jones-types would normally be up in arms I think they would support it it Trump sold it as the system additionally to make it easy to identify illegal immigrants and members of the "alt-left".

ineptech 9y ago

> Now seems like the time to set the expectation that this service may not ever be used by private websites. Wha-huh? Why? What specifically is wrong with login.gov (or any government agency) running an oauth server and private websites allowing users to authenticate with it? How does that result in "a major new point of U.S. government control over the Internet"?

Vinnl 9y ago
It allows them to see what you log in to and thus what services you use, much like Facebook can often do as well. (Although luckily I haven't seen that as the only option anywhere yet - that might not be the case for a system that everyone in one's target audience might be forced to use.)
- beaconstudios 9y ago
  I'm pretty certain they can already do that though.
  - ISL 9y ago
    How?
    - beaconstudios 9y ago
      Through all the drag net surveillance the NSA performs and using tools like those unveiled by Snowden and other whistleblowers.
- ineptech 9y ago
  > Now seems like the time to set the expectation that this service may not ever be used by private websites. Oh shit! The government knows I bought something from custom-fishing-lures.com! Ruuuuun! Seriously, what you just listed is a reason not to use the government's Oauth for every website and ban all other implementations. What OP seemed to say, and what I disputed, is the idea that this service should not ever be used by any private website even as one of several options.

deleted 9y ago

[deleted]

mizzao 9y ago

In many countries (e.g. Denmark), this is already the case. https://en.wikipedia.org/wiki/NemID https://en.wikipedia.org/wiki/NemID

Fnoord 9y ago
Netherlands has DigiD. Banks here are rolling out iDIN which can be used to authenticate elsewhere as well. Banks here have been using TOTP for ages for online banking, with a physical authenticator. Tho iDIN is more recent. Belgium has eID.
denzil_correa 9y ago
But do these countries have the same laws, processes like the USA? If not, there's no point in mentioning some other country has it. For example, in Norway you can see everyone's tax returns [0]. The caveat is that if you see someone else's tax return - the person will be notified. Now, if you just make tax returns public without the notification - it would be a different policy and not comparable to Norway. Therefore, comparisons/mentions should be complete and apt. [0] https://www.theguardian.com/money/blog/2016/apr/11/when-it-comes-to-tax-transparency-norway-leads-the-field https://www.theguardian.com/money/blog/2016/apr/11/when-it-c...

52-6F-62 9y ago

This is part of the reason why I see value in something like BlockOne ID (by Thomson-Reuters)[0]. I think it's a noble pursuit (what the US Digital Service is trying to do here[1]), making the internet easier and more accessible for people. For many people, involving themselves in the constant updates of what service is secure versus what service is not and "I have to sign up for a different email now to log in to the thing I used to log in to" is a nightmare -- and this isn't restricted to the elderly. I think it's noble, because I really think it shouldn't be arcane. To a lot of people the nuances still are, unfortunately. But a service that translates blockchain addresses into WWW accounts and back has some value, no? Couldn't it do a better job of this? I'd love to know if anybody has any more insight or thoughts. I haven't dug too deeply yet, but it keeps coming back to me. Perhaps BlockOne ID isn't the ultimate execution, but maybe one could be developed. Something that requires one sign up, and can be used as ubiquitously as you like. --- [0] https://blockoneid.thomsonreuters.com/ https://blockoneid.thomsonreuters.com/ [1] For instance, with Canadian Government services I require an account for every single service, often with different password and username requirements and age limits. I understand why, but for somebody who doesn't spend so much of their career(s) on and around and familiar with computers and how they work, it could be prohibitive.

tammer 9y ago

This is an excellent point and highlights the brutal need people of all walks have for a better authentication paradigm.

korzun 9y ago

> This appears valuable and well executed How can you tell? You are looking at a PR piece that links to a web site that mentions 'security experts' in every other sentence. It's not proven to be valuable or well executed.

zby 9y ago

With the help of all the awesome new crypto algorithms isn't it possible to create a protocol for authentication via a central server without disclosing to the central server where the login goes?

Eridrus 9y ago

It's much easier to technically enforce that this doesn't get used with private sites than tell people not to use SSNs