4 ms·
Why it's a privacy nightmare: you delegate authentication to an oauth service. You trust it to check the authenticity of the login/password. The code is open s
by weddpros 9y ago
Why it's a privacy nightmare: you delegate authentication to an oauth service. You trust it to check the authenticity of the login/password.
The code is open source, but it doesn't mean login.gov runs exactly this code.
Now imagine the NSA forks the code, adds a master password "IworkForTheNSA,LetMeIn!" and runs the fork instead on login.gov. Now the government can impersonate you in seconds.
Use Auth0 if you don't want to handle auth yourself. It's probably more difficult to coerce a private company into hacking its users, than it is for the NSA/FBI/IRS/Whatever to hack it's own system.
Don't be foolish. Don't use that for private businesses.
- finnn 9y agoIs it even possible to use this for a private business? The title literally says that it is "to simplify access to public services"
- weddpros 9y agoI sure hope it will be restricted to public services... I was reacting to other comments on HN
- devrand 9y agoAccording to the developer registration instructions (https://developers.login.gov/register/ https://developers.login.gov/register/) you need to provide what government agency you are registering for. Therefore I don't believe this is open to non-government agencies.
- bobthecowboy 9y ago> It's probably more difficult to coerce a private company into hacking its users, than it is for the NSA/FBI/IRS/Whatever to hack it's own system. This is a fantasy. I'm shocked to find people parroting this argument mere years after Snowden.
- weddpros 9y agoDon't you think it's easier for the government to hack its own code than someone else's ?
- zbentley 9y agoMaybe, but where "hacking someone else's" might just be issuing a search warrant, the difference in difficulties is like the difference between swatting a mosquito and swatting a gnat.
- joshuamorton 9y agoWait, but this is for accessing data that the government already has about you. So while sure they could impersonate you, the NSA/FBI/whomever could also just access the government database that stores the information. The only way to fix this is with something like per-user encryption of data, in which case a master password wouldn't help, although I'm not quite sure how you'd implement oauth and have an encryption password. Maybe the oauth system uses your password to decrypt a personal encryption key, and that is then sent to the client services. That way a master password doesn't get access.