12 ms·

Single sign-on: What we learned during our identity alpha

145 points by open-source-ux 5y ago

jiveturkey 5y ago
Interesting. This is more about capital-I Identity than about SSO.
tialaramex 5y ago
Reading documents like passports with an NFC reader does indeed work, and does indeed produce verifiable material. Specifically the passport has proof (via a digital signature) that it was issued by a specific authority, and in turn, proof that the contents of the passport (name, date of birth, a picture and so on) are as issued. But, the problem here is that the issuer is the British government, so, what are you proving? "Here, you issued this passport". "Oh yes, so we did". I presume the British government does own a database of the passports they issued, so this isn't news to them. A modestly smart device, such as a Yubico device, is capable of providing fresh proof of its identity. My Security Key doesn't prove "The security key that enrolled me with GitHub in fact exists" which is redundant - but "I am still the same security key that you enrolled". However the passport can't do that, your passport is inert, and the fact that Sarah Smith existed isn't the thing you presumably want to prove to a single-sign-on service. You want to prove that you are Sarah Smith, something the passport doesn't really do. I think the GDS ignores this problem, which is to be fair no worse than lots of other systems, but the result isn't actually what it seems to be, all the digital technology isn't actually proving anybody's identity in this space. It reminds me of the bad old days of the Web PKI where it was found that the "email validation" being used would accept automated "virus checking" of email. A CA sends the "Are you sure you want to issue a cert for mycorp.example?" message to somebody@mycorp.example and even though Somebody is on vacation in Barbados for two weeks, the automatic "virus" check reads the URL out of the email, follows it, ignores the page saying "Success, your certificate has been issued" and passes it to Somebody's inbox... All the "security" is doing what it was designed to do, but, what it was designed to do isn't what it should have been designed to do, and so it's futile.
- jimvdv 5y ago
  The way it works in my country is: you install an app that uses your passports NFC chip to verify your identity. Then gov web services or verified third parties (like private insurance) can use what looks like (I did not dig in the details) a fairly standard OAuth flow.
- advisedwang 5y ago
  Scanning the passport: 1. Verifies that you have the passport 2. Provides biometric info Of course neither of these are a 100% guarantee of identity. (1) doesn't account for stolen or lost documents. (2) is only useful if the app doing verification is tamperproof and the camera isn't fooled by holding up a photo of you etc. However _nothing_ is a 100% guarantee. These steps, plus any other verification that's going on, can make it very hard to fake ID, which is all we are really able to hope for with these systems.
  - tialaramex 5y ago
    > 1. Verifies that you have the passport Because the data is static, it doesn't do that. It only verifies that you know the static passport data. This was a key problem with the old magnetic stripe credit cards. You could easily clone the stripe. I don't see any substantial obstacle to cloning an NFC passport chip. 2. Provides biometric info Sure, that is useful, but, this is a government application. The government does have this biometric info, that's why it's baked inside the passports. So this isn't something the passport is enabling for the government.
    - JonathonW 5y ago
      The biometric passport spec has support for what it calls active authentication-- this is your fairly standard challenge/response-type thing using a private key contained in the chip that can't be read or copied. The caveat is that it's optional-- not all passports support it, and thus there are possible (depending on the reader software) downgrade attacks where a passport with active authentication could be cloned anyways if you can convince the reader not to perform the authentication step. And there are bad hardware implementations out there that don't adequately protect the private key material (leaving them susceptible to cloning anyways).
asperous 5y ago
The us government is rolling this out as well: https://login.gov https://login.gov
- toomuchtodo 5y ago
  Not only are they rolling it out, it is the primary identity provider for the Social Security Administration (as of a few weeks ago), CBP’s Global Entry, USAjobs, and about 200 other federal sites (mostly internal agency sites and apps, including USDS’ Slack team). They also support state and third parties in certain cases. They are an incredible product of the USDS, 18F, and GSA and it’s awesome watching them slowly but surely make digital identity with the US government better.
  - systemvoltage 5y ago
    Shout out to 18F and GSA Digital services people. They're doing god's work where most government agencies are dysfunctional and completely incompetent.
    - deleted 5y ago
      [deleted]
    - stuaxo 5y ago
      There's an article on here comparing 18F and GDS approach https://gds.blog.gov.uk/2015/07/29/same-but-different-a-common-international-approach-to-digital-government/ https://gds.blog.gov.uk/2015/07/29/same-but-different-a-comm...
  - jfrunyon 5y ago
    If only the IRS used them instead of contracting out to a for-profit third-party... who will make you go through 30 minutes of verification only to tell you they can't verify you, and then take 3 months to reply to your email.
    - toomuchtodo 5y ago
greenail 5y ago
Wait till it gets ransomwared and then you'll see something... I sure hope they have a plan B.
goodmachine 5y ago
>To be honest we didn’t get this right with GOV.UK Verify. We have an opportunity and obligation to do much better this time. Something of an understatement. The project was red-flagged as'undeliverable' in 2019, after spending £154m https://www.theregister.com/2019/07/18/verify_to_be_flagged_undeliverable_by_gov_projects_watchdog/ https://www.theregister.com/2019/07/18/verify_to_be_flagged_... By 2020, and now at £200m sunk: https://www.computerweekly.com/blog/Computer-Weekly-Editors-Blog/Even-GDS-is-telling-GDS-to-shut-down-Verify https://www.computerweekly.com/blog/Computer-Weekly-Editors-... So now in 2021, we're back to informal tests and Post-It notes again?
- EGreg 5y ago
  Um ridiculous government waste! We could have done it all in $300K and so could have many other startups
  - stuaxo 5y ago
    I don't know what they were covering, but there is a multitude of different systems from local councils up to central Gov. GDS is full of mostly django based systems, some legacy ruby and that's just the stuff from the last few years. Going back further there are various C# systems, the amount of separate systems is staggering, it's not too surprising costs add up.
    - deleted 5y ago
      [deleted]
    - rjzzleep 5y ago
      The problem in these environments is often not technical, but human, full of egos, people without competence wanting to be involved in every discussion and generally people talking and evaluating systems based on specs for a year without actually testing things. For every one of the systems you mentioned there is a fairly straightforward solution. And even if you can't solve them all you could gradually migrate everything. Oftentimes because of management wanting to push liability to a private party, they don't want to invest into local dev teams, but instead want to buy a big enterprise solution. The VA, NHS and the German systems all have these issues, but it's not because they're public institutions, it's because they work like enterprise.
lifeisstillgood 5y ago
Can anyone point to background reading on hanging all this stuff together (in a corporate context, so avoiding a lot of inclusion issues) things like FIDO/ubi key as the basis for all authentication / identification Once we do that how do we manage SSO - I dislike the idea of having a nice hardware module and then saying "great for the next x hours / days use this static string. All attempts to make that better (timers, usage countdown timers) just seem less good than client certificatest and certificates in HSMs (simply, I am trying to design a ... company I guess )
- jfrunyon 5y ago
  > just seem less good than client certificatest and certificates in HSMs That's effectively what FIDO/U2F are.
  - tialaramex 5y ago
    Most importantly FIDO isn't identity. It's deliberately only authentication. Facebook and GitHub both have records that allow them to authenticate that I'm still me, using FIDO Security Keys, but if they compare records they intentionally do not learn that they're authenticating the same person, even though that is in fact what they're doing. The place you'd logically put an "identifier" (and in fact it's even called ID) in protocols like WebAuthn is chosen effectively at random for each enrolment. On your phone the ID is actually just a bunch of random bits, on a cheap Security Key it's much more complicated but the effect for relying parties is that it's random.
    - jfrunyon 5y ago
      While that's true, I would argue that makes it more good than certs on an HSM, not less good as the person I replied to posited.
- toomuchtodo 5y ago
  Two great places to start are "Beyond Corp"/zero trust and "WebAuthN". BeyondCorp is the name brand of a zero trust model, where the perimeter security model is broken down for authorization ("authz") and authentication ("authn") everywhere. WebAuthN is using PKI infrastructure with a purposeful UX to migrate away from passwords for authentication. The implementation and management of SSO is a complex topic with a lot of nuance beyond a single HN comment, so I'd recommend you speak to someone with some IAM (identity and access management) subject matter expertise to scope your use case and provide recommendations for possible solutions. https://www.beyondcorp.com/ https://www.beyondcorp.com/ https://github.com/pomerium/awesome-zero-trust/ https://github.com/pomerium/awesome-zero-trust/ https://webauthn.guide/ https://webauthn.guide/ https://fidoalliance.org/fido2/fido2-web-authentication-webauthn/ https://fidoalliance.org/fido2/fido2-web-authentication-weba... (digital identity and IAM is a component of my work)
NomDePlum 5y ago
That is a very scary post. For all Verify had/has real issues (mostly politically mandated pressure to use + key usability and accessibility issues) at least it had some people who understood key elements of the identity landscape. That article appears to draw no distinction between the proving of the existence and of the ownership of an identity. If anything the examples conflate them which is a critical failure. Identity is a really hard government problem, mostly because it is a government issue/need really not an individual's and government are insanely bad at addressing it.
pippy 5y ago
The NZ govt did a good job with their version: realme.govt.nz While proving your identity was easy, they've had trouble achieving the next step of information sharing. Traditionally government departments under law were not able to share information. This has only recently changed and they're struggling to reach the next step.
- earleybird 5y ago
  Legislated prohibitions on sharing information are sometimes there for good reason. A good government has checks, balances and circuit breakers. Aggregating data provides a very powerful tool. Architecting solutions with this in mind means I (and others of my ilk) have open discussions with the businesses (inside government) we support regarding what are the necessary and sufficient information and identity requirements in an application or business process. There are cases where it is sufficient to only know that "this is the same actor we were interacting with before and they have x, y and z attributes germane to this interaction"
- beachy 5y ago
  Realme also suffers from typical government thinking though. We wanted to add it to our platform as an authentication mechanism. That would be good for individuals, and good for realme, as it would increase adoption. However this is not allowed because ... Realme is paid for from taxes, so noone in the private sector can use it unless they pay. This makes some sense, but also obviously it makes no sense for a web site to pay e.g Google for "sign in with Google". Google is obviously more than happy to underwrite the costs, since it means greater adoption of their identities and more power to their platform. As a result realme is stuck in a public sector prison. It's a shame as some of it has been well executed.
  - toomuchtodo 5y ago
    Cost recovery of a public service is reasonable, even if the base level of service is contributed to with tax revenue. What was the cost quoted versus private/corporate identity providers?
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
nhoughto 5y ago
suuch a hard problem, esp for government that has to include 'everyone' and all the weird edgecases that forces on you. Couple that with proof of identity being one of the few things that might have been issued 40, 50.. 60+ years ago (birth certificates) and never updated (unlike passports..) and when issued had no concept or sympathy that it might be used for digital verification in the future. Without redefining the problem to avoid issues like birth certificates, i'm not sure this is solvable in the way stakeholders expect it to be. Stakeholders (like citizens paying for it) expect to be able to point technology at the problem and have it solved, 'its just an app right?' or 'lets use biometrics!' but so many other things have to adapt to make something like this successful. Estonia had an interesting approach where they just issued everyone smartcards/certificates and used that as proof, this bypasses the 'birth certificate' problem but is expensive (Estonia has smallish population, newish government so ok) but such an approach itself has a root of trust problem.. who do I issue the smartcards to? It isn't directly transferable to other countries/governments. You work around the root of trust problem by creating exceptions and alternate paths to verification, maybe do it in-person for people with disabilities etc. But then how long does that take to roll-out? How easily abused is such a system? How many of the identity moment can I use it for? Is in-person verification trusted less? It is very easy for the resulting system to be quite brittle too and not reflect real use-cases, real world identity moments are very diverse and often have more flex than you'd think and it is very difficult to carve out the right chunk of the identity problem to solve and which to leave behind and still create something that improves the ecosystem. learnt through pain, built digitalid.com
- Muromec 5y ago
  Oh, birth certificates. If you need to support birth certificates in your system -- you need to support each and every format of birth certificate issued in the last 100 years in every part of the world, not just ones issued in $countryname. It's like "falsehood programmers believe about Names" combined with one about dates and all others too. Because sometimes including name of lunar month is more important than assigning a number to the document.
sofixa 5y ago
> Millions of people in the UK don’t have a passport or driving licence and there’s no magic document that lets everyone prove their identity. That's why most(all?) EU countries have ID cards which are (usually? sometimes? probably depends on the country) mandatory. Especially the new EU standard version, which will of course take time to be deployed everywhere, is pretty great with a chip containing the biometric and other data allowing for automatic verification ( via an app or device at certain places, like airports).
- tikkabhuna 5y ago
  I’m a bit young to comment on this, but we did have identity cards for a while. https://en.wikipedia.org/wiki/Identity_Cards_Act_2006 https://en.wikipedia.org/wiki/Identity_Cards_Act_2006
- tyyuppfg 5y ago
  In the UK identity cards are considered an intrusion on freedoms. Boris Johnson once wrote this which I think sums up that sentiment: "If I am ever asked on the streets of London, or in any other venue, public or private, to produce my ID card as evidence that I am who I say I am ... then I will take that card out of my wallet and physically eat it in the presence of whatever emanation of the state has demanded I produce it."
  - sofixa 5y ago
    If people actually listened to what that empty vain populist said, the UK would be in big trouble. Imagine anyone lets him into any position of power! He'd just lie and change his public opinion on things daily. /s How this man is anywhere near Downing Street is a complete mistery to me.
- Angostura 5y ago
  In the U.K. there is substantial sentiment against mandatory ID
  - tonyedgecombe 5y ago
trhoad 5y ago
The UK must be one of the few countries left where you have to show (often paper) bank statements and utility bills to prove who you are (or simply that you live where you say you live), and in the process revealing all kinds of personal information that is none of the recipient's business - including Government. This could all be solved with a national ID card (and would save the public purse £millions, as shown by the Verify programme). The complexity isn't in the actual technology (which exists, and has done for a long time), but the sheer number of possible identity documents that need to be accounted for and the mechanisms for collecting that documentation for verification. But Brits are too stubborn to accept it. These are the same swathes of people that share stuff on Facebook, install Ring doorbells, and throw bank statements in the bin un-shredded.
- davuinci 5y ago
  Why is UK one of the few countries left to require such documents? I have been asked for those documents in several EU countries to prove residency.
  - p_l 5y ago
    Most of the time if you're proving residency with such documents you're not a permanent resident and your ID is for foreign country under freedom of movement. There's a huge difference for example between identity/residency checks in Poland for people who are in PESEL database and people who aren't - and if you're in PESEL, you're going to have polish ID card as well.
- billpg 5y ago
  "We need you to prove your identity." "Here's something indistinguishable from something I could have knocked together using Microsoft Word an hour ago."
- ChrisKnott 5y ago
  I don't believe it was the same people. It was derailed by, essentially, "HN types" i.e. people who think they need to defend themselves from government surveillance. Without that campaign (NO2ID) screaming that it was Big Brother it would have been introduced without fanfare, because as you say Brits are generally pretty dismissive of their own privacy and trusting of the state, compared to many other countries.
heurisko 5y ago
The GDS have now become what they were setup to avoid. That is, they were supposed to be an agile startup to avoid massive overspend on untenable projects like NHS digital [1]. What I've noticed is that "new style" government projects like the GDS seem to be suffering from using too many "innovation tokens" [2], probably due to the much cited lack of leadership. It's not nice to be in a situation where you are stuck on a legacy Java 7 platform, and nothing else, but equally, it's not nice to be in a situation where you are trying to support and context-switch between too many stacks. One is too conservative, the other is chaos. If there's no leadership, there's no-one to make decisions to limit proliferation of new technology. This might be unpopular for some developers looking to improve their CVs, but necessary for the organisation as a whole. [1] https://www.bbc.co.uk/news/uk-politics-28464002 https://www.bbc.co.uk/news/uk-politics-28464002 [2] https://mcfunley.com/choose-boring-technology https://mcfunley.com/choose-boring-technology
- trhoad 5y ago
  > support and context-switch between too many stacks I don't believe this is the case at GDS, and wasn't the cause of the failure of the Gov.UK Verify project.
  - heurisko 5y ago
    I don't think it was the cause of failure for the Verify project. But I do think it is the case at the GDS, as evidenced by the comment on this page: > GDS is full of mostly django based systems, some legacy ruby and that's just the stuff from the last few years. Going back further there are various C# systems, the amount of separate systems is staggering, it's not too surprising costs add up And this blog post: > ...quickly agreed that rather than try to settle on a single one of those we'd build each tool using whichever technology would most quickly get us to a relatively-durable prototype, and then "federate" them. We started with the python-based framework Django for the Department pages, added Ruby on Rails for a suite of tools focussed on specific tasks, and used Sinatra (another ruby framework) to glue together our search. https://gds.blog.gov.uk/2011/05/12/a-brief-overview-of-technology-behind-alpha-gov-uk/ https://gds.blog.gov.uk/2011/05/12/a-brief-overview-of-techn...
deleted 5y ago
[deleted]

Interesting. This is more about capital-I Identity than about SSO.

Reading documents like passports with an NFC reader does indeed work, and does indeed produce verifiable material. Specifically the passport has proof (via a digital signature) that it was issued by a specific authority, and in turn, proof that the contents of the passport (name, date of birth, a picture and so on) are as issued. But, the problem here is that the issuer is the British government, so, what are you proving? "Here, you issued this passport". "Oh yes, so we did". I presume the British government does own a database of the passports they issued, so this isn't news to them. A modestly smart device, such as a Yubico device, is capable of providing fresh proof of its identity. My Security Key doesn't prove "The security key that enrolled me with GitHub in fact exists" which is redundant - but "I am still the same security key that you enrolled". However the passport can't do that, your passport is inert, and the fact that Sarah Smith existed isn't the thing you presumably want to prove to a single-sign-on service. You want to prove that you are Sarah Smith, something the passport doesn't really do. I think the GDS ignores this problem, which is to be fair no worse than lots of other systems, but the result isn't actually what it seems to be, all the digital technology isn't actually proving anybody's identity in this space. It reminds me of the bad old days of the Web PKI where it was found that the "email validation" being used would accept automated "virus checking" of email. A CA sends the "Are you sure you want to issue a cert for mycorp.example?" message to somebody@mycorp.example and even though Somebody is on vacation in Barbados for two weeks, the automatic "virus" check reads the URL out of the email, follows it, ignores the page saying "Success, your certificate has been issued" and passes it to Somebody's inbox... All the "security" is doing what it was designed to do, but, what it was designed to do isn't what it should have been designed to do, and so it's futile.

jimvdv 5y ago
The way it works in my country is: you install an app that uses your passports NFC chip to verify your identity. Then gov web services or verified third parties (like private insurance) can use what looks like (I did not dig in the details) a fairly standard OAuth flow.
advisedwang 5y ago
Scanning the passport: 1. Verifies that you have the passport 2. Provides biometric info Of course neither of these are a 100% guarantee of identity. (1) doesn't account for stolen or lost documents. (2) is only useful if the app doing verification is tamperproof and the camera isn't fooled by holding up a photo of you etc. However _nothing_ is a 100% guarantee. These steps, plus any other verification that's going on, can make it very hard to fake ID, which is all we are really able to hope for with these systems.
- tialaramex 5y ago
  > 1. Verifies that you have the passport Because the data is static, it doesn't do that. It only verifies that you know the static passport data. This was a key problem with the old magnetic stripe credit cards. You could easily clone the stripe. I don't see any substantial obstacle to cloning an NFC passport chip. 2. Provides biometric info Sure, that is useful, but, this is a government application. The government does have this biometric info, that's why it's baked inside the passports. So this isn't something the passport is enabling for the government.
  - JonathonW 5y ago
    The biometric passport spec has support for what it calls active authentication-- this is your fairly standard challenge/response-type thing using a private key contained in the chip that can't be read or copied. The caveat is that it's optional-- not all passports support it, and thus there are possible (depending on the reader software) downgrade attacks where a passport with active authentication could be cloned anyways if you can convince the reader not to perform the authentication step. And there are bad hardware implementations out there that don't adequately protect the private key material (leaving them susceptible to cloning anyways).

asperous 5y ago

The us government is rolling this out as well: https://login.gov https://login.gov

toomuchtodo 5y ago
Not only are they rolling it out, it is the primary identity provider for the Social Security Administration (as of a few weeks ago), CBP’s Global Entry, USAjobs, and about 200 other federal sites (mostly internal agency sites and apps, including USDS’ Slack team). They also support state and third parties in certain cases. They are an incredible product of the USDS, 18F, and GSA and it’s awesome watching them slowly but surely make digital identity with the US government better.
- systemvoltage 5y ago
  Shout out to 18F and GSA Digital services people. They're doing god's work where most government agencies are dysfunctional and completely incompetent.
  - deleted 5y ago
    [deleted]
  - stuaxo 5y ago
    There's an article on here comparing 18F and GDS approach https://gds.blog.gov.uk/2015/07/29/same-but-different-a-common-international-approach-to-digital-government/ https://gds.blog.gov.uk/2015/07/29/same-but-different-a-comm...
- jfrunyon 5y ago
  If only the IRS used them instead of contracting out to a for-profit third-party... who will make you go through 30 minutes of verification only to tell you they can't verify you, and then take 3 months to reply to your email.
  - toomuchtodo 5y ago

greenail 5y ago

Wait till it gets ransomwared and then you'll see something... I sure hope they have a plan B.

goodmachine 5y ago

>To be honest we didn’t get this right with GOV.UK Verify. We have an opportunity and obligation to do much better this time. Something of an understatement. The project was red-flagged as'undeliverable' in 2019, after spending £154m https://www.theregister.com/2019/07/18/verify_to_be_flagged_undeliverable_by_gov_projects_watchdog/ https://www.theregister.com/2019/07/18/verify_to_be_flagged_... By 2020, and now at £200m sunk: https://www.computerweekly.com/blog/Computer-Weekly-Editors-Blog/Even-GDS-is-telling-GDS-to-shut-down-Verify https://www.computerweekly.com/blog/Computer-Weekly-Editors-... So now in 2021, we're back to informal tests and Post-It notes again?

EGreg 5y ago
Um ridiculous government waste! We could have done it all in $300K and so could have many other startups
- stuaxo 5y ago
  I don't know what they were covering, but there is a multitude of different systems from local councils up to central Gov. GDS is full of mostly django based systems, some legacy ruby and that's just the stuff from the last few years. Going back further there are various C# systems, the amount of separate systems is staggering, it's not too surprising costs add up.
  - deleted 5y ago
    [deleted]
  - rjzzleep 5y ago
    The problem in these environments is often not technical, but human, full of egos, people without competence wanting to be involved in every discussion and generally people talking and evaluating systems based on specs for a year without actually testing things. For every one of the systems you mentioned there is a fairly straightforward solution. And even if you can't solve them all you could gradually migrate everything. Oftentimes because of management wanting to push liability to a private party, they don't want to invest into local dev teams, but instead want to buy a big enterprise solution. The VA, NHS and the German systems all have these issues, but it's not because they're public institutions, it's because they work like enterprise.

lifeisstillgood 5y ago

Can anyone point to background reading on hanging all this stuff together (in a corporate context, so avoiding a lot of inclusion issues) things like FIDO/ubi key as the basis for all authentication / identification Once we do that how do we manage SSO - I dislike the idea of having a nice hardware module and then saying "great for the next x hours / days use this static string. All attempts to make that better (timers, usage countdown timers) just seem less good than client certificatest and certificates in HSMs (simply, I am trying to design a ... company I guess )

jfrunyon 5y ago
> just seem less good than client certificatest and certificates in HSMs That's effectively what FIDO/U2F are.
- tialaramex 5y ago
  Most importantly FIDO isn't identity. It's deliberately only authentication. Facebook and GitHub both have records that allow them to authenticate that I'm still me, using FIDO Security Keys, but if they compare records they intentionally do not learn that they're authenticating the same person, even though that is in fact what they're doing. The place you'd logically put an "identifier" (and in fact it's even called ID) in protocols like WebAuthn is chosen effectively at random for each enrolment. On your phone the ID is actually just a bunch of random bits, on a cheap Security Key it's much more complicated but the effect for relying parties is that it's random.
  - jfrunyon 5y ago
    While that's true, I would argue that makes it more good than certs on an HSM, not less good as the person I replied to posited.
toomuchtodo 5y ago
Two great places to start are "Beyond Corp"/zero trust and "WebAuthN". BeyondCorp is the name brand of a zero trust model, where the perimeter security model is broken down for authorization ("authz") and authentication ("authn") everywhere. WebAuthN is using PKI infrastructure with a purposeful UX to migrate away from passwords for authentication. The implementation and management of SSO is a complex topic with a lot of nuance beyond a single HN comment, so I'd recommend you speak to someone with some IAM (identity and access management) subject matter expertise to scope your use case and provide recommendations for possible solutions. https://www.beyondcorp.com/ https://www.beyondcorp.com/ https://github.com/pomerium/awesome-zero-trust/ https://github.com/pomerium/awesome-zero-trust/ https://webauthn.guide/ https://webauthn.guide/ https://fidoalliance.org/fido2/fido2-web-authentication-webauthn/ https://fidoalliance.org/fido2/fido2-web-authentication-weba... (digital identity and IAM is a component of my work)

NomDePlum 5y ago

That is a very scary post. For all Verify had/has real issues (mostly politically mandated pressure to use + key usability and accessibility issues) at least it had some people who understood key elements of the identity landscape. That article appears to draw no distinction between the proving of the existence and of the ownership of an identity. If anything the examples conflate them which is a critical failure. Identity is a really hard government problem, mostly because it is a government issue/need really not an individual's and government are insanely bad at addressing it.

pippy 5y ago

The NZ govt did a good job with their version: realme.govt.nz While proving your identity was easy, they've had trouble achieving the next step of information sharing. Traditionally government departments under law were not able to share information. This has only recently changed and they're struggling to reach the next step.

earleybird 5y ago
Legislated prohibitions on sharing information are sometimes there for good reason. A good government has checks, balances and circuit breakers. Aggregating data provides a very powerful tool. Architecting solutions with this in mind means I (and others of my ilk) have open discussions with the businesses (inside government) we support regarding what are the necessary and sufficient information and identity requirements in an application or business process. There are cases where it is sufficient to only know that "this is the same actor we were interacting with before and they have x, y and z attributes germane to this interaction"
beachy 5y ago
Realme also suffers from typical government thinking though. We wanted to add it to our platform as an authentication mechanism. That would be good for individuals, and good for realme, as it would increase adoption. However this is not allowed because ... Realme is paid for from taxes, so noone in the private sector can use it unless they pay. This makes some sense, but also obviously it makes no sense for a web site to pay e.g Google for "sign in with Google". Google is obviously more than happy to underwrite the costs, since it means greater adoption of their identities and more power to their platform. As a result realme is stuck in a public sector prison. It's a shame as some of it has been well executed.
- toomuchtodo 5y ago
  Cost recovery of a public service is reasonable, even if the base level of service is contributed to with tax revenue. What was the cost quoted versus private/corporate identity providers?

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

nhoughto 5y ago

suuch a hard problem, esp for government that has to include 'everyone' and all the weird edgecases that forces on you. Couple that with proof of identity being one of the few things that might have been issued 40, 50.. 60+ years ago (birth certificates) and never updated (unlike passports..) and when issued had no concept or sympathy that it might be used for digital verification in the future. Without redefining the problem to avoid issues like birth certificates, i'm not sure this is solvable in the way stakeholders expect it to be. Stakeholders (like citizens paying for it) expect to be able to point technology at the problem and have it solved, 'its just an app right?' or 'lets use biometrics!' but so many other things have to adapt to make something like this successful. Estonia had an interesting approach where they just issued everyone smartcards/certificates and used that as proof, this bypasses the 'birth certificate' problem but is expensive (Estonia has smallish population, newish government so ok) but such an approach itself has a root of trust problem.. who do I issue the smartcards to? It isn't directly transferable to other countries/governments. You work around the root of trust problem by creating exceptions and alternate paths to verification, maybe do it in-person for people with disabilities etc. But then how long does that take to roll-out? How easily abused is such a system? How many of the identity moment can I use it for? Is in-person verification trusted less? It is very easy for the resulting system to be quite brittle too and not reflect real use-cases, real world identity moments are very diverse and often have more flex than you'd think and it is very difficult to carve out the right chunk of the identity problem to solve and which to leave behind and still create something that improves the ecosystem. learnt through pain, built digitalid.com

Muromec 5y ago
Oh, birth certificates. If you need to support birth certificates in your system -- you need to support each and every format of birth certificate issued in the last 100 years in every part of the world, not just ones issued in $countryname. It's like "falsehood programmers believe about Names" combined with one about dates and all others too. Because sometimes including name of lunar month is more important than assigning a number to the document.

sofixa 5y ago

> Millions of people in the UK don’t have a passport or driving licence and there’s no magic document that lets everyone prove their identity. That's why most(all?) EU countries have ID cards which are (usually? sometimes? probably depends on the country) mandatory. Especially the new EU standard version, which will of course take time to be deployed everywhere, is pretty great with a chip containing the biometric and other data allowing for automatic verification ( via an app or device at certain places, like airports).

tikkabhuna 5y ago
I’m a bit young to comment on this, but we did have identity cards for a while. https://en.wikipedia.org/wiki/Identity_Cards_Act_2006 https://en.wikipedia.org/wiki/Identity_Cards_Act_2006
tyyuppfg 5y ago
In the UK identity cards are considered an intrusion on freedoms. Boris Johnson once wrote this which I think sums up that sentiment: "If I am ever asked on the streets of London, or in any other venue, public or private, to produce my ID card as evidence that I am who I say I am ... then I will take that card out of my wallet and physically eat it in the presence of whatever emanation of the state has demanded I produce it."
- sofixa 5y ago
  If people actually listened to what that empty vain populist said, the UK would be in big trouble. Imagine anyone lets him into any position of power! He'd just lie and change his public opinion on things daily. /s How this man is anywhere near Downing Street is a complete mistery to me.
Angostura 5y ago
In the U.K. there is substantial sentiment against mandatory ID
- tonyedgecombe 5y ago

trhoad 5y ago

The UK must be one of the few countries left where you have to show (often paper) bank statements and utility bills to prove who you are (or simply that you live where you say you live), and in the process revealing all kinds of personal information that is none of the recipient's business - including Government. This could all be solved with a national ID card (and would save the public purse £millions, as shown by the Verify programme). The complexity isn't in the actual technology (which exists, and has done for a long time), but the sheer number of possible identity documents that need to be accounted for and the mechanisms for collecting that documentation for verification. But Brits are too stubborn to accept it. These are the same swathes of people that share stuff on Facebook, install Ring doorbells, and throw bank statements in the bin un-shredded.

davuinci 5y ago
Why is UK one of the few countries left to require such documents? I have been asked for those documents in several EU countries to prove residency.
- p_l 5y ago
  Most of the time if you're proving residency with such documents you're not a permanent resident and your ID is for foreign country under freedom of movement. There's a huge difference for example between identity/residency checks in Poland for people who are in PESEL database and people who aren't - and if you're in PESEL, you're going to have polish ID card as well.
billpg 5y ago
"We need you to prove your identity." "Here's something indistinguishable from something I could have knocked together using Microsoft Word an hour ago."
ChrisKnott 5y ago
I don't believe it was the same people. It was derailed by, essentially, "HN types" i.e. people who think they need to defend themselves from government surveillance. Without that campaign (NO2ID) screaming that it was Big Brother it would have been introduced without fanfare, because as you say Brits are generally pretty dismissive of their own privacy and trusting of the state, compared to many other countries.

heurisko 5y ago

The GDS have now become what they were setup to avoid. That is, they were supposed to be an agile startup to avoid massive overspend on untenable projects like NHS digital [1]. What I've noticed is that "new style" government projects like the GDS seem to be suffering from using too many "innovation tokens" [2], probably due to the much cited lack of leadership. It's not nice to be in a situation where you are stuck on a legacy Java 7 platform, and nothing else, but equally, it's not nice to be in a situation where you are trying to support and context-switch between too many stacks. One is too conservative, the other is chaos. If there's no leadership, there's no-one to make decisions to limit proliferation of new technology. This might be unpopular for some developers looking to improve their CVs, but necessary for the organisation as a whole. [1] https://www.bbc.co.uk/news/uk-politics-28464002 https://www.bbc.co.uk/news/uk-politics-28464002 [2] https://mcfunley.com/choose-boring-technology https://mcfunley.com/choose-boring-technology

trhoad 5y ago
> support and context-switch between too many stacks I don't believe this is the case at GDS, and wasn't the cause of the failure of the Gov.UK Verify project.
- heurisko 5y ago
  I don't think it was the cause of failure for the Verify project. But I do think it is the case at the GDS, as evidenced by the comment on this page: > GDS is full of mostly django based systems, some legacy ruby and that's just the stuff from the last few years. Going back further there are various C# systems, the amount of separate systems is staggering, it's not too surprising costs add up And this blog post: > ...quickly agreed that rather than try to settle on a single one of those we'd build each tool using whichever technology would most quickly get us to a relatively-durable prototype, and then "federate" them. We started with the python-based framework Django for the Department pages, added Ruby on Rails for a suite of tools focussed on specific tasks, and used Sinatra (another ruby framework) to glue together our search. https://gds.blog.gov.uk/2011/05/12/a-brief-overview-of-technology-behind-alpha-gov-uk/ https://gds.blog.gov.uk/2011/05/12/a-brief-overview-of-techn...

deleted 5y ago

[deleted]