6 ms·

I'm mostly offended that they're using a third-party private service. We need a reliable link-to-meatspace authentication provider for the consumption of gover

by hakfoo 5y ago

I'm mostly offended that they're using a third-party private service. We need a reliable link-to-meatspace authentication provider for the consumption of government services. That's obvious. But why are we outsourcing it to an external company, which may not be subject to the same purview as the government itself, particularly in terms of legally-mandated transparency, accountability, and universal service? I suspect half of this is anchored in the "mark of the beast" crowd who is terrified at the thought of any sort of coherent national identity document system. After all, if we had a central "Department of Identity" already, adding some sort of account system linked to the pre-authenticated passports and driver's licenses you already have would be trivial and within their wheelhouse.

chrisin2d 5y ago
I recommend the curious to check out DigiD. It's a relatively well-designed SSO for many (if not all?) national and local government services in the Netherlands: personal taxes, business taxes, municipal taxes, trash and water bills, health insurance (trusted private), social benefits, police services, and more.
landemva 5y ago
Wondering why centralized department of identity is needed. Could it be decentralized?
- hakfoo 5y ago
  Decentralization doesn't add value because it's not really a consensus/disagreement problem. If you look at it a certain way, we're not considering the general problem of identity, just "association with government accounts". We already have an established set of roots-of-trust and dispute resolution protocols for figuring out which accounts you're attached to. All we need is a tech-friendly set of credentials to supplement the paper passport/driver's license/social security card. If anything, decentralization would be difficult for the legal system to work with. How do you force everyone else to accept an update from the courts, especially if they're politically opposed to, or disincentived to, accept the update? You could try to tie legal acceptability to staying up to date, but then you'd create a huge liability for software bugs.
  - landemva 5y ago
    This is worth some discussion. Notaries are decentralized and regulated. Alternatively decentralized at employer, UI logon credentials could be set up when onboarding each new hire.
    - hakfoo 5y ago
      Then you start running into differing motivations. How often would you see employers "forget to" synch new hires with the unemployment system, figuring that will reduce their claim rate later? Or check in new hires as "verified citizen, eligible to work" when their proof consisted of a McLovin driver's license and a birth certificate still warm from the Kinko's across the street? It feels like it would turn into every other abused aspect of employment law: widely exploited both because of technical incompetence and the knowledge most will get away with it.
dane-pgp 5y ago
> terrified at the thought of any sort of coherent national identity document system If the outcome that they want to avoid is actually a global ID system, you'd think that a private corporation (that could offer its services to multiple countries, interoperably) would be more worrying to them. It's not like, by opposing a government-run ID system, they've prevented the existence of an ID system that the government accepts (and could mandate nationally).
- robbedpeter 5y ago
  There should be a protocol, in which voluntary individual participation is possible alongside identity brokers. This is one of those things that should have zero trust baked in at every level. It should require reversible data transactions, and real world mechanisms to allow legal authorities to reset or return ownership of ID information. It should work concurrently with a properly defined notion of valid, entirely offline identities to accommodate people who don't want their identity digitized. Multi signature cryptography and webs of trust are pretty mature concepts at this point. Using public notary systems could provide the real world authentication to publish keys, so the protocols could be developed around the idea that additional bureacracy and government shouldn't be needed - use the systems already in place wherever possible.
- wmf 5y ago
  This is a big blind spot in the US generally. Few people consider that corporations could be a bigger risk than the government, so they limit government power and leave corporations less regulated.
  - genewitch 5y ago
    Yeah while that may be a reason, and I say that with respect, that's not the reason we let corporations do what they do. That's just temporary embarrassed millionaire syndrome and financial greed.
  - jimmaswell 5y ago
    A corporation can't arrest me, shoot me, confiscate my property, or otherwise tell me what to do outside any voluntary contract with them. It's really not the same at all.
thrwawy283 5y ago
In Denmark they actually issue their citizens little RSA tokens for use authenticating into government websites. Of course, there are issues sometimes with desynced tokens but I wish our government took things that seriously.
- genewitch 5y ago
  As an aside, if you're using ssh-rsa the latest openssh server removed the RSA encryption module for pubkey verification, by default. You can add it back into the sshd_config in /etc.
  - mortehu 5y ago
    It should be added that this is because ssh-rsa uses SHA1, which is broken, and not because there's a problem with RSA itself.
  - doublepg23 5y ago
    My main key was a ed25519 one for a while (looks like 2016-2018) but after running into so many edge cases I just went back to a rsa 4096. Is it in a better place now?
  - thwarted 5y ago
    ssh's support for RSA has nothing to do with RSA tokens, which is the common name for RSA's SecurID hardware 2FA generators.
- walterbell 5y ago
  > I wish our government took things that seriously See the recent Zero Trust memo, https://news.ycombinator.com/item?id=30101411 https://news.ycombinator.com/item?id=30101411
  - thrwawy283 5y ago
    That makes me incredibly optimistic. Thanks for sharing that. :-)
kylebyproxy 5y ago
I tried to file for unemployment insurance benefits for the first time back in July, and I'm still in limbo thanks to Id.me. My state won't let me into their online portal without verifying with Id.me, but their website fails to recognize the photo on my driver's license. Their customer support rep apparently couldn't help in any way other than to escalate my ticket. Got an email update in November to please be continue being patient... Bonus points to the state of Florida DEO for removing any human staff from their phone answering system. It's just an automated menu that always leads to forced disconnection and useless advice to check their useless website. Why even have a government if it's adversarial to its own citizens?
- crooked-v 5y ago
  > Why even have a government if it's adversarial to its own citizens? The point is to be adversarial to the correct citizens, e.g., poor people and minorities. That's just basic conservatism these days.
  - nopenopenopeno 5y ago
    There is almost nothing conservative about it. The US government and both US parties are plainly neoliberal. Capitalism as a political economic system is contradictory to sustaining a state that serves its working citizens over its ruling class and global corporate stakeholders.
- idontwantthis 5y ago
  It couldn't recognize my documents either, but I got directed to a video chat with a real person. Took several hours because the "queue" randomly stops refreshing, but I got verified with in a day. It was ass, but at least it worked. You never got the video chat option?
- landemva 5y ago
  It's insurance so you paid for it. If you know an attorney, maybe look at where the State agency thinks it got authority to demand this and maybe sue for injunction.
tomrod 5y ago
I suspect login.gov is going to be expanded.
- deleted 5y ago
  [deleted]
mcshicks 5y ago
There is a digital identity act making it's way through Congress. Check it out and if you support it write your local representative. https://www.congress.gov/bill/117th-congress/house-bill/4258?s=1&r=20 https://www.congress.gov/bill/117th-congress/house-bill/4258...

by hakfoo 5y ago

chrisin2d 5y ago

I recommend the curious to check out DigiD. It's a relatively well-designed SSO for many (if not all?) national and local government services in the Netherlands: personal taxes, business taxes, municipal taxes, trash and water bills, health insurance (trusted private), social benefits, police services, and more.

landemva 5y ago

Wondering why centralized department of identity is needed. Could it be decentralized?

hakfoo 5y ago
Decentralization doesn't add value because it's not really a consensus/disagreement problem. If you look at it a certain way, we're not considering the general problem of identity, just "association with government accounts". We already have an established set of roots-of-trust and dispute resolution protocols for figuring out which accounts you're attached to. All we need is a tech-friendly set of credentials to supplement the paper passport/driver's license/social security card. If anything, decentralization would be difficult for the legal system to work with. How do you force everyone else to accept an update from the courts, especially if they're politically opposed to, or disincentived to, accept the update? You could try to tie legal acceptability to staying up to date, but then you'd create a huge liability for software bugs.
- landemva 5y ago
  This is worth some discussion. Notaries are decentralized and regulated. Alternatively decentralized at employer, UI logon credentials could be set up when onboarding each new hire.
  - hakfoo 5y ago
    Then you start running into differing motivations. How often would you see employers "forget to" synch new hires with the unemployment system, figuring that will reduce their claim rate later? Or check in new hires as "verified citizen, eligible to work" when their proof consisted of a McLovin driver's license and a birth certificate still warm from the Kinko's across the street? It feels like it would turn into every other abused aspect of employment law: widely exploited both because of technical incompetence and the knowledge most will get away with it.

dane-pgp 5y ago

> terrified at the thought of any sort of coherent national identity document system If the outcome that they want to avoid is actually a global ID system, you'd think that a private corporation (that could offer its services to multiple countries, interoperably) would be more worrying to them. It's not like, by opposing a government-run ID system, they've prevented the existence of an ID system that the government accepts (and could mandate nationally).

robbedpeter 5y ago
There should be a protocol, in which voluntary individual participation is possible alongside identity brokers. This is one of those things that should have zero trust baked in at every level. It should require reversible data transactions, and real world mechanisms to allow legal authorities to reset or return ownership of ID information. It should work concurrently with a properly defined notion of valid, entirely offline identities to accommodate people who don't want their identity digitized. Multi signature cryptography and webs of trust are pretty mature concepts at this point. Using public notary systems could provide the real world authentication to publish keys, so the protocols could be developed around the idea that additional bureacracy and government shouldn't be needed - use the systems already in place wherever possible.
wmf 5y ago
This is a big blind spot in the US generally. Few people consider that corporations could be a bigger risk than the government, so they limit government power and leave corporations less regulated.
- genewitch 5y ago
  Yeah while that may be a reason, and I say that with respect, that's not the reason we let corporations do what they do. That's just temporary embarrassed millionaire syndrome and financial greed.
- jimmaswell 5y ago
  A corporation can't arrest me, shoot me, confiscate my property, or otherwise tell me what to do outside any voluntary contract with them. It's really not the same at all.

thrwawy283 5y ago

In Denmark they actually issue their citizens little RSA tokens for use authenticating into government websites. Of course, there are issues sometimes with desynced tokens but I wish our government took things that seriously.

genewitch 5y ago
As an aside, if you're using ssh-rsa the latest openssh server removed the RSA encryption module for pubkey verification, by default. You can add it back into the sshd_config in /etc.
- mortehu 5y ago
  It should be added that this is because ssh-rsa uses SHA1, which is broken, and not because there's a problem with RSA itself.
- doublepg23 5y ago
  My main key was a ed25519 one for a while (looks like 2016-2018) but after running into so many edge cases I just went back to a rsa 4096. Is it in a better place now?
- thwarted 5y ago
  ssh's support for RSA has nothing to do with RSA tokens, which is the common name for RSA's SecurID hardware 2FA generators.
walterbell 5y ago
> I wish our government took things that seriously See the recent Zero Trust memo, https://news.ycombinator.com/item?id=30101411 https://news.ycombinator.com/item?id=30101411
- thrwawy283 5y ago
  That makes me incredibly optimistic. Thanks for sharing that. :-)

kylebyproxy 5y ago

I tried to file for unemployment insurance benefits for the first time back in July, and I'm still in limbo thanks to Id.me. My state won't let me into their online portal without verifying with Id.me, but their website fails to recognize the photo on my driver's license. Their customer support rep apparently couldn't help in any way other than to escalate my ticket. Got an email update in November to please be continue being patient... Bonus points to the state of Florida DEO for removing any human staff from their phone answering system. It's just an automated menu that always leads to forced disconnection and useless advice to check their useless website. Why even have a government if it's adversarial to its own citizens?

crooked-v 5y ago
> Why even have a government if it's adversarial to its own citizens? The point is to be adversarial to the correct citizens, e.g., poor people and minorities. That's just basic conservatism these days.
- nopenopenopeno 5y ago
  There is almost nothing conservative about it. The US government and both US parties are plainly neoliberal. Capitalism as a political economic system is contradictory to sustaining a state that serves its working citizens over its ruling class and global corporate stakeholders.
idontwantthis 5y ago
It couldn't recognize my documents either, but I got directed to a video chat with a real person. Took several hours because the "queue" randomly stops refreshing, but I got verified with in a day. It was ass, but at least it worked. You never got the video chat option?
landemva 5y ago
It's insurance so you paid for it. If you know an attorney, maybe look at where the State agency thinks it got authority to demand this and maybe sue for injunction.

tomrod 5y ago

I suspect login.gov is going to be expanded.

deleted 5y ago
[deleted]

mcshicks 5y ago

There is a digital identity act making it's way through Congress. Check it out and if you support it write your local representative. https://www.congress.gov/bill/117th-congress/house-bill/4258?s=1&r=20 https://www.congress.gov/bill/117th-congress/house-bill/4258...