3 ms·

What happened to the idea of using physical OTP generators? Or smart cards? Why can't we have a proper, democratic and auditable system of electronic authentica

by mateo1 5y ago

What happened to the idea of using physical OTP generators? Or smart cards? Why can't we have a proper, democratic and auditable system of electronic authentication in almost any government? The UK also partners with Android and iOS-based apps now, usually run by private companies, or credit agencies (which are at least strongly regulated and can't just refuse service). The possibility that eventually the only method of accessing vital government services will be through unregulated and unaccountable private companies is horrifying.

g_p 5y ago
Part of the issue seems to be getting other departments and agencies in government to let another take responsibility for "login" - authentication gives internal leverage and "power" over other departments... It shouldn't be seen that way, but this is definitely the case in a number of countries. The solution is central SSO-by-and-for-govt, run as an in-house capability. This isn't in itself uncontroversial (many countries don't have a unique primary key for easily linking individuals across datasets) - people who are in favour of smaller government are likely to be unkeen on a single government account they have to verify and then use to access taxes, healthcare, etc - they're used to separation of powers between agencies. The challenge for government is they're not just providing TOFU-style SSO - they need to also validate each user's "identity" against other datasets to ascertain to a certain level of confidence who the individual is, and that it's really them and not a fraudster. This is hard for government as nobody wants to be on the hook to another department when their verification was inadequate for some future use-case (think covid emergency loans).
sofixa 5y ago
The UK and US are uniquely positioned among developed nations in that they lack, mostly, a national register of citizens. Some countries have successful "government SSO" solutions which are used across the board ( e.g. France Connect in France, or the Estonian one come to mind, and both are open source to boot). The French one delegates authn to a few government-related providers ( the post office, tax office, healthcare system, all of which extensively verify your identity when setting up an account with them). There was talk for a new app that could read the NFC chips in passports and ID cards, and compare a selfie with the photo stored there for smoother authn, but I don't know if its state. Digital stuff is mostly well done in France ( at least recently), with most of it done in-house by the digital department and associated institutions, and usually open source.

by mateo1 5y ago

g_p 5y ago

Part of the issue seems to be getting other departments and agencies in government to let another take responsibility for "login" - authentication gives internal leverage and "power" over other departments... It shouldn't be seen that way, but this is definitely the case in a number of countries. The solution is central SSO-by-and-for-govt, run as an in-house capability. This isn't in itself uncontroversial (many countries don't have a unique primary key for easily linking individuals across datasets) - people who are in favour of smaller government are likely to be unkeen on a single government account they have to verify and then use to access taxes, healthcare, etc - they're used to separation of powers between agencies. The challenge for government is they're not just providing TOFU-style SSO - they need to also validate each user's "identity" against other datasets to ascertain to a certain level of confidence who the individual is, and that it's really them and not a fraudster. This is hard for government as nobody wants to be on the hook to another department when their verification was inadequate for some future use-case (think covid emergency loans).

sofixa 5y ago

The UK and US are uniquely positioned among developed nations in that they lack, mostly, a national register of citizens. Some countries have successful "government SSO" solutions which are used across the board ( e.g. France Connect in France, or the Estonian one come to mind, and both are open source to boot). The French one delegates authn to a few government-related providers ( the post office, tax office, healthcare system, all of which extensively verify your identity when setting up an account with them). There was talk for a new app that could read the NFC chips in passports and ID cards, and compare a selfie with the photo stored there for smoother authn, but I don't know if its state. Digital stuff is mostly well done in France ( at least recently), with most of it done in-house by the digital department and associated institutions, and usually open source.