14 ms·

Mygov is a ‘huge disappointment,’ key architect despairs

136 points by ahonhn 4y ago

macropin 4y ago
To truely make it "MyGov" they need to open up the code base and start accepting PR's.
- Krisjohn 4y ago
  After a thorough security audit, please. I've been forced to put my personal data in there and I'd like to imagine it's not compromised yet.
- JMS2021 4y ago
  UK Represent... https://alphagov.github.io/ https://alphagov.github.io/
jay_kyburz 4y ago
I find it very annoying that to do your taxes yourself in Australia you must have an Android or iOS phone. There is no way to authenticate via the web or just sms on a dumb phone.
- mkj 4y ago
  Last year it didn't need any 2FA for my taxes. Have they made it required now?
  - Andaith 4y ago
    It's been required for a while now for the mygov login?
  - throwawayboise 4y ago
    They have to do somthing to prevent the epidemic of people paying taxes other than their own.
    - meetups323 4y ago
      Same with utilities... I swear I need to provide more PII to pay my utilities than to login to my bank account. Who's going around paying other peoples bills and how do I become friends with them?
    - erik_seaberg 4y ago
      Stealing refunds is a problem in the US, because too much was withheld from many taxpayers.
  - ahonhn 4y ago
    Yes, but if you linked before that then you don't have to update (for now).
- toomuchtodo 4y ago
  This is really what a national ID card with smart card support was made for. PIV card readers are $10-$20. https://playbooks.idmanagement.gov/piv/gettingstarted/ https://playbooks.idmanagement.gov/piv/gettingstarted/ https://en.wikipedia.org/wiki/ISO/IEC_7816 https://en.wikipedia.org/wiki/ISO/IEC_7816
  - Namidairo 4y ago
    Australians get really really antsy whenever the topic of National ID cards are brought up. I don't think anyone really expects a new government from either side to spend political capital on one, especially given the focus on cost of living/inflation at the moment. (There's a federal election in just over 2 weeks time.)
- denismi 4y ago
  How so? I just logged in on Linux/Firefox with username+password+SMS-2FA?
- Andaith 4y ago
  Errr, is that new? I always use username/password/2fa via text message.
- cbo100 4y ago
  Are you meaning business taxes? Personal tax is via mygov which is SMS 2FA. Business tax (which I thankfully haven't had to do for a while) has always been "difficult", it was an awful Java applet for a while there. Edit: I think I realise now my mistake, the new beta/govid looks to be following that path. So iOS/Android only. Old IDs still work for the moment though.
  - jay_kyburz 4y ago
    I was talking about business taxes and the business portal. I didn't realize personal tax was different.
- plugger 4y ago
  My sister in law is a tax accountant so thankfully I still lodge through her by paper. I'd rather not have a MyGov account until absolutely required given my expectations of just how poorly that environment is configured and secured.
mhitza 4y ago
90-day sprints, lol, who signed off on that?!
- cgb223 4y ago
  That’s just waterfall with extra steps…
  - marginalia_nu 4y ago
    Rice terrace development, maybe?
- senectus1 4y ago
  Thats Agile, for Gov.
- throwaway-aogS8 4y ago
  You misread the article. Deloitte was given a 90 day period to build a proof of concept which won them the follow-up contract. I believe the project actually ran on pretty standard 2 or 3 week sprints.
teh_klev 4y ago
> Deloitte, Accenture, IBM and Arq Group I think I see the problem.
- ArtWomb 4y ago
  Cream. Bad Company. The Power Station. Traveling Wilburys. Temple of the Dog. I think we need a name for this supergroup as well ;)
  - partomniscient 4y ago
    Money Vampires Collective?
- koolba 4y ago
  Sounds like something a McKinsey consultant would say.
- tootie 4y ago
  "Adobe also landed a $32 million deal to provide tech components" They bought AEM didn't they?
- deleted 4y ago
  [deleted]
tpmx 4y ago
I spent a year working in Melbourne, Australia a decade ago. I loved pretty much everything about the experience, except one thing: the "she'll be right, mate" attitude. I saw a fair bit of complacency. Strange experience.
- drfuchs 4y ago
  Would you please provide a translation for us Americans? Thanks.
  - diatone 4y ago
    If your house has a gas leak but it’s not too strong, she’ll be right. If your bathroom faucet is leaking but it’s a drop an hour, she’ll be right. If it’s bushfire season and you haven’t prepared for your house getting burned down, but it hasn’t happened in the last five years, she’ll be right. Cynically, it’s shirking responsibility. Optimistically, it’s playing the odds.
    - bigDinosaur 4y ago
      I've never known anyone to leave a gas leak, and everyone I know would also get a leaking tap fixed (or do it themselves). I think you're exaggerating this aspect of Australian culture quite a bit.
      - PickledHotdog 4y ago
        I think the exaggeration was for humorous effect
        bigDinosaur 4y ago
        Fair enough, it's more for an international audience who might take it as a totally serious assessment of Australian culture (if they care!). Can't keep the reputation of being too relaxed forever.
  - deleted 4y ago
shakna 4y ago
Considering the enormous and complicated design-by-committee standards [0] that the services are now all required to implement, it's a shocker when any part of myGov continues to even function. (Though it does have its fair share of unexpected outages...) Especially when there's breaking changes [1] every two months or so. [0] https://consumerdatastandardsaustralia.github.io/standards https://consumerdatastandardsaustralia.github.io/standards [1] https://consumerdatastandardsaustralia.github.io/standards/#change-log https://consumerdatastandardsaustralia.github.io/standards/#...
aetherspawn 4y ago
Honestly it's not too bad. It does some clever things (like upload and scan a photo of your birth certificate for identity verification), and yes, for a lot of small tasks it saves you having to get on the phone and wait on hold for hours. However, my birth certificate is from a small country hospital and in a non-standard format that it doesn't recognize, and now that myGov is the standard channel, it's so difficult to apply for anything. And I can't just .. be re-born at a different hospital .. so that the system will accept my application to become a chartered engineer.
- shakna 4y ago
  You should be able to request a new birth certificate from Birth, Deaths and Marriages, which will come in the new format. That should save you a few headaches in the future, as well.
  - aetherspawn 4y ago
    I had no idea, thank you.
  - gg82 4y ago
    Although getting it from Birth, Deaths and Marriages may cause you a few headaches all of its own!
TempestSA 4y ago
“The argument has been that you employ consultants and commercial providers to do this sort of work based on the fact they have skills you don’t, but had it not been for the fact we’ve lost so many skills we wouldn’t have needed to do that.” This. How can companies/governments still think that you can "outsource" IT, when technology is not only tightly integrated into the fabric of what a modern company is, but nowadays a solid technology capability sets the high performers apart from the laggards. It's just as ludicrous as outsourcing the HR, sales team or the executive office. Unfortunately unlike in the real world where these companies will become uncompetitive and dissolve, we are stuck with our government and their outdated operating models...
- mistrial9 4y ago
  > How can companies/governments still think that you can "outsource" IT becuase they have the budget and others do not. It really is that simple.
- zmmmmm 4y ago
  > you employ consultants and commercial providers to do this sort of work based on the fact they have skills you don’t The irony is, it's nearly exactly backwards. I have literally never seen effective use of consultants and outsourced work like this except in one situation: where you DO have the internal skills. Pretty much the only way to get any value is when you have highly knowledgeable and skilled people with strong engineering background managing the process. Of course, convincing highly skilled engineers that it's a valuable use of their skills and time to simply manage a bunch of outsourced consultants when they could be directly managing a team somewhere else is a challenge in itself.
  - lrem 4y ago
    You are obviously right with needing local knowledge first. But I've seen two types of well-used consulting: 1. A small team needs to integrate with an external data source. They figure out it's better to keep own engineers focused on the business logic and bring external folk for the (hopefully) one-off task of figuring out the idiosyncrasies of the thing. 2. A large company needs to push the edges. They hire someone with a PhD in the general area, who then points at the exact professors needed on board to get the edges pushed.
mianos 4y ago
This way more serious than a 'huge disappointment'. The platform seemed to be based on some weird 'forms' based application builder when it was released ten years ago. It is flakey as hell. Ugly I can deal with, we have ebay and it still works fine, but even the most basic things you would expect, for example when you press tab the cursor to follow the order of forms on the page, does not work. Often when you submit a form the focus ends up on some text field. The integration with other services, such as Medicare, barely work. I have spent endless calls on the phone to near useless support staff trying to get emails reset for old mother. The support staff are friendly but don't seem to have any ability to do anything but reset things that take several hours to complete. The tax and business functionality is completely senseless. They got the paper forms designed in the 50s for batch mainframes and coded them into web forms. You have to do things like copy the same value into multiple fields marker T8 and T2. The instructions say just that: "Copy the value from T8 to T2". If you don't it fails. The article mentions the huge problem with them having no in-house expertise so they bring in consultants. I work here in Sydney and I know, from first hand experience working with them, these large consulting companies have the same or less technical expertise. What they do have is huge sales teams and even larger teams of project managers. The odd technical person they have is spread across so many projects they are pretty much useless. They employ hordes of off-shore developers that are managed people with little or no clue about anything.
- volcanok 4y ago
  >these large consulting companies have the same or less technical expertise. What they do have is huge sales teams and even larger teams of project managers. This is correct. Consulting is 100% marketing. It appears the problem is, how does a team of actually skilled engineers who wants to get a start in this business compete with these sales companies? The people hiring them have no clue, hence why the marketing is the most important thing, and many of these companies have inertia from a bunch of previous projects they can use in their marketing. I feel like actually good engineers have the least social contacts, and it is these social contacts that provide all of the opportunities to start building a client-base. This seems to be the case with society in general. Everything is decided by social relationships, and the best engineers are the worst at creating these relationships, or are actively excluded from them as some sort of defence mechanism for social people to maintain power. Hence why we end up with a bunch of terrible products and software. It is all bundled up in a cocoon of social contracts.
jiggawatts 4y ago
Let me provide some background information for people who aren't familiar with the agencies involved in this (Centrelink, Medicare, and the Australian Taxation Office). These places have some of the worst-run IT departments on the planet. I can say this with more than a little evidence. As a consultant, I've worked on over a hundred customer sites, all the way from tiny private companies up to federal government, including all three of those agencies. I've seen how IT is done at just about every state government office in my state, and two dozen in other states. There just is no comparison. Centrelink especially is so fucked up that people think that I made up my stories about my experience there. It's crazy beyond belief. The sheer scale of it is amazing. They have over 1K IT staff in one building, and spent $2B on a single software upgrade project! They have huge teams for obscure tasks that other large enterprises might have just one or two people doing. There are Big Name consultants everywhere. Direct vendor support, often flown in from the US, which is otherwise rare around here. Despite all these people, money, and support, nothing works. Nothing. It's all broken. Everything. Every part. It's a sight to behold. I wrote a report for them about a key security system where I pointed out that out of something like 50 settings, 47 were incorrectly configured. The only reason it "worked" is because the errors cancelled out. That is, it was incorrectly rejecting valid access, but another error meant that the rejection was being ignored. And so on. Similarly, their core authentication system was supposed to be distributed and highly available, but the main architect put all of the servers into one rack, one on top of another. He said with a straight face that a product that is well known in the industry for its efficient wide-scale replication is "bad at replication" and only works if the "network cables are really short". He meant 30cm, not 3000km. A power outage took out all three "redundant" controllers, and so something like 80K staff spent several days staring at login prompts on their monitors for a few days. I could go on, and on, and on. I have a whole collection of stories like that. The most amazing part is that I was only there for a couple of months, yet this short time period yielded 8 of my top 10 horror stories from the field. It's also the only workplace setting where I had ever seen a man cry. For work related reasons. Several men, on several occasions.
- vehementi 4y ago
  How does corruption like this go unpunished?
jkahn 4y ago
Really, this article is just a whinge. I'm an Australian. MyGov is fine, I interact with it as a citizen regularly. Government needs to outsource implementation of this kind of stuff because it's extremely hard to build software teams and manage their performance in permanent government roles. And those costs are reasonable - particularly for anyone that builds teams of software engineers and knows what aggregate team costs are like in Australia. The hard part of the MyGov platform is the inter-department stuff, and I don't think that's a software issue, that's bureaucracy. MyGov isn't perfect, but it's fine.
- mrmincent 4y ago
  Agreed, I’ve linked several services over the years and it all works when I need it. I can’t imagine the struggle it would’ve been to get all the various ancient systems and bureaucracies working together
- tallytarik 4y ago
  > MyGov isn't perfect, but it's fine. Sure. But then why have they spent tens of millions of dollars trying to build a new version - https://beta.my.gov.au https://beta.my.gov.au - that works the same or worse?
  - dryanau 4y ago
    I switched to beta a month or so and I can't even tell what the difference is, other than it being slightly shinier. MyGov just seems like a portal containing bookmarks to various other services anyway, right? It consolidates your records for Medicare, ATO, and if applicable, NDIS, Centrelink etc. Seems kind of basic. Although I understand there's a lot of hidden complexity underneath these things, especially surrounding ID verification. But even so, I couldn't tell you the difference between the old mygov and the beta version.
    - bigDinosaur 4y ago
      That's part of the problem noted in the article: they haven't even implemented style changes that they could have - why are simple changes taking so long?
n-e-w 4y ago
Are we just going to ignore the equally ludicrous amounts being paid under these contracts??
throwaway-aogS8 4y ago
Throwaway for obvious reasons. While I didn't work directly on myGov, I knew quite a few people on the team that did (at all levels) and had a fair number of depressing pub sessions with them lamenting the entire project. This article doesn't say much that the people working on it weren't saying throughout the entire delivery. I'm not going to defend the ludicrous cost of the project; we all know that outsourcing to private consultants to save money is a neoliberal pipe-dream up there with "trickle-down" economics. Many of the contractors for government agencies are former public sector workers who have been driven out by the laughably uncompetitive wages and the government's hostile attitude towards the APS. And can you blame someone for leaving a job where they aren't supported and are mocked by the governing party in the media, when they can do essentially the same job with less bureaucratic oversight and twice the pay as a consultant or contractor? Why would they stay? A sense of civic duty? That's called "being a gullible c*nt" here in Australia. The article even points this out: > "Agencies are somewhat compromised by no longer having lots of these skills in-house." No shit. Who knew systematically de-funding your own public service meant it would lose efficacy? Starve the beast[1] is a toxic political strategy that never should have made it across the pacific. So that's why myGov is expensive; we're paying to support an entire ecosystem of middlemen. But if you want to know why it's a shit-show these quotes from the article point to (imo) the biggest cause: > Responsibility for the "enhancement" of myGov was transferred from the DTA (Digital Transformation Agency) to Services Australia (formerly Department of Human Services/Department of Social Security) in late 2020 > "Individual agencies continue to do their own thing [...]" MyGov was meant to integrate government services, but none of the agencies would actually expose a single endpoint for the myGov team to integrate. Months and months were spent just trying to get agencies to accept that for an integrated platform to work they would need to support a common authentication system. Doesn't leave much to do except polish the UI, does it? This quote from the article literally made me laugh out loud: > "What's so hard about making these improvements? I don't understand why it has taken that long and cost so much money to do that." > The main goal of myGov was to integrate a range of government services from different departments seamlessly on the one platform. But the new beta version of the platform still doesn't do that effectively The problem wasn't technical, it was institutional. The Australian tax payer just spent millions of dollars hiring consultants to try and herd cats. They weren't outsourcing for developers as much as they were outsourcing for mediators. The DTA was meant to be the solution to digital integration of government agencies in Australia by setting up an internal government digital agency. But the large entrenched agencies (such as Services Australia) had no real incentive to listen to a word it said and every incentive to resist relinquishing control to it. The agency is for all intents-and-purposes now dead. It's only remaining responsibilities are "advisory". Even the official design system inspired by the highly praised GOV.UK one was decommissioned practically before it got off the ground [2] The myGov and DTA story isn't some simplistic private vs public sector issue. This is a fundamental culture issue within Australia (and it seems the whole anglosphere at the moment). No one is happy except the ministers and executives rorting record amounts of cash out of the system. [1] https://en.wikipedia.org/wiki/Starve_the_beast https://en.wikipedia.org/wiki/Starve_the_beast [2] https://designsystem.gov.au/ https://designsystem.gov.au/
3np 4y ago
As a complete outsider, half of the whole article reads like an Onion piece.
WatchDog 4y ago
The main thing I use mygov for is doing my tax, and it works fine. Given all the complaints I see here about the lack of a US government online tax app, we seem to be doing better in that regard, although I imagine the US tax landscape is much more complex.
fphhotchips 4y ago
Season 3, Episode 3 of Utopia dealt with myGov perfectly. It's like the writers were actually in implementation meetings. If you've never worked in or with government in Australia, I highly recommend checking it out. Then remember that the real thing is worse.
- cube00 4y ago
  Internationally it's on Netflix but named "Dreamland" [1] [1] https://en.wikipedia.org/wiki/Utopia_(Australian_TV_series) https://en.wikipedia.org/wiki/Utopia_(Australian_TV_series)
- pabfusdhd 4y ago
  Was working at DTA at the time on the digital identity work and the episode was painfully close to the bone.
tonfreed 4y ago
Part of the problem is that there's no real negative feedback in a government project. I've been attached to government work in the past, and the whims of the PMs change day to day because the people there were often just promoted to get them out of the way of another team. There's no real leadership or technical ownership of the product, and I've found that the PMs will often just quickly blame the user for not using the software correctly rather than actually reflecting on why they may be getting that feedback. The consultants may have fucked up, but they were only able to because the people in charge fucked up first.
sebast_bake 4y ago
Australian here, I think the comments here overstate how bad MyGov is. I'm in my mid 20's, and I have literally never had to call any federal government organisation, visit any service centre or post any forms. For my entire adult life, all of my interactions with federal services have been through MyGov. This includes taxes, welfare, healthcare and education... I can only imagine how colossal the undertaking must have been. MyGov ties together our largest, most bureaucratic organisations. Imagine being tasked with such an project, building the web application is the easy part, you also need to convince a country's largest organisations to change how they operate. Considering this, I'm actually surprised how good MyGov is.
- unlikelymordant 4y ago
  Im in the same boat, except Im older, but i agree with everything youve said.
- systoll 4y ago
  This seems to be mostly talking about the 'new' mygov. The new goal was to provide a unified front – users would navigate through MyGov based on their needs and goals and be sent directly to the relevant forms and info from all departments. EG – instead of going to Centrelink and seeing only JobSeeker, or going to the ATO and seeing only JobKeeper; you’d go to 'COVID relief payments' and see a clear explanation of both, and you’d be able to apply for either one directly. But in the beta… it’s basically just Centrelink. In the entire 'Health' section, the only medicare service mentioned is the proof of COVID-19 vaccination. The end result is that https://beta.my.gov.au/en/myaccount/dashboard/ https://beta.my.gov.au/en/myaccount/dashboard/ is basically the old mygov, and the rest of the site is a mirror of https://servicesaustralia.gov.au https://servicesaustralia.gov.au .
- kdtsh 4y ago
  I don’t want to make assumptions about how you use the services in MyGov, but the experience of my family and friends has been that, if you require any service which is at all out-of-the-ordinary or needs a pair of human eyes looking at it (whether or not it should - there are plenty of broken processes at Centrelink, some might say that’s by design) then you need to make a phone call, because the function to perform self-service is simply not there. I have also had fairly good experiences with MyGov - but my interactions with social services are fairly boring compared to the needs of many people. Edit: the problem here of course is that if you make a phone call you can expect to wait in a queue for many hours.
Trouble_007 4y ago
>Analysis of the Australian Tax Office's myGovID system< Thinking Cybersecurity – A/Prof. Vanessa Teague (ANU) : https://www.thinkingcybersecurity.com https://www.thinkingcybersecurity.com blogs and code on github : https://github.com/vteague https://github.com/vteague Twitter @VTeagueAus
joeman1000 4y ago
I set up my fathers ‘vaccination pass’ a few months ago. I had to link about 4 different services together, prove his identity twice, confirm email multiple times, navigate through the chain of services trying to talk to each other… I’m used to complexity as an engineer and it took me 20 minutes of headscratching to get it working. Insanity
simonw 4y ago
Has paying Accenture, Deloitte and IBM tens of millions of dollars ever worked for anyone?
- stephen_g 4y ago
  No, never. But we'll try again and next time surely it'll work!
- diordiderot 4y ago
  It's worked for Accenture, Deloitte and IBM
somada141 4y ago
I honestly feel that whoever complains about MyGov never had to perform these bureaucratic operations in a country like Greece. The fact that one can interact with some of the biggest and slowest-moving agencies in the Australian government from the comfort of their home was mind-blowing to me when living in Aus. Maybe having to queue up for 3h in the cold to be greeted by a grouchy underpaid public servant that would have you queue up again next week (the Greek experience) until you have to call some person you know to do basic things like renewing your passport has lowered the bar too much for me. Let’s not forget software is hard in the best of environments and archaic governmental offices and processes aren’t exactly conducive to development velocity and quality
- nmfisher 4y ago
  At the same time, it's easy to think Australia's doing a good job if you've never experienced well-run government services (like Singapore). What's more, Australia's online services have somehow managed to get worse every year since around 2010. Last I checked, there's still no way for me to lodge a corporate tax return electronically, it needs to be via paper or an agent. SASIC failed to notify me - by either physical mail or e-mail - that an annual fee was due, slugged me with a late penalty, then refused to reverse it when I complained and showed that their own online system had no trace of an invoice. MyGovID (or whatever its latest incarnation is) literally took an hour to validate a passport scan. My mother just returned from overseas and was required to download an (Android/iOS only) app, create an account and fill out a whole range of personal details simply for a health declaration. It truly feels like public service management keep handing blank cheques to (probably Big 4) 'digital transformation consultants' to charge millions for project after shitty half-baked project, with no regard for whether actual improvements are being made.
thrixton 4y ago
Personally, as an Aussie, I don't have any massive gripes with MyGov specifically. Bear in mind that it's mainly (only?) a portal to other departments (ATO, Centrelink, Medicare?). I don't actually see why we're bothering to "upgrade" it at all, the mention of not being able to deploy a styling change, who gives a toss honestly, styling is way down my list for something like this. When I had to get a MyGov ID for my son, it did the facial recognition off his passport (no idea if it would have allowed someone else...) fine, set it all up just fine in Covid lockdown so that's a +. My main gripe is that unless you want their crappy app installed, the only MFA option is SMS, which as this audience knows is just not secure.
- ahonhn 4y ago
  As an Aussie who has lived overseas for decades even the SMS option is not available to me as it requires you to have an Australian phone number. You can't install the myGov Code Generator app without an Australian phone number either. I haven't tried the myGovId app, which seems the best bet, as I'm scared it will fail and block what access I have to myGov now. Also, for a long time the only way to change your myGov email was to set up a new myGov account. Ditto if you had the Code Generator app and lost your phone - though with the myGovId app you now have another avenue for recovery - provided of course that it doesn't crash, accepts your scanned documents and you actually have enough such documents to keep it happy.
  - PickledHotdog 4y ago
    Haven't tried this myself, but perhaps it might work overseas? https://github.com/abrasive/mygov-totp-enroll https://github.com/abrasive/mygov-totp-enroll
n8ta 4y ago
"four-company panel was established to continue works on it, featuring Deloitte, Accenture, IBM and Arq Group." "We’re supposed to be adopting an agile development methodology" Ah yes the classic agile setup 2 week sprints where at the end of each sprint you rotate companies.
aemreunal 4y ago
Turkey actually has a very good online portal [1] for a lot of interactions for the government. Anything from obtaining official letters to checking statuses of court causes, etc. can be done over it. Pretty decent iOS app too. Credit where credit is due. Wish the US had as decent of an online portal to all governmental things. [1]: www.turkiye.gov.tr
SulphurCrested 4y ago
The 2FA the site supports is either SMS or time-based token. According to them SMS doesn't work outside Australia, and having access to the site might be useful outside the country, so the time-based token seems the better choice. Except they apparently decided that the standard TOTP apps like Google Authenticator weren't good enough for them. Moah bits better, or some such. Anyway, although it is a time-based token it isn't that time-based token and you have to install their app. OK, we'll do that then. Carefully navigating past the almost identically named app with a similar icon that is for proving your identity to them, and trying not to think about all the user reviews saying myGov Code Generator doesn't work, we get it on our iPhone. Now, it doesn't work like any other TOTP app and read a QR code or have you enter a number. Instead, you have to enter your username and password into the app. [1] At this point, for me it just hung with a white screen. Exactly the same behaviour is described in the top listed review, from 2020, in the App Store, with no response from the developer [2]. This was a little scary: am I now locked out of my account? They won't help you get back in; you have to create a new one. They also have you create a backup 2FA method (SMS) after you've logged in with the time-based token. This would be a little late if you got locked out after something went wrong on your first outing with the Code Generator app. The linked video seems to have been improved since I tangled with the app. I don't remember at the time knowing it was possible to have both the SMS and app enabled for 2FA. It seems it's still not possible to have two apps enabled, on two different phones, for example to replace your phone. Bear in mind that there are residences in Australia with no mobile reception at all. No doubt they had meetings in which they congratulated each other in devising a time-based one-time password scheme which is theoretically more secure than the usual TOTP. Never mind that both are adequate for the job, and the alternative is SMS. I wouldn't be surprised if someone got a conference paper out of it. I guess if the system is actually built by someone else, you can only get promotion and a pay rise by adding knobs to the specification. If the incentives valued robustness, they would have simply used the standard TOTP. I think the biggest failing is that this problem has been all over social media, and is mentioned in the App Store reviews, but nothing has been addressed. According to the revision history at the App Store, it last got bug fixes in December 2017, with only edits to help text since then. The developers were nowhere to be seen in the Whirlpool thread or at the App Store. In my opinion this crosses the line from incompetence to misconduct. [1] https://www.youtube.com/watch?v=m-gf448FDFA https://www.youtube.com/watch?v=m-gf448FDFA [2] https://apps.apple.com/au/app/mygov-code-generator/id1305497801 https://apps.apple.com/au/app/mygov-code-generator/id1305497...

136 points by ahonhn 4y ago

macropin 4y ago

To truely make it "MyGov" they need to open up the code base and start accepting PR's.

Krisjohn 4y ago
After a thorough security audit, please. I've been forced to put my personal data in there and I'd like to imagine it's not compromised yet.
JMS2021 4y ago
UK Represent... https://alphagov.github.io/ https://alphagov.github.io/

jay_kyburz 4y ago

I find it very annoying that to do your taxes yourself in Australia you must have an Android or iOS phone. There is no way to authenticate via the web or just sms on a dumb phone.

mkj 4y ago
Last year it didn't need any 2FA for my taxes. Have they made it required now?
- Andaith 4y ago
  It's been required for a while now for the mygov login?
- throwawayboise 4y ago
  They have to do somthing to prevent the epidemic of people paying taxes other than their own.
  - meetups323 4y ago
    Same with utilities... I swear I need to provide more PII to pay my utilities than to login to my bank account. Who's going around paying other peoples bills and how do I become friends with them?
  - erik_seaberg 4y ago
    Stealing refunds is a problem in the US, because too much was withheld from many taxpayers.
- ahonhn 4y ago
  Yes, but if you linked before that then you don't have to update (for now).
toomuchtodo 4y ago
This is really what a national ID card with smart card support was made for. PIV card readers are $10-$20. https://playbooks.idmanagement.gov/piv/gettingstarted/ https://playbooks.idmanagement.gov/piv/gettingstarted/ https://en.wikipedia.org/wiki/ISO/IEC_7816 https://en.wikipedia.org/wiki/ISO/IEC_7816
- Namidairo 4y ago
  Australians get really really antsy whenever the topic of National ID cards are brought up. I don't think anyone really expects a new government from either side to spend political capital on one, especially given the focus on cost of living/inflation at the moment. (There's a federal election in just over 2 weeks time.)
denismi 4y ago
How so? I just logged in on Linux/Firefox with username+password+SMS-2FA?
Andaith 4y ago
Errr, is that new? I always use username/password/2fa via text message.
cbo100 4y ago
Are you meaning business taxes? Personal tax is via mygov which is SMS 2FA. Business tax (which I thankfully haven't had to do for a while) has always been "difficult", it was an awful Java applet for a while there. Edit: I think I realise now my mistake, the new beta/govid looks to be following that path. So iOS/Android only. Old IDs still work for the moment though.
- jay_kyburz 4y ago
  I was talking about business taxes and the business portal. I didn't realize personal tax was different.
plugger 4y ago
My sister in law is a tax accountant so thankfully I still lodge through her by paper. I'd rather not have a MyGov account until absolutely required given my expectations of just how poorly that environment is configured and secured.

mhitza 4y ago

90-day sprints, lol, who signed off on that?!

cgb223 4y ago
That’s just waterfall with extra steps…
- marginalia_nu 4y ago
  Rice terrace development, maybe?
senectus1 4y ago
Thats Agile, for Gov.
throwaway-aogS8 4y ago
You misread the article. Deloitte was given a 90 day period to build a proof of concept which won them the follow-up contract. I believe the project actually ran on pretty standard 2 or 3 week sprints.

teh_klev 4y ago

> Deloitte, Accenture, IBM and Arq Group I think I see the problem.

ArtWomb 4y ago
Cream. Bad Company. The Power Station. Traveling Wilburys. Temple of the Dog. I think we need a name for this supergroup as well ;)
- partomniscient 4y ago
  Money Vampires Collective?
koolba 4y ago
Sounds like something a McKinsey consultant would say.
tootie 4y ago
"Adobe also landed a $32 million deal to provide tech components" They bought AEM didn't they?
deleted 4y ago
[deleted]

tpmx 4y ago

I spent a year working in Melbourne, Australia a decade ago. I loved pretty much everything about the experience, except one thing: the "she'll be right, mate" attitude. I saw a fair bit of complacency. Strange experience.

drfuchs 4y ago
Would you please provide a translation for us Americans? Thanks.
- diatone 4y ago
  If your house has a gas leak but it’s not too strong, she’ll be right. If your bathroom faucet is leaking but it’s a drop an hour, she’ll be right. If it’s bushfire season and you haven’t prepared for your house getting burned down, but it hasn’t happened in the last five years, she’ll be right. Cynically, it’s shirking responsibility. Optimistically, it’s playing the odds.
  - bigDinosaur 4y ago
    I've never known anyone to leave a gas leak, and everyone I know would also get a leaking tap fixed (or do it themselves). I think you're exaggerating this aspect of Australian culture quite a bit.
    - PickledHotdog 4y ago
      I think the exaggeration was for humorous effect
      - bigDinosaur 4y ago
        Fair enough, it's more for an international audience who might take it as a totally serious assessment of Australian culture (if they care!). Can't keep the reputation of being too relaxed forever.
- deleted 4y ago

shakna 4y ago

Considering the enormous and complicated design-by-committee standards [0] that the services are now all required to implement, it's a shocker when any part of myGov continues to even function. (Though it does have its fair share of unexpected outages...) Especially when there's breaking changes [1] every two months or so. [0] https://consumerdatastandardsaustralia.github.io/standards https://consumerdatastandardsaustralia.github.io/standards [1] https://consumerdatastandardsaustralia.github.io/standards/#change-log https://consumerdatastandardsaustralia.github.io/standards/#...

aetherspawn 4y ago

Honestly it's not too bad. It does some clever things (like upload and scan a photo of your birth certificate for identity verification), and yes, for a lot of small tasks it saves you having to get on the phone and wait on hold for hours. However, my birth certificate is from a small country hospital and in a non-standard format that it doesn't recognize, and now that myGov is the standard channel, it's so difficult to apply for anything. And I can't just .. be re-born at a different hospital .. so that the system will accept my application to become a chartered engineer.

shakna 4y ago
You should be able to request a new birth certificate from Birth, Deaths and Marriages, which will come in the new format. That should save you a few headaches in the future, as well.
- aetherspawn 4y ago
  I had no idea, thank you.
- gg82 4y ago
  Although getting it from Birth, Deaths and Marriages may cause you a few headaches all of its own!

TempestSA 4y ago

“The argument has been that you employ consultants and commercial providers to do this sort of work based on the fact they have skills you don’t, but had it not been for the fact we’ve lost so many skills we wouldn’t have needed to do that.” This. How can companies/governments still think that you can "outsource" IT, when technology is not only tightly integrated into the fabric of what a modern company is, but nowadays a solid technology capability sets the high performers apart from the laggards. It's just as ludicrous as outsourcing the HR, sales team or the executive office. Unfortunately unlike in the real world where these companies will become uncompetitive and dissolve, we are stuck with our government and their outdated operating models...

mistrial9 4y ago
> How can companies/governments still think that you can "outsource" IT becuase they have the budget and others do not. It really is that simple.
zmmmmm 4y ago
> you employ consultants and commercial providers to do this sort of work based on the fact they have skills you don’t The irony is, it's nearly exactly backwards. I have literally never seen effective use of consultants and outsourced work like this except in one situation: where you DO have the internal skills. Pretty much the only way to get any value is when you have highly knowledgeable and skilled people with strong engineering background managing the process. Of course, convincing highly skilled engineers that it's a valuable use of their skills and time to simply manage a bunch of outsourced consultants when they could be directly managing a team somewhere else is a challenge in itself.
- lrem 4y ago
  You are obviously right with needing local knowledge first. But I've seen two types of well-used consulting: 1. A small team needs to integrate with an external data source. They figure out it's better to keep own engineers focused on the business logic and bring external folk for the (hopefully) one-off task of figuring out the idiosyncrasies of the thing. 2. A large company needs to push the edges. They hire someone with a PhD in the general area, who then points at the exact professors needed on board to get the edges pushed.

mianos 4y ago

This way more serious than a 'huge disappointment'. The platform seemed to be based on some weird 'forms' based application builder when it was released ten years ago. It is flakey as hell. Ugly I can deal with, we have ebay and it still works fine, but even the most basic things you would expect, for example when you press tab the cursor to follow the order of forms on the page, does not work. Often when you submit a form the focus ends up on some text field. The integration with other services, such as Medicare, barely work. I have spent endless calls on the phone to near useless support staff trying to get emails reset for old mother. The support staff are friendly but don't seem to have any ability to do anything but reset things that take several hours to complete. The tax and business functionality is completely senseless. They got the paper forms designed in the 50s for batch mainframes and coded them into web forms. You have to do things like copy the same value into multiple fields marker T8 and T2. The instructions say just that: "Copy the value from T8 to T2". If you don't it fails. The article mentions the huge problem with them having no in-house expertise so they bring in consultants. I work here in Sydney and I know, from first hand experience working with them, these large consulting companies have the same or less technical expertise. What they do have is huge sales teams and even larger teams of project managers. The odd technical person they have is spread across so many projects they are pretty much useless. They employ hordes of off-shore developers that are managed people with little or no clue about anything.

volcanok 4y ago
>these large consulting companies have the same or less technical expertise. What they do have is huge sales teams and even larger teams of project managers. This is correct. Consulting is 100% marketing. It appears the problem is, how does a team of actually skilled engineers who wants to get a start in this business compete with these sales companies? The people hiring them have no clue, hence why the marketing is the most important thing, and many of these companies have inertia from a bunch of previous projects they can use in their marketing. I feel like actually good engineers have the least social contacts, and it is these social contacts that provide all of the opportunities to start building a client-base. This seems to be the case with society in general. Everything is decided by social relationships, and the best engineers are the worst at creating these relationships, or are actively excluded from them as some sort of defence mechanism for social people to maintain power. Hence why we end up with a bunch of terrible products and software. It is all bundled up in a cocoon of social contracts.

jiggawatts 4y ago

Let me provide some background information for people who aren't familiar with the agencies involved in this (Centrelink, Medicare, and the Australian Taxation Office). These places have some of the worst-run IT departments on the planet. I can say this with more than a little evidence. As a consultant, I've worked on over a hundred customer sites, all the way from tiny private companies up to federal government, including all three of those agencies. I've seen how IT is done at just about every state government office in my state, and two dozen in other states. There just is no comparison. Centrelink especially is so fucked up that people think that I made up my stories about my experience there. It's crazy beyond belief. The sheer scale of it is amazing. They have over 1K IT staff in one building, and spent $2B on a single software upgrade project! They have huge teams for obscure tasks that other large enterprises might have just one or two people doing. There are Big Name consultants everywhere. Direct vendor support, often flown in from the US, which is otherwise rare around here. Despite all these people, money, and support, nothing works. Nothing. It's all broken. Everything. Every part. It's a sight to behold. I wrote a report for them about a key security system where I pointed out that out of something like 50 settings, 47 were incorrectly configured. The only reason it "worked" is because the errors cancelled out. That is, it was incorrectly rejecting valid access, but another error meant that the rejection was being ignored. And so on. Similarly, their core authentication system was supposed to be distributed and highly available, but the main architect put all of the servers into one rack, one on top of another. He said with a straight face that a product that is well known in the industry for its efficient wide-scale replication is "bad at replication" and only works if the "network cables are really short". He meant 30cm, not 3000km. A power outage took out all three "redundant" controllers, and so something like 80K staff spent several days staring at login prompts on their monitors for a few days. I could go on, and on, and on. I have a whole collection of stories like that. The most amazing part is that I was only there for a couple of months, yet this short time period yielded 8 of my top 10 horror stories from the field. It's also the only workplace setting where I had ever seen a man cry. For work related reasons. Several men, on several occasions.

vehementi 4y ago
How does corruption like this go unpunished?

jkahn 4y ago

Really, this article is just a whinge. I'm an Australian. MyGov is fine, I interact with it as a citizen regularly. Government needs to outsource implementation of this kind of stuff because it's extremely hard to build software teams and manage their performance in permanent government roles. And those costs are reasonable - particularly for anyone that builds teams of software engineers and knows what aggregate team costs are like in Australia. The hard part of the MyGov platform is the inter-department stuff, and I don't think that's a software issue, that's bureaucracy. MyGov isn't perfect, but it's fine.

mrmincent 4y ago
Agreed, I’ve linked several services over the years and it all works when I need it. I can’t imagine the struggle it would’ve been to get all the various ancient systems and bureaucracies working together
tallytarik 4y ago
> MyGov isn't perfect, but it's fine. Sure. But then why have they spent tens of millions of dollars trying to build a new version - https://beta.my.gov.au https://beta.my.gov.au - that works the same or worse?
- dryanau 4y ago
  I switched to beta a month or so and I can't even tell what the difference is, other than it being slightly shinier. MyGov just seems like a portal containing bookmarks to various other services anyway, right? It consolidates your records for Medicare, ATO, and if applicable, NDIS, Centrelink etc. Seems kind of basic. Although I understand there's a lot of hidden complexity underneath these things, especially surrounding ID verification. But even so, I couldn't tell you the difference between the old mygov and the beta version.
  - bigDinosaur 4y ago
    That's part of the problem noted in the article: they haven't even implemented style changes that they could have - why are simple changes taking so long?

n-e-w 4y ago

Are we just going to ignore the equally ludicrous amounts being paid under these contracts??

throwaway-aogS8 4y ago

Throwaway for obvious reasons. While I didn't work directly on myGov, I knew quite a few people on the team that did (at all levels) and had a fair number of depressing pub sessions with them lamenting the entire project. This article doesn't say much that the people working on it weren't saying throughout the entire delivery. I'm not going to defend the ludicrous cost of the project; we all know that outsourcing to private consultants to save money is a neoliberal pipe-dream up there with "trickle-down" economics. Many of the contractors for government agencies are former public sector workers who have been driven out by the laughably uncompetitive wages and the government's hostile attitude towards the APS. And can you blame someone for leaving a job where they aren't supported and are mocked by the governing party in the media, when they can do essentially the same job with less bureaucratic oversight and twice the pay as a consultant or contractor? Why would they stay? A sense of civic duty? That's called "being a gullible c*nt" here in Australia. The article even points this out: > "Agencies are somewhat compromised by no longer having lots of these skills in-house." No shit. Who knew systematically de-funding your own public service meant it would lose efficacy? Starve the beast[1] is a toxic political strategy that never should have made it across the pacific. So that's why myGov is expensive; we're paying to support an entire ecosystem of middlemen. But if you want to know why it's a shit-show these quotes from the article point to (imo) the biggest cause: > Responsibility for the "enhancement" of myGov was transferred from the DTA (Digital Transformation Agency) to Services Australia (formerly Department of Human Services/Department of Social Security) in late 2020 > "Individual agencies continue to do their own thing [...]" MyGov was meant to integrate government services, but none of the agencies would actually expose a single endpoint for the myGov team to integrate. Months and months were spent just trying to get agencies to accept that for an integrated platform to work they would need to support a common authentication system. Doesn't leave much to do except polish the UI, does it? This quote from the article literally made me laugh out loud: > "What's so hard about making these improvements? I don't understand why it has taken that long and cost so much money to do that." > The main goal of myGov was to integrate a range of government services from different departments seamlessly on the one platform. But the new beta version of the platform still doesn't do that effectively The problem wasn't technical, it was institutional. The Australian tax payer just spent millions of dollars hiring consultants to try and herd cats. They weren't outsourcing for developers as much as they were outsourcing for mediators. The DTA was meant to be the solution to digital integration of government agencies in Australia by setting up an internal government digital agency. But the large entrenched agencies (such as Services Australia) had no real incentive to listen to a word it said and every incentive to resist relinquishing control to it. The agency is for all intents-and-purposes now dead. It's only remaining responsibilities are "advisory". Even the official design system inspired by the highly praised GOV.UK one was decommissioned practically before it got off the ground [2] The myGov and DTA story isn't some simplistic private vs public sector issue. This is a fundamental culture issue within Australia (and it seems the whole anglosphere at the moment). No one is happy except the ministers and executives rorting record amounts of cash out of the system. [1] https://en.wikipedia.org/wiki/Starve_the_beast https://en.wikipedia.org/wiki/Starve_the_beast [2] https://designsystem.gov.au/ https://designsystem.gov.au/

3np 4y ago

As a complete outsider, half of the whole article reads like an Onion piece.

WatchDog 4y ago

The main thing I use mygov for is doing my tax, and it works fine. Given all the complaints I see here about the lack of a US government online tax app, we seem to be doing better in that regard, although I imagine the US tax landscape is much more complex.

fphhotchips 4y ago

Season 3, Episode 3 of Utopia dealt with myGov perfectly. It's like the writers were actually in implementation meetings. If you've never worked in or with government in Australia, I highly recommend checking it out. Then remember that the real thing is worse.

cube00 4y ago
Internationally it's on Netflix but named "Dreamland" [1] [1] https://en.wikipedia.org/wiki/Utopia_(Australian_TV_series) https://en.wikipedia.org/wiki/Utopia_(Australian_TV_series)
pabfusdhd 4y ago
Was working at DTA at the time on the digital identity work and the episode was painfully close to the bone.

tonfreed 4y ago

Part of the problem is that there's no real negative feedback in a government project. I've been attached to government work in the past, and the whims of the PMs change day to day because the people there were often just promoted to get them out of the way of another team. There's no real leadership or technical ownership of the product, and I've found that the PMs will often just quickly blame the user for not using the software correctly rather than actually reflecting on why they may be getting that feedback. The consultants may have fucked up, but they were only able to because the people in charge fucked up first.

sebast_bake 4y ago

Australian here, I think the comments here overstate how bad MyGov is. I'm in my mid 20's, and I have literally never had to call any federal government organisation, visit any service centre or post any forms. For my entire adult life, all of my interactions with federal services have been through MyGov. This includes taxes, welfare, healthcare and education... I can only imagine how colossal the undertaking must have been. MyGov ties together our largest, most bureaucratic organisations. Imagine being tasked with such an project, building the web application is the easy part, you also need to convince a country's largest organisations to change how they operate. Considering this, I'm actually surprised how good MyGov is.

unlikelymordant 4y ago
Im in the same boat, except Im older, but i agree with everything youve said.
systoll 4y ago
This seems to be mostly talking about the 'new' mygov. The new goal was to provide a unified front – users would navigate through MyGov based on their needs and goals and be sent directly to the relevant forms and info from all departments. EG – instead of going to Centrelink and seeing only JobSeeker, or going to the ATO and seeing only JobKeeper; you’d go to 'COVID relief payments' and see a clear explanation of both, and you’d be able to apply for either one directly. But in the beta… it’s basically just Centrelink. In the entire 'Health' section, the only medicare service mentioned is the proof of COVID-19 vaccination. The end result is that https://beta.my.gov.au/en/myaccount/dashboard/ https://beta.my.gov.au/en/myaccount/dashboard/ is basically the old mygov, and the rest of the site is a mirror of https://servicesaustralia.gov.au https://servicesaustralia.gov.au .
kdtsh 4y ago
I don’t want to make assumptions about how you use the services in MyGov, but the experience of my family and friends has been that, if you require any service which is at all out-of-the-ordinary or needs a pair of human eyes looking at it (whether or not it should - there are plenty of broken processes at Centrelink, some might say that’s by design) then you need to make a phone call, because the function to perform self-service is simply not there. I have also had fairly good experiences with MyGov - but my interactions with social services are fairly boring compared to the needs of many people. Edit: the problem here of course is that if you make a phone call you can expect to wait in a queue for many hours.

Trouble_007 4y ago

>Analysis of the Australian Tax Office's myGovID system< Thinking Cybersecurity – A/Prof. Vanessa Teague (ANU) : https://www.thinkingcybersecurity.com https://www.thinkingcybersecurity.com blogs and code on github : https://github.com/vteague https://github.com/vteague Twitter @VTeagueAus

joeman1000 4y ago

I set up my fathers ‘vaccination pass’ a few months ago. I had to link about 4 different services together, prove his identity twice, confirm email multiple times, navigate through the chain of services trying to talk to each other… I’m used to complexity as an engineer and it took me 20 minutes of headscratching to get it working. Insanity

simonw 4y ago

Has paying Accenture, Deloitte and IBM tens of millions of dollars ever worked for anyone?

stephen_g 4y ago
No, never. But we'll try again and next time surely it'll work!
diordiderot 4y ago
It's worked for Accenture, Deloitte and IBM

somada141 4y ago

I honestly feel that whoever complains about MyGov never had to perform these bureaucratic operations in a country like Greece. The fact that one can interact with some of the biggest and slowest-moving agencies in the Australian government from the comfort of their home was mind-blowing to me when living in Aus. Maybe having to queue up for 3h in the cold to be greeted by a grouchy underpaid public servant that would have you queue up again next week (the Greek experience) until you have to call some person you know to do basic things like renewing your passport has lowered the bar too much for me. Let’s not forget software is hard in the best of environments and archaic governmental offices and processes aren’t exactly conducive to development velocity and quality

nmfisher 4y ago
At the same time, it's easy to think Australia's doing a good job if you've never experienced well-run government services (like Singapore). What's more, Australia's online services have somehow managed to get worse every year since around 2010. Last I checked, there's still no way for me to lodge a corporate tax return electronically, it needs to be via paper or an agent. SASIC failed to notify me - by either physical mail or e-mail - that an annual fee was due, slugged me with a late penalty, then refused to reverse it when I complained and showed that their own online system had no trace of an invoice. MyGovID (or whatever its latest incarnation is) literally took an hour to validate a passport scan. My mother just returned from overseas and was required to download an (Android/iOS only) app, create an account and fill out a whole range of personal details simply for a health declaration. It truly feels like public service management keep handing blank cheques to (probably Big 4) 'digital transformation consultants' to charge millions for project after shitty half-baked project, with no regard for whether actual improvements are being made.

thrixton 4y ago

Personally, as an Aussie, I don't have any massive gripes with MyGov specifically. Bear in mind that it's mainly (only?) a portal to other departments (ATO, Centrelink, Medicare?). I don't actually see why we're bothering to "upgrade" it at all, the mention of not being able to deploy a styling change, who gives a toss honestly, styling is way down my list for something like this. When I had to get a MyGov ID for my son, it did the facial recognition off his passport (no idea if it would have allowed someone else...) fine, set it all up just fine in Covid lockdown so that's a +. My main gripe is that unless you want their crappy app installed, the only MFA option is SMS, which as this audience knows is just not secure.

ahonhn 4y ago
As an Aussie who has lived overseas for decades even the SMS option is not available to me as it requires you to have an Australian phone number. You can't install the myGov Code Generator app without an Australian phone number either. I haven't tried the myGovId app, which seems the best bet, as I'm scared it will fail and block what access I have to myGov now. Also, for a long time the only way to change your myGov email was to set up a new myGov account. Ditto if you had the Code Generator app and lost your phone - though with the myGovId app you now have another avenue for recovery - provided of course that it doesn't crash, accepts your scanned documents and you actually have enough such documents to keep it happy.
- PickledHotdog 4y ago
  Haven't tried this myself, but perhaps it might work overseas? https://github.com/abrasive/mygov-totp-enroll https://github.com/abrasive/mygov-totp-enroll

n8ta 4y ago

"four-company panel was established to continue works on it, featuring Deloitte, Accenture, IBM and Arq Group." "We’re supposed to be adopting an agile development methodology" Ah yes the classic agile setup 2 week sprints where at the end of each sprint you rotate companies.

aemreunal 4y ago

Turkey actually has a very good online portal [1] for a lot of interactions for the government. Anything from obtaining official letters to checking statuses of court causes, etc. can be done over it. Pretty decent iOS app too. Credit where credit is due. Wish the US had as decent of an online portal to all governmental things. [1]: www.turkiye.gov.tr

SulphurCrested 4y ago

The 2FA the site supports is either SMS or time-based token. According to them SMS doesn't work outside Australia, and having access to the site might be useful outside the country, so the time-based token seems the better choice. Except they apparently decided that the standard TOTP apps like Google Authenticator weren't good enough for them. Moah bits better, or some such. Anyway, although it is a time-based token it isn't that time-based token and you have to install their app. OK, we'll do that then. Carefully navigating past the almost identically named app with a similar icon that is for proving your identity to them, and trying not to think about all the user reviews saying myGov Code Generator doesn't work, we get it on our iPhone. Now, it doesn't work like any other TOTP app and read a QR code or have you enter a number. Instead, you have to enter your username and password into the app. [1] At this point, for me it just hung with a white screen. Exactly the same behaviour is described in the top listed review, from 2020, in the App Store, with no response from the developer [2]. This was a little scary: am I now locked out of my account? They won't help you get back in; you have to create a new one. They also have you create a backup 2FA method (SMS) after you've logged in with the time-based token. This would be a little late if you got locked out after something went wrong on your first outing with the Code Generator app. The linked video seems to have been improved since I tangled with the app. I don't remember at the time knowing it was possible to have both the SMS and app enabled for 2FA. It seems it's still not possible to have two apps enabled, on two different phones, for example to replace your phone. Bear in mind that there are residences in Australia with no mobile reception at all. No doubt they had meetings in which they congratulated each other in devising a time-based one-time password scheme which is theoretically more secure than the usual TOTP. Never mind that both are adequate for the job, and the alternative is SMS. I wouldn't be surprised if someone got a conference paper out of it. I guess if the system is actually built by someone else, you can only get promotion and a pay rise by adding knobs to the specification. If the incentives valued robustness, they would have simply used the standard TOTP. I think the biggest failing is that this problem has been all over social media, and is mentioned in the App Store reviews, but nothing has been addressed. According to the revision history at the App Store, it last got bug fixes in December 2017, with only edits to help text since then. The developers were nowhere to be seen in the Whirlpool thread or at the App Store. In my opinion this crosses the line from incompetence to misconduct. [1] https://www.youtube.com/watch?v=m-gf448FDFA https://www.youtube.com/watch?v=m-gf448FDFA [2] https://apps.apple.com/au/app/mygov-code-generator/id1305497801 https://apps.apple.com/au/app/mygov-code-generator/id1305497...