4 ms·

> In other news, I’ve discovered a new level of this hell. Because I used Facebook as a login service for my account with the DMV I am now unable to pay my vehi

> In other news, I’ve discovered a new level of this hell. Because I used Facebook as a login service for my account with the DMV I am now unable to pay my vehicle taxes nor renew my registration/tags online. It's ironic that Jeff Atwood phrased OpenID/third party logins as an internet driver's license. 10 years later, we've learned the pitfalls of such a system, namely that your login is at the mercy of organizations without customer support, and they can turn you off for no personally attributable reason. https://blog.codinghorror.com/your-internet-drivers-license/ https://blog.codinghorror.com/your-internet-drivers-license/

koolba 4y ago
It’s not as bad if you control the domain as you could always setup a new provider. Note that I didn’t say “own” as the risk of the domain being seized will always be present. All in all, it’s no different than delegating to your email provider to prove your identity via a password reset / login link.
- orangepurple 4y ago
  At least there is legal remedy for domain seizure
- marcosdumay 4y ago
  Hum... Or maybe we should have the government arrange the logins for public services, since it's already in charge of tracking your identity and already has the procedures for it. But well, that may be too radical an idea to be executed. I'm sure privatizing logins is the way to go.
  - darreninthenet 4y ago
    IIRC they have this in South Korea..?
    - codetrotter 4y ago
      In Norway we have MinID. > MinID provides access to online public services at a substantial level of security (level 3). https://eid.difi.no/en/minid https://eid.difi.no/en/minid > MinID is issued by the Directorate of Digitization and can be ordered from the year you turn 13. https://minid.no/en/about-minid/ https://minid.no/en/about-minid/ There is also BankID which we can use in order to log in to all public services. > BankID is an electronic credential for secure identification and signing on the web. https://www.bankid.no/en/private/ https://www.bankid.no/en/private/ > Work on developing BankID as a joint infrastructure started in 2000, and the first customers got BankID in 2004. In 2014, BankID Norway AS was established. In 2018 BankID merged with Vipps and BankAxept in order to improve product offering and prepare for competition against global tech firms. https://www.bankid.no/en/private/about-us/ https://www.bankid.no/en/private/about-us/ I have both MinID and BankID and I can use either of them for things like taxes and such. Statens Vegvesen, who are in charge of driver licenses and more, allow us to sign in with BankID and a couple of other methods, but not with MinID from what I can tell. Norge.no, which is a guide developed by the Norwegian Digitalisation Agency, has the following to say about MinID and BankID: > Electronic IDs are available at different security levels, and thus give access to slightly different types of services. > MinID is at a medium-high security level ("Significant"), and can be used for many public services, but not for health services at helsenorge.no, for example. > BankID, Buypass and Commfides, which can also be used for public services, are at the highest security level (“High”) and give access to all public services. https://www.norge.no/en/minid https://www.norge.no/en/minid
      - LinAGKar 4y ago
        But those aren't by the government, or at BankID isn't. It's a proprietary application from a private company, owned by the banks, which only works on certain operating systems. Estonia though has an electronic ID which uses X.509 certificates.
        codetrotter 4y ago
        > those aren't by the government, or at BankID isn't MinID is by the government. BankID is private. > It's a proprietary application from a private company, owned by the banks, which only works on certain operating systems If you want to use the BankID app to generate codes then you will need iOS or Android. But you don't need the BankID app to use BankID. Instead of using the BankID app, you can use a physical dongle to generate codes. The device that you sign in with needs nothing other than Internet and a modern web browser. You can sign in with BankID on Linux or whichever other platform you desire. This device does not need to run any proprietary code aside from maybe some JavaScript executed by the browser. Very many years ago the device needed Java to sign in with BankID, but that has not been the case for many years.
  - ValentineC 4y ago
    Singapore has SingPass Login: https://api.singpass.gov.sg/library/login/developers/overview-at-a-glance https://api.singpass.gov.sg/library/login/developers/overvie...
  - trumbitta2 4y ago
    Italy has SPID https://www.agid.gov.it/en/platforms/spid https://www.agid.gov.it/en/platforms/spid
    - manuelmoreale 4y ago
      Which apparently they want to phase it out at some point because...Italy.
  - andrewnicolalde 4y ago
    The United States has https://login.gov/ https://login.gov/
forgotpwd16 4y ago
You can set up OpenID on your domain and then delegate authentication elsewhere or run your own authenticator. Basically similar to having email on your domain. Also Jeff mentions that this is about sites which don't have an impact on you. So you will use it for some forum but not banks nor anything your real life depends on.
nicoburns 4y ago
OpenID actually solved this problem by letting you use your own domain. Much like email it was possible to have this delegate to a 3rd party provider while retaining full control to seamlessly switch providors. Unfortunately OpenID never saw widespread adoption, and the OAuth based ID we're left with doesn't allow this. But yes, in 2023 you probably shouldn't use 3rd party authentication. You're much better off combining email/password login with a password manager, which effectively allows you push authentication on a 3rd party while retaining full control.
- sigmoid10 4y ago
  ...until someone breaks into LastPass and steals all vaults and you have to hope that your vault used the newer iteration settings. And those are just the cases we hear about because the attackers were careless. Cloud based password managers are simply an unimaginably attractive target for all kinds of threat actors, from individuals to groups all the way to nation states. I'd not be surprised if all the major ones already have backdoors installed - either on purpose with a gag order or even without the company's knowledge. Ironically, a simple text file on a well encrypted USB is probably one of the more secure ways to do this nowadays.
  - hn_go_brrrrr 4y ago
    You should use a local-storage password manager, like KeePass.
    - stinkytaco 4y ago
      I use KeePass, but keep the file in cloud storage because I need to log in from multiple places and it's a tradeoff I'm willing to make. I don't want to excuse bad security practices, but in the end I've decided I'm safer with good passwords + cloud storage than I am with possibly bad passwords because I need to retype them all the time. I feel like this is part of the reason we need real data protection laws in the US. There doesn't seem to be any downside for a company with lax security practices.
ciupicri 4y ago
Your forgetting that his baby - Stack Overflow - allows you to use multiple logins for the same account, so you wouldn't depend on say Facebook.
- pc86 4y ago
  One of my litmus tests for whether a technical team knows what the hell they're doing is what happens when you sign up for a service with one 3rd party auth (e.g. Facebook) then try to sign in with another one, e.g. Google, with the same email. Top tier is having the accounts seamlessly merged, ideally with a notification along those lines. My favorite was getting an error because I was using a different service, but not telling me what that service was, and it somehow broke the login such that I had to restart the browser to be able to sign in.
  - sk0g 4y ago
    The Epic Games launcher has a bizarre behaviour here. If you first sign in with your Xbox account, you can later sign in with the credentials of your Xbox account (email and password), as a 'native' account. I'm not sure what's shared, but that process made me uncomfortable. My hope is it's a password hash or they forward the sign in request to MS servers, but who knows.
  - account42 4y ago
    > Top tier is having the accounts seamlessly merged Uhm, not without requiring you to log in with the other auth as well - otherwise your account security is as weak as the weakest supported auth instead of the just weakest auth you added.
  - dns_snek 4y ago
    Disagree, I don't think accounts should be automatically merged under any circumstances. It's definitely not expected behavior for me as a user and as mentioned in a sibling comment, it would negatively affect security. If the service notices that an account with the same email already exists, you may ask me to login with the original provider again to link the accounts, and indeed, this would probably be my favorite solution. Second best would be to just create a second account without complaining. Playing fast and loose with authentication processes in the way you're describing is a guaranteed way to lose me as a customer if your service handles any valuable personal/confidential information. What if tomorrow a vulnerability is discovered where, say, Facebook provides the new unverified email address rather than the previous verified address during the OAuth login flow? It would immediately result in an arbitrary account takeover on your website. There are so many possible edge cases with this setup and the surface area increases with each new auth provider.
giancarlostoro 4y ago
I hate to be that guy but, can you not go to the DMV physically to do those things? Edit: I was not done reading and realized he addressed this.
- pc86 4y ago
  The very next sentence after the above quote: "Obviously I can do this in person, but who wants to GO to the DMV? Not I, that’s for sure."
  - RajT88 4y ago
    The DMV gets a bad rap, but if you can pick a time which is less busy (wed. afternoon, instead of Sat. morning), it's fine. Or - you can opportunistically pick a time when you drive by and there's no obvious line out the door.
    - giancarlostoro 4y ago
      The rep is so awful, when I got my drivers license, my mom drove me out to a town about 45 minutes away, just because it was quieter, but also I probably waited less despite driving out farther, but also the driving test was less stressful than being in a more populated area, it was insanely calm.
    - jcforbes 4y ago
      Because I travel for work a lot my time actually at my place of business is important and valuable. Taking time off during a day that I'm there is something I avoid, but in this case I had to and you are right. In went in the middle of the afternoon and there was minimal line. I even got done some other items that I'd been putting off for literal years because I don't ever take time off work.
ineptech 4y ago
Ironic, because the solution that no one wants to hear is an actual internet driver's license, i.e. government-run openid. There's no final recourse more final than going to a place and talking to a person, and no other organization is going to build and staff enough brick-and-mortar offices. One way of thinking about public vs private is, private companies are for cases where we care about efficiency more than fairness and government is for the opposite. Auth seems to have gotten to the "rural electrification" stage, where handling the corner cases fairly is more important than efficiency or innovation.

koolba 4y ago

It’s not as bad if you control the domain as you could always setup a new provider. Note that I didn’t say “own” as the risk of the domain being seized will always be present. All in all, it’s no different than delegating to your email provider to prove your identity via a password reset / login link.

orangepurple 4y ago
At least there is legal remedy for domain seizure
marcosdumay 4y ago
Hum... Or maybe we should have the government arrange the logins for public services, since it's already in charge of tracking your identity and already has the procedures for it. But well, that may be too radical an idea to be executed. I'm sure privatizing logins is the way to go.
- darreninthenet 4y ago
  IIRC they have this in South Korea..?
  - codetrotter 4y ago
    In Norway we have MinID. > MinID provides access to online public services at a substantial level of security (level 3). https://eid.difi.no/en/minid https://eid.difi.no/en/minid > MinID is issued by the Directorate of Digitization and can be ordered from the year you turn 13. https://minid.no/en/about-minid/ https://minid.no/en/about-minid/ There is also BankID which we can use in order to log in to all public services. > BankID is an electronic credential for secure identification and signing on the web. https://www.bankid.no/en/private/ https://www.bankid.no/en/private/ > Work on developing BankID as a joint infrastructure started in 2000, and the first customers got BankID in 2004. In 2014, BankID Norway AS was established. In 2018 BankID merged with Vipps and BankAxept in order to improve product offering and prepare for competition against global tech firms. https://www.bankid.no/en/private/about-us/ https://www.bankid.no/en/private/about-us/ I have both MinID and BankID and I can use either of them for things like taxes and such. Statens Vegvesen, who are in charge of driver licenses and more, allow us to sign in with BankID and a couple of other methods, but not with MinID from what I can tell. Norge.no, which is a guide developed by the Norwegian Digitalisation Agency, has the following to say about MinID and BankID: > Electronic IDs are available at different security levels, and thus give access to slightly different types of services. > MinID is at a medium-high security level ("Significant"), and can be used for many public services, but not for health services at helsenorge.no, for example. > BankID, Buypass and Commfides, which can also be used for public services, are at the highest security level (“High”) and give access to all public services. https://www.norge.no/en/minid https://www.norge.no/en/minid
    - LinAGKar 4y ago
      But those aren't by the government, or at BankID isn't. It's a proprietary application from a private company, owned by the banks, which only works on certain operating systems. Estonia though has an electronic ID which uses X.509 certificates.
      - codetrotter 4y ago
        > those aren't by the government, or at BankID isn't MinID is by the government. BankID is private. > It's a proprietary application from a private company, owned by the banks, which only works on certain operating systems If you want to use the BankID app to generate codes then you will need iOS or Android. But you don't need the BankID app to use BankID. Instead of using the BankID app, you can use a physical dongle to generate codes. The device that you sign in with needs nothing other than Internet and a modern web browser. You can sign in with BankID on Linux or whichever other platform you desire. This device does not need to run any proprietary code aside from maybe some JavaScript executed by the browser. Very many years ago the device needed Java to sign in with BankID, but that has not been the case for many years.
- ValentineC 4y ago
  Singapore has SingPass Login: https://api.singpass.gov.sg/library/login/developers/overview-at-a-glance https://api.singpass.gov.sg/library/login/developers/overvie...
- trumbitta2 4y ago
  Italy has SPID https://www.agid.gov.it/en/platforms/spid https://www.agid.gov.it/en/platforms/spid
  - manuelmoreale 4y ago
    Which apparently they want to phase it out at some point because...Italy.
- andrewnicolalde 4y ago
  The United States has https://login.gov/ https://login.gov/

forgotpwd16 4y ago

You can set up OpenID on your domain and then delegate authentication elsewhere or run your own authenticator. Basically similar to having email on your domain. Also Jeff mentions that this is about sites which don't have an impact on you. So you will use it for some forum but not banks nor anything your real life depends on.

nicoburns 4y ago

OpenID actually solved this problem by letting you use your own domain. Much like email it was possible to have this delegate to a 3rd party provider while retaining full control to seamlessly switch providors. Unfortunately OpenID never saw widespread adoption, and the OAuth based ID we're left with doesn't allow this. But yes, in 2023 you probably shouldn't use 3rd party authentication. You're much better off combining email/password login with a password manager, which effectively allows you push authentication on a 3rd party while retaining full control.

sigmoid10 4y ago
...until someone breaks into LastPass and steals all vaults and you have to hope that your vault used the newer iteration settings. And those are just the cases we hear about because the attackers were careless. Cloud based password managers are simply an unimaginably attractive target for all kinds of threat actors, from individuals to groups all the way to nation states. I'd not be surprised if all the major ones already have backdoors installed - either on purpose with a gag order or even without the company's knowledge. Ironically, a simple text file on a well encrypted USB is probably one of the more secure ways to do this nowadays.
- hn_go_brrrrr 4y ago
  You should use a local-storage password manager, like KeePass.
  - stinkytaco 4y ago
    I use KeePass, but keep the file in cloud storage because I need to log in from multiple places and it's a tradeoff I'm willing to make. I don't want to excuse bad security practices, but in the end I've decided I'm safer with good passwords + cloud storage than I am with possibly bad passwords because I need to retype them all the time. I feel like this is part of the reason we need real data protection laws in the US. There doesn't seem to be any downside for a company with lax security practices.

ciupicri 4y ago

Your forgetting that his baby - Stack Overflow - allows you to use multiple logins for the same account, so you wouldn't depend on say Facebook.

pc86 4y ago
One of my litmus tests for whether a technical team knows what the hell they're doing is what happens when you sign up for a service with one 3rd party auth (e.g. Facebook) then try to sign in with another one, e.g. Google, with the same email. Top tier is having the accounts seamlessly merged, ideally with a notification along those lines. My favorite was getting an error because I was using a different service, but not telling me what that service was, and it somehow broke the login such that I had to restart the browser to be able to sign in.
- sk0g 4y ago
  The Epic Games launcher has a bizarre behaviour here. If you first sign in with your Xbox account, you can later sign in with the credentials of your Xbox account (email and password), as a 'native' account. I'm not sure what's shared, but that process made me uncomfortable. My hope is it's a password hash or they forward the sign in request to MS servers, but who knows.
- account42 4y ago
  > Top tier is having the accounts seamlessly merged Uhm, not without requiring you to log in with the other auth as well - otherwise your account security is as weak as the weakest supported auth instead of the just weakest auth you added.
- dns_snek 4y ago
  Disagree, I don't think accounts should be automatically merged under any circumstances. It's definitely not expected behavior for me as a user and as mentioned in a sibling comment, it would negatively affect security. If the service notices that an account with the same email already exists, you may ask me to login with the original provider again to link the accounts, and indeed, this would probably be my favorite solution. Second best would be to just create a second account without complaining. Playing fast and loose with authentication processes in the way you're describing is a guaranteed way to lose me as a customer if your service handles any valuable personal/confidential information. What if tomorrow a vulnerability is discovered where, say, Facebook provides the new unverified email address rather than the previous verified address during the OAuth login flow? It would immediately result in an arbitrary account takeover on your website. There are so many possible edge cases with this setup and the surface area increases with each new auth provider.

giancarlostoro 4y ago

I hate to be that guy but, can you not go to the DMV physically to do those things? Edit: I was not done reading and realized he addressed this.

pc86 4y ago
The very next sentence after the above quote: "Obviously I can do this in person, but who wants to GO to the DMV? Not I, that’s for sure."
- RajT88 4y ago
  The DMV gets a bad rap, but if you can pick a time which is less busy (wed. afternoon, instead of Sat. morning), it's fine. Or - you can opportunistically pick a time when you drive by and there's no obvious line out the door.
  - giancarlostoro 4y ago
    The rep is so awful, when I got my drivers license, my mom drove me out to a town about 45 minutes away, just because it was quieter, but also I probably waited less despite driving out farther, but also the driving test was less stressful than being in a more populated area, it was insanely calm.
  - jcforbes 4y ago
    Because I travel for work a lot my time actually at my place of business is important and valuable. Taking time off during a day that I'm there is something I avoid, but in this case I had to and you are right. In went in the middle of the afternoon and there was minimal line. I even got done some other items that I'd been putting off for literal years because I don't ever take time off work.

ineptech 4y ago

Ironic, because the solution that no one wants to hear is an actual internet driver's license, i.e. government-run openid. There's no final recourse more final than going to a place and talking to a person, and no other organization is going to build and staff enough brick-and-mortar offices. One way of thinking about public vs private is, private companies are for cases where we care about efficiency more than fairness and government is for the opposite. Auth seems to have gotten to the "rural electrification" stage, where handling the corner cases fairly is more important than efficiency or innovation.