UK Government's Payment Infrastructure Is Now Open Source
govukpay-docs.cloudapps.digital
govukpay-docs.cloudapps.digital
I do not feel that reporting every online interaction I have with my government in the UK, back to a huge corporate in the US, is in any way appropriate. But I can't even get anyone to engage on the issue.
When I tried to raise it I got directed to a helpdesk ticket on a site run by an SV helpdesk-as-a-service company.
I appreciate that gov.uk have done some great stuff getting the UK government online, and their designs and Open Source attitude are refreshing, but this is a a serious privacy issue.
For what it’s worth, for extremely sensitive projects like GOV.UK Verify other options are fine; Verify uses a local Piwik instance.
You’re also welcome to block that specific JS or just turn off JS completely on GOV.UK properties - everything has to work without JS to go live on GOV.UK.[2]
[1] https://support.google.com/analytics/answer/2763052?hl=en
[2] https://www.gov.uk/service-manual/technology/using-progressi...
https://www.theguardian.com/politics/2010/may/27/theresa-may...
Does it prevent US government from getting this data with a court order?
Even if they could, they wouldn't be able to find it.
Furthermore, it is often possible to de-anonymize data especially if you have an extensive knowledge of users and their data such as google. But even then, you can also de-anonymize data
https://www.cs.utexas.edu/~shmat/shmat_oak08netflix.pdf
https://www.wired.com/2007/12/why-anonymous-data-sometimes-i...
When a customer of Analytics requests IP address anonymization, Analytics anonymizes the address as soon as technically feasible at the earliest possible stage of the collection network. The IP anonymization feature in Analytics sets the last octet of IPv4 user IP addresses and the last 80 bits of IPv6 addresses to zeros in memory shortly after being sent to the Analytics Collection Network. The full IP address is never written to disk in this case.
It's not about you trusting somebody to handle the data. It's just that the data should not exist at all outside of you and the gov.
As soon as the data exists somewhere else, there is a way to misuse it and a chance it will happen. In todays word, those don't even require a lot of imagination to find because it already happened and is currently happening.
Of course not. Also it does not prevent governments and other organizations from illegally extracting that data from Google, as it happened.
This kind of stuff should be opt-in for users, but Google know that hardly anyone would want to be tracked by them if they were given a clear choice.
I very reluctantly tried to use it as I don't want to give all my data to any of the companies you listed, and yet it failed to identify me using the two companies I was allowed to pick.
I really don't see how it's acceptable to force users to give so much personal data to a handful of randomly selected private companies, on the off-chance that they already have it.
The concerning part was what happened when I tried to cancel the process. The companies told me that they would delete all the data I had submitted to them, but when I tried again a year later, I was invited to resume my application, and all my data was still in their systems!
[edit] Just tried to go through the process again to see if anything has changed. I picked Royal Mail as an identity provider but was unable to finish because I had to upload a scan of a phone contract, which I don't have since I use pay as you go! Bloody waste of time!
Impossible over the phone as they wanted to send a paper letter to my address and I was just moving to a new place (and doing some travel before that) so I had no more access to the address HMRC had on file.
I finally gave up and just asked my accountant to do it on my behalf. He somehow managed to sort this out with HMRC.
There is no flow to recover your username and password (or generate new one) with your email address which is maddening.
[1] "HMRC rejects Gov.uk Verify", http://www.computerweekly.com/news/450412927/HMRC-rejects-Go... [2] http://www.computerweekly.com/news/450301278/Revealed-The-ba...
And we all know that means it's safe forever, and isn't in any sort of jeopardy the moment it crosses a border, or in fact the moment it escapes to a third party at all.
It's all industry standard so it must be fine!
>> For what it’s worth, for extremely sensitive projects like GOV.UK Verify other options are fine; Verify uses a local Piwik instance.
Then gov.uk should use a local Piwik instance for everything, GDS are clearly not incapable of it.
FYI I can and do block google analytics JS. It shouldn't be there in the first place, I shouldn't have to block it when interacting with my own government.
Privacy is opt-in, not opt-out.
What's the penalty for completely disregarding that?
Is it anywhere near large enough to justify them not disregarding it?
More to the point: Pretty much the only thing a contract can do is impose a monetary penalty. Even if it's quite large, it's still only money, and Google rakes in money by the bushel basket from selling data to advertisers. Therefore, it isn't a very convincing penalty.
Is it in the public view? How many Daily Mail headlines about Google Analytics have you read ever?
They hold the coroner's letters to prevent future deaths, but the search is not useful.
It would be good if I could search and return every letter about eg deaths by suicide or railway deaths or etc.
It seems a shame to have all these reports to prevent future death locked away.
https://www.payments.service.gov.uk/
That's the actual service and it includes GA, or at least it did earlier.
However the "business logic" of gov.uk is still sorely lacking. For the actual visa application process and payment, I was bounced around between 4-5 different third party websites handling different aspects of the process. I'm sure further integration with gov.uk is on the roadmap, and it will certainly be nice.
As a new resident of the U.K., though, I have to admit I've been pleasantly surprised and very happy with the gov.uk website so far.
Canada had plans to integrate all citizen services through one account dashboard, curious to see how countries roll-out services like those in next decade or so.
There is actually a legal requirement for banks to offer no-credit no-fee accounts, in order to help people get into the banking system and take advantage of the associated discounts, but obviously they don't advertise it much.
Proof of address used to be easy as any utility bill would do, but now days it's trickier because so much is done online and paper bills don't get sent out much any more! And, of course, it's a problem if the bills at your house are in someone else's name. (They won't accept print outs from the Internet for obvious reasons...)
However, if you're registered for paying tax in the UK then you would certainly have a letter from Jobcentre Plus or HMRC showing your address. This would be accepted by your bank.
Another option is to get a UK driver's license, which is pretty easy and inexpensive if you already have a driver's license from your (EU) home country.
I had a similar issue when I was opening a bank account a while ago. I didn't actually get any bills in the mail, so I printed off my ISP bill, which was a pdf of what they send you in the mail. Obviously, the printer didn't fold it to fit in an envelope.
The person at the bank asked if it was a printout or actually from the mail since it didn't have any creases in it, they said they could only accept it if it was from the mail.
I told them I would just walk outside, fold it up, and walk back in, it was exactly the same as what you'd get in the mail. They ended up accepting it, even though technically they weren't meant to.
It's ridiculous, I don't actually physically receive mail from anything. All my bills etc. are done electronically, I even sign contracts electronically.
Just rechecked it's still complete crap. They can't support the back button, no post / redirect pattern, confirm form resubmission. https://passportapplication.service.gov.uk/
I think it's made that way so that it works without Javascript.
http://www.manxradio.com/news/isle-of-man-business/micard-de...