Hacker News Reader

Comment by pdabbadabba | Hacker News Reader

This appears valuable and well executed, but I worry that private businesses will be eager to outsource their authentication to this service, if they are allowed to. And once it's fully stood up, I suspect the government would be all too eager to oblige.

This might be convenient, but might also mark the beginning of a major new point of U.S. government control over the Internet, with all the surveillance and other civil liberties issues that this might raise, to say nothing of the issues that could arise from this degree of centralization.

Now seems like the time to set the expectation that this service may not ever be used by private websites. Of course, we tried that with Social Security numbers too, for all the good it did us. http://www.nytimes.com/1998/07/26/weekinreview/the-nation-no...

View on HN

Given the alternative of handing out my SSN and hoping for the best, I'd be more than happy to use this for banking and related services. Presumably, third-party use would be covered by some form of ToS, and maybe we'd see actual repercussions for leaking data that originated here.

Repercussions? For the OPM hack, I got a form letter and a year (I think, I didn't use it) of credit monitoring. That was some of my most intimate information. That was a huge invasion of my privacy. I didn't even get a phone call. I didn't even get a sincere apology.

Just as an FYI, I think they extended the period to 10 years. I agree that it was handled poorly!

I froze my credit. I am in a position where I don't need credit and can get credit by virtue of assets if I did need to. I was, for lack of a better phrase, pretty pissed off. I got a form letter and something about credit monitoring in one of those weird security envelopes, as I recall.

Ten years? Yeah, that'll help. I pretty much admitted to everything I'd ever done, on those forms. It wasn't just me impacted, it had names of my friends and family. Then, I'm guessing it had all the notes I didn't see, from things like the interviews.

I don't have any real enemies, or any reason to be afraid, but that makes me no less angry and feel no less violated. Meh... I try to let the anger go, so it only pops up when I discuss it. There's nothing I can do to change it. I do consider it the greatest violation of trust ever enacted on me by the government. There was no reason for me to even be in the system any more, I am retired.

[redacted]

Oh well... If you can get away with it, freeze your credit. This does, curiously, impact your credit score. The peace of mind is worth it. Sorry for the novella.

Even if you're not concerned that the government might get a list of all the sites you log into, what about arbitrary login revocation? Suddenly someone gets a brain fart and decides that everyone on the terrorist watch list shouldn't be able to use this service? Now you're locked out of all the accounts you used this for, even if you're not a "bad guy".

This is why I don't use "log in with google" or log in with Facebook" -- I don't think those companies are evil (I use them both) but I can't afford for them to accidentally or absentmindedly deny me access to other services.

With the government you have free speech rights, so you can sue them if they close your account. With private companies you have no free speech rights and they can close your account whenever they want.

So account closure seems like a positive point of government-controlled login.

Look up the secrecy and lack of oversight over the so-called "terrorist" watchlist and the calls for scope creep, and see if you are so confident about those first amendment rights. I'm sure failure to log in would not be considered a first amendment right.

I agree that the government should be a far more dependable provider than any private sector organization. But the recent (last 20 years) enthusiasm for scope creep has not been encouraging.

Does the government deny passports or driver licenses/IDs to people on those lists? Because that would be the equivalent here.

I'm not saying the government wouldn't do it. I'm saying you would have constitutional basis to sue, which you don't have for companies.

Some lawsuits against the no fly list have been successful. https://www.aclu.org/blog/national-security/victory-no-fly-l...

I'm not sure that it would be seen as equivalent here given the overall push away from net neutrality over the last decade. I could see many government officials making the (out-dated) argument that the internet is a non-essential service and you online profiles are not as critical as physical government-issues IDs.

Edit: Forgot this post was a couple days old, working through my HN backlog haha

Government action could let you sue under (say ) free speech protections.

You can't sue FB for account termination

This thread is the digital equivalent of why every attempt so far to set up a sane ID system in the US has floundered, leaving us stuck with the worst possible solution, SSNs.

Wouldn't it be entertaining if the SSN leak was just a really clever PR boost for the Trump administration?

I'm certainly entertaining conspiracy theory level ludicrousy, but it is entertaining.

The EquiFax thing would only be good PR for Trump's administration if they used it as an attempt to push through legislation that would prevent these kinds of things from happening in future - like a reasoned and functional (and minimum privilege) national identification service - while Alex Jones-types would normally be up in arms I think they would support it it Trump sold it as the system additionally to make it easy to identify illegal immigrants and members of the "alt-left".

In many countries (e.g. Denmark), this is already the case.

https://en.wikipedia.org/wiki/NemID

Netherlands has DigiD. Banks here are rolling out iDIN which can be used to authenticate elsewhere as well. Banks here have been using TOTP for ages for online banking, with a physical authenticator. Tho iDIN is more recent.

Belgium has eID.

But do these countries have the same laws, processes like the USA? If not, there's no point in mentioning some other country has it.

For example, in Norway you can see everyone's tax returns [0]. The caveat is that if you see someone else's tax return - the person will be notified. Now, if you just make tax returns public without the notification - it would be a different policy and not comparable to Norway. Therefore, comparisons/mentions should be complete and apt.

[0] https://www.theguardian.com/money/blog/2016/apr/11/when-it-c...

This is part of the reason why I see value in something like BlockOne ID (by Thomson-Reuters)[0].

I think it's a noble pursuit (what the US Digital Service is trying to do here[1]), making the internet easier and more accessible for people. For many people, involving themselves in the constant updates of what service is secure versus what service is not and "I have to sign up for a different email now to log in to the thing I used to log in to" is a nightmare -- and this isn't restricted to the elderly.

I think it's noble, because I really think it shouldn't be arcane. To a lot of people the nuances still are, unfortunately.

But a service that translates blockchain addresses into WWW accounts and back has some value, no? Couldn't it do a better job of this? I'd love to know if anybody has any more insight or thoughts. I haven't dug too deeply yet, but it keeps coming back to me. Perhaps BlockOne ID isn't the ultimate execution, but maybe one could be developed. Something that requires one sign up, and can be used as ubiquitously as you like.

---

[0] https://blockoneid.thomsonreuters.com/

[1] For instance, with Canadian Government services I require an account for every single service, often with different password and username requirements and age limits. I understand why, but for somebody who doesn't spend so much of their career(s) on and around and familiar with computers and how they work, it could be prohibitive.

> Now seems like the time to set the expectation that this service may not ever be used by private websites.

Wha-huh? Why? What specifically is wrong with login.gov (or any government agency) running an oauth server and private websites allowing users to authenticate with it? How does that result in "a major new point of U.S. government control over the Internet"?

It allows them to see what you log in to and thus what services you use, much like Facebook can often do as well. (Although luckily I haven't seen that as the only option anywhere yet - that might not be the case for a system that everyone in one's target audience might be forced to use.)

I'm pretty certain they can already do that though.

How?

Through all the drag net surveillance the NSA performs and using tools like those unveiled by Snowden and other whistleblowers.

> Now seems like the time to set the expectation that this service may not ever be used by private websites.

Oh shit! The government knows I bought something from custom-fishing-lures.com! Ruuuuun!

Seriously, what you just listed is a reason not to use the government's Oauth for every website and ban all other implementations. What OP seemed to say, and what I disputed, is the idea that this service should not ever be used by any private website even as one of several options.

Don't ever trust anyone who takes your stuff at the threat of violence.

This is the basis for the "taxation is theft" argument. It's very weak and wry.

The state exists as the means for ensuring positive societal outcomes, such as providing services that the private competitive market cannot or will not supply (tragedy of the commons, game theory, etc). One such possible service is an identity service - and we already have that through a hodge-podge of things like SSN, driving licenses, passports, etc. A consolidation of these services means greater efficiency, less waste, and therefore lower taxes.

I'd respect the libertarian position more if it were framed as "greater utility of government" instead of the dogmatic "less government".

>The state exists as the means for ensuring positive societal outcomes

This is the moral basis for outcomes like, snuffing out a person for selling loose cigarettes. In the end, the privileged get away with infractions that hurt people en masse, and the disposessed get punished for offending the sensibilities of those who get to define "positivity" on behalf of society.

I'd respect the state position more if there were well defined metrics for "greater utility" and a stronger non self regulating mechanism for accountability, instead of the dogmatic principle that voting constitutes consent.

Yeah, they know you were browsing custom-fishing-lures.com on your phone just before those girls were strangled with fishing line one block away. The guy who did it wasn't using his imperial login at the time, so you're the only suspect at the moment. As long as you have a good alibi, they won't be able to hold you more than 72 hours and you should be able to get your job back.

> As long as you have a good alibi, they won't be able to hold you more than 72 hours and you should be able to get your job back.

The US does not have legally-mandated job-protected leave for pre-trial detention, people have been terminated (for cause, and so not eligible for unemployment, either) for missing one day of work due to an arrest for which no charges were ever filed.

Thanks, yes, it was the uncertainty about getting the job back that I was hinting at with "should".

BTW in case anyone thinks it was a ridiculously contrived example, I was just trying to illustrate that what one person thinks is totally innocuous can appear damning to someone else.

Tinder is Facebook-only, last I checked

It allows email now

What happens when important websites start requiring login.gov, and then the government shuts down your account? Can't just sign up for a new one, can you?

Er, why not? Why would the government shut down the account you use to identify yourself, if not because there was something wrong with it, in which case presumably they'd want you to create a new one?

I dunno, maybe one day a government-official-inspired muslim-phobia arises, and the government cuts off your access because you look like a middle-eastern man? Or maybe another flavor of the many instances of government minority-targeting we've seen in the past?

The government does shady stuff all the time. It's unwise to give them such an easy kill-switch that cuts off any particular citizen's access at any time.

I think whenever someone asks a "why would they?" question, it's best reworded as "why wouldn't they?"

The government is made up of people, and given enough people, at least one is bound to do something stupid for reasons most won't understand. If someone can do something, no matter how ridiculous, at some point, someone will.

Better yet. What if the government shuts off a web site's ability to utilize login.gov and effectively destroys the entire site by wiping out its userbase (in a scenario where a site is heavily using login.gov for authentication).

That's a far greater threat than that they might shut off any given person's access.

Step 1) regulate all speech by vaguely defined hate speech laws, which change based on who has power

Step 2) Start arbitrarily destroying sites based on who is in power, utilizing login.gov + speech controls, to deem a given site in violation of speech codes

> What happens when important websites start requiring login.gov, and then the government shuts down your account?

Or, more plausibly, selectively refuses to authenticate you to certain classes of sites, whether “all non-government sites” or something more targeted.

It's bad enough when sites require you to use Facebook to log in. At least Facebook can't send you to jail and you can have (with some effort) a pseudonymous Facebook account.

Sites will use such a service to invade your privacy even further, and the government has a record of every site you've logged into and when.

> Sites will use such a service to invade your privacy even further,

That's not how OAuth works. https://en.wikipedia.org/wiki/OAuth

> the government has a record of every site you've logged into

Only the ones where you chose to use their service. Or are we imaginging a future where this service has been made mandatory, and logins and passwords have been abolished?

Honestly, the amount of FUD in this thread is absurd. The government already has an enormous amount of information about your online activity! If they want more, their strategy will probably not be writing open source software and hoping you opt in to it!

I know very well how oauth works, thanks, but I'm not sure why you thought that had anything to do with my comment. The invasion of privacy comes from websites insisting on knowing who I am and refusing to allow me to make anonymous/pseudonymous accounts. If there's a convenient API to do so provided by the government, that's bad for users.

> Only the ones where you chose to use their service.

There are hundreds of websites that require you to use Facebook to log in. With government-sanctioned ID, it will be worse.

> Or are we imaginging a future where this service has been made mandatory, and logins and passwords have been abolished?

This already exists in several countries, including Korea. https://en.m.wikipedia.org/wiki/Resident_registration_number

Hopefully this serves as an indicator that your skepticism on this topic is wildly miscalibrated. There's no "imagination" involved, this is how it is right now in places where this exists.

> their strategy will probably not be writing open source software and hoping you opt in to it!

That is the exact strategy I would use if my goal was to help the government gain more control over the internet. Letting people give their freedom away in exchange for a bit of convenience is one of the oldest tricks in the book.

> your skepticism on this topic is wildly miscalibrated

The reason I'm not worried about the government finding out which websites I visit is because they already know, from traffic inspection at the ISP level. Don't think I'm the one miscalibrated here.

Beyond that, the problem with this "but they might do something bad!" argument is not that it's false, it's that it's always true in every case. Literally every government policy could be the precursor to something terrible. Sure, they could introduce an optional OAuth to try to stop identity theft and then later use it to censor the internet, but they could also just censor the internet straightaway.

Speak for yourself. It's non-trivial (in fact, very challenging) for the government to identify which websites I use. I don't have to put in much work to make this happen. If everyone started requiring the use of a dragnet surveillance program just to log in to services, it would become next to impossible to protect yourself.

> If everyone started requiring the use of a dragnet surveillance program just to log in to services, it would become next to impossible to protect yourself.

Yes, this is true. If all websites start requiring their visitors to do something their visitors overwhelmingly don't want, the result would be something their visitors don't want. Kind of suggests that they won't do that, yes?

We will probably have to agree to disagree here; you're imagining a world where oauth.fed.gov slowly becomes more and more widespread until it's ubiquitous and we have no other options, and that just doesn't sound realistic to me. (I think it would struggle for adoption even if it were implemented perfectly and had the best privacy controls possible, due to exactly the fears you're enumerating in this discussion) But we are talking about something hypothetical, so either of us could be right.

At any rate thanks for arguing forcefully but staying respectful and on topic!

Users generally hate Facebook login but sites use it anyway because it's good for advertising and lets them outsource fraud avoidance to Facebook. The same and more benefits (to sites, not users) apply to government provided auth.

Again, please look at what's happening in South Korea. I think you're vastly underestimating how likely businesses are to adopt such a thing and how likely the government is to gradually incentivize (and eventually force) businesses into using it.

The true point of imagining the login.gov will become the defacto standard for Oauth is the same reason why Tinder was Facebook login only. It's more secure and easier for people to use when they only have one login. The consolidation of most internet logins to login.gov gives the US government more power that it shouldn't have. All you need to do is look at Google. It's not necessarily an everyday appearance, but Twitter is full of accounts of Google revoking access to accounts with no warning, and no effective or efficient way to appeal.

With the help of all the awesome new crypto algorithms isn't it possible to create a protocol for authentication via a central server without disclosing to the central server where the login goes?

It's much easier to technically enforce that this doesn't get used with private sites than tell people not to use SSNs

This is an excellent point and highlights the brutal need people of all walks have for a better authentication paradigm.

> This appears valuable and well executed

How can you tell? You are looking at a PR piece that links to a web site that mentions 'security experts' in every other sentence. It's not proven to be valuable or well executed.

Reply on news.ycombinator.com