Comment by toomuchtodo | Hacker News Reader

Comment by toomuchtodo | Hacker News Reader

Parent Full thread

> I will eat my hat if this happens in that timeframe.

Login.gov (a product of USDS and 18F @ GSA) is positioned to meet these identity provider needs.

https://www.login.gov/help/get-started/authentication-option... (2FA support for all users + PIV/CAC support for Fed Gov workers)

https://developers.login.gov/ (developer resources)

Skepticism is warranted as 6 USC 1523: Federal cybersecurity requirements [1] has required a lot of what the EO is calling for for almost half a decade, but the tooling exists and 82 agency applications/systems (as of October 2020) are already leveraging this identity provider. Appropriations ($$$) for this identity integration work seems the challenge, as implementation is straightforward.

Sidenote: You can now login to your Social Security Administration account with Login.gov [2] (under "Other Sign In Options"). If you've applied for TSA Precheck or Global Entry, you've been using Login.gov for some time.

[1] https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim...

[2] https://secure.ssa.gov/RIL/SiView.action

(disclosure: no affiliation with any federal government agency or office, not a fed gov employee or contractor currently)

In particular Login.gov can do WebAuthn, so a vaguely recent Yubikey or other Security Key product, a modern iPhone, or the nicer Android phones with fingerprint readers, all work and deliver unphishable¹, zero correlation² authentication.

1) The Domain Name "login.gov" is inherently associated with these credentials, your Security Key hasn't the faintest idea how to use them on another site even if you yourself are completely fooled and believe you're on Login.gov

2) Even if the US government, your key manufacturer and Facebook conspire together to try to figure it out, there's no way to take their authentication data and correlate that Facebook user mikey-the-shoe is US Login.gov user Michael Shoemaker of New York based on the Security Key used on both sites. It seems like a good guess of course, but WebAuthn deliberately doesn't confirm this.

We really need to allocate more money to USDS. Seems like they've been saving our ass for a while and we're paying them on government employee scale?

The American Rescue Act act did boost CISA, GSA, and USDS funding [1]. Whether they can further push salaries beyond what they're already doing with tours of duty (short tenures allow for higher GS pay scale during assignments), I cannot speak to.

> The Cybersecurity and Infrastructure Security Agency will get $650 million for cybersecurity risk mitigation. The agency has been leading the federal government’s investigation into the SolarWinds hack that breached several federal agencies.

> Also included in the relief funding is $200 million for the U.S. Digital Service, a technology team based within the Executive Office of the President. The General Services Administration will receive two appropriations through the COVID Relief Act: $1 billion for the Technology Modernization Fund and $150 million for its Federal Citizen Services Fund. The citizen services fund enables public access and engagement with government programs through a variety of operational programs and public-facing products, and supports the implementation of emerging technologies in agency-facing programs.

[1] https://www.nextgov.com/cio-briefing/2021/03/covid-relief-bi...

How is it affiliated with TSA Precheck? I'm quite sure I've never directly used login.gov for anything related to my TSA Precheck, and I don't have a password associated with it either.

Interesting! It was my understanding that TSA Precheck was lumped in with Global Entry, NEXUS, and SENTRI, all of which make up DHS'/CBP's Trusted Traveler Programs [1] [2]. I have Global Entry, so have not used the TSA Precheck enrollment flow (I steer those who ask to Global Entry, as it's only $15 more over 5 years vs Precheck and gives you everything TSA Precheck does but also CBP expedited clearance benefits at the US border). I'll have to do more research, thanks for pointing this out.

Interestingly enough, the TSA Jobs portal does use Login.gov. [3]

[1] https://login.gov/help/specific-agencies/trusted-traveler-pr...

[2] https://ttp.dhs.gov/

[3] https://candidates.tsa.dhs.gov/s/

I applied for Global Entry in 2017ish, and at the time it didn't use login.gov. I renewed my passport and had to update my passport number in the system this year, and that was my first exposure to login.gov. So sometime between 2017 and 2021, they started using login.gov.

The process for establishing identity for login.gov was frighteningly easy. It required something like my Global Entry ID and my full name only, and then it automatically connected with other details about me.

This is good to know.

The takeaway for me is to go claim my login.gov ID (if possible) before someone else does.

Please report back, I’m always interested in feedback on how the product is performing from a user experience perspective. Also recommend trying to login to your social security account with it, as it’ll take you through an identity proofing flow where a government ID (which you’ll provide photos of front and back) is used for proofing.

Reply on news.ycombinator.com