Hacker News Reader

Comment by theandrewbailey | Hacker News Reader

> In other news, I’ve discovered a new level of this hell. Because I used Facebook as a login service for my account with the DMV I am now unable to pay my vehicle taxes nor renew my registration/tags online.

It's ironic that Jeff Atwood phrased OpenID/third party logins as an internet driver's license. 10 years later, we've learned the pitfalls of such a system, namely that your login is at the mercy of organizations without customer support, and they can turn you off for no personally attributable reason.

https://blog.codinghorror.com/your-internet-drivers-license/

View on HN

OpenID actually solved this problem by letting you use your own domain. Much like email it was possible to have this delegate to a 3rd party provider while retaining full control to seamlessly switch providors. Unfortunately OpenID never saw widespread adoption, and the OAuth based ID we're left with doesn't allow this.

But yes, in 2023 you probably shouldn't use 3rd party authentication. You're much better off combining email/password login with a password manager, which effectively allows you push authentication on a 3rd party while retaining full control.

...until someone breaks into LastPass and steals all vaults and you have to hope that your vault used the newer iteration settings. And those are just the cases we hear about because the attackers were careless. Cloud based password managers are simply an unimaginably attractive target for all kinds of threat actors, from individuals to groups all the way to nation states. I'd not be surprised if all the major ones already have backdoors installed - either on purpose with a gag order or even without the company's knowledge. Ironically, a simple text file on a well encrypted USB is probably one of the more secure ways to do this nowadays.

Bitwarden (and the Rust clone Vaultwarden) are both 100% open source and self-hostable. Vaultwarden runs great on an old raspberry pi or any low power SBC. All of the convenience of Bitwarden clients/extensions/integrations but the same tiny attack surface (encrypted db on one local machine) as keepassXC or a text file.

If you know what you're doing, that is definitely an option. But self-hosting is not something I would recommend to the general public. I wouldn't even recommend it to the average person in IT to be honest. If the people at LastPass already manage to screw up the configuration so many times (and they really ought to know better than 99.99% of the population by now), then you can guess how safe it would be íf the average Joe sets something like that up.

You should use a local-storage password manager, like KeePass.

I use KeePass, but keep the file in cloud storage because I need to log in from multiple places and it's a tradeoff I'm willing to make. I don't want to excuse bad security practices, but in the end I've decided I'm safer with good passwords + cloud storage than I am with possibly bad passwords because I need to retype them all the time.

I feel like this is part of the reason we need real data protection laws in the US. There doesn't seem to be any downside for a company with lax security practices.

Same. keepass with the db on a cloud drive. keepass clients on both laptop and phone access the same cloud copy, and also each keep a local copy.

I intentionally don't let the clients integrate with the browser. I let the browser itself cache the unimportant stuff for convenience, and anything important I always paste from the password manager and have to get a code from the totp app also anyway.

I don't think anyone should use a fully 3rd party full featured password manager like lastpass or onepass.

I would say it is NOT better that they use that vs nothing. 'anything is better than nothing' is not true here. Some things are better than nothing, and some are not.

KeePassXC supports TOTPs out of the box and its browser integrations fill TOTP fields just like they do with password fields. I love that the browser integrations check logins by domain, and shows a popup when it finds one. Manually copying and pasting logins is susceptible to phished domains, even the lookalikes with visually similar/identical Unicode characters.

Maybe I will revisit this policy. Thanks.

Also, you could add an extra key (can be any file, so you would need passphrase+key) and keep only the key offline on each device.

Don't let perfect be the enemy of the good. Many people won't use a password manager at all if it has no cross-device syncing, and that almost always means a cloud implementation. Sure, it's less secure than a pure local-only password manager, but it's way more secure than not using a password manager at all.

That only works if you stick to a single device. If you use many devices or frequently switch between different devices, you'll want portability.

KeePass on Google drive with local backup.

> But yes, in 2023 you probably shouldn't use 3rd party authentication.

You misspelled "definitely" as "probably" here.

> ... by letting you use your own domain. Much like email ...

It's getting harder and harder to send email from your domain without being send to spam, bouncing, or the server just discarding your email without notice.

Sending it from your own domain isn’t hard, it’s self-hosting that domain which is hard. If you pay Microsoft or Google using your own domain works well.

I use smtp2go for sending, it's easy to setup your domain with them, and they are free for low volume (1000 emails/month) senders. Emails never get rejected, guess they know their game.

Co-incidentally, we (sqlitebrowser.org) switched most of our stuff to them over a year ago, and yeah they've been hassle free.

Currently using their lowest paid tier US$10/month, as that's 10k emails a month which is far more than we send. At least at this stage. ;)

Wish they'd occasionally look over the PR's submitted to their GitHub repo's though. ;)

eg: https://github.com/smtp2go-oss/smtp2go-go

It is, but OpenID didn't have this problem because requests were always initiated by the other party.

It’s not as bad if you control the domain as you could always setup a new provider. Note that I didn’t say “own” as the risk of the domain being seized will always be present.

All in all, it’s no different than delegating to your email provider to prove your identity via a password reset / login link.

Hum... Or maybe we should have the government arrange the logins for public services, since it's already in charge of tracking your identity and already has the procedures for it.

But well, that may be too radical an idea to be executed. I'm sure privatizing logins is the way to go.

Italy has SPID https://www.agid.gov.it/en/platforms/spid

Which apparently they want to phase it out at some point because...Italy.

Singapore has SingPass Login:

https://api.singpass.gov.sg/library/login/developers/overvie...

The United States has https://login.gov/

IIRC they have this in South Korea..?

In Norway we have MinID.

> MinID provides access to online public services at a substantial level of security (level 3).

https://eid.difi.no/en/minid

> MinID is issued by the Directorate of Digitization and can be ordered from the year you turn 13.

https://minid.no/en/about-minid/

There is also BankID which we can use in order to log in to all public services.

> BankID is an electronic credential for secure identification and signing on the web.

https://www.bankid.no/en/private/

> Work on developing BankID as a joint infrastructure started in 2000, and the first customers got BankID in 2004. In 2014, BankID Norway AS was established. In 2018 BankID merged with Vipps and BankAxept in order to improve product offering and prepare for competition against global tech firms.

https://www.bankid.no/en/private/about-us/

I have both MinID and BankID and I can use either of them for things like taxes and such.

Statens Vegvesen, who are in charge of driver licenses and more, allow us to sign in with BankID and a couple of other methods, but not with MinID from what I can tell.

Norge.no, which is a guide developed by the Norwegian Digitalisation Agency, has the following to say about MinID and BankID:

> Electronic IDs are available at different security levels, and thus give access to slightly different types of services.

> MinID is at a medium-high security level ("Significant"), and can be used for many public services, but not for health services at helsenorge.no, for example.

> BankID, Buypass and Commfides, which can also be used for public services, are at the highest security level (“High”) and give access to all public services.

https://www.norge.no/en/minid

But those aren't by the government, or at BankID isn't. It's a proprietary application from a private company, owned by the banks, which only works on certain operating systems.

Estonia though has an electronic ID which uses X.509 certificates.

> those aren't by the government, or at BankID isn't

MinID is by the government. BankID is private.

> It's a proprietary application from a private company, owned by the banks, which only works on certain operating systems

If you want to use the BankID app to generate codes then you will need iOS or Android. But you don't need the BankID app to use BankID.

Instead of using the BankID app, you can use a physical dongle to generate codes.

The device that you sign in with needs nothing other than Internet and a modern web browser. You can sign in with BankID on Linux or whichever other platform you desire. This device does not need to run any proprietary code aside from maybe some JavaScript executed by the browser.

Very many years ago the device needed Java to sign in with BankID, but that has not been the case for many years.

That exists, but it's a PITA typing codes back and forth, and more importantly no place I've tried accepts it as a login method, other than the bank's own website (and it locks you out from some options when logging in like that). Some might work with the BankID application installed on PC (which also only works on some operating systems), and other places specifically requires mobile BankID.

So yes, you do need to use the BankID app, not just in case you "want" to use BankID, but in order to be able to log into some sites period.

At least there is legal remedy for domain seizure

Ironic, because the solution that no one wants to hear is an actual internet driver's license, i.e. government-run openid. There's no final recourse more final than going to a place and talking to a person, and no other organization is going to build and staff enough brick-and-mortar offices.

One way of thinking about public vs private is, private companies are for cases where we care about efficiency more than fairness and government is for the opposite. Auth seems to have gotten to the "rural electrification" stage, where handling the corner cases fairly is more important than efficiency or innovation.

You can set up OpenID on your domain and then delegate authentication elsewhere or run your own authenticator. Basically similar to having email on your domain. Also Jeff mentions that this is about sites which don't have an impact on you. So you will use it for some forum but not banks nor anything your real life depends on.

Your forgetting that his baby - Stack Overflow - allows you to use multiple logins for the same account, so you wouldn't depend on say Facebook.

One of my litmus tests for whether a technical team knows what the hell they're doing is what happens when you sign up for a service with one 3rd party auth (e.g. Facebook) then try to sign in with another one, e.g. Google, with the same email. Top tier is having the accounts seamlessly merged, ideally with a notification along those lines. My favorite was getting an error because I was using a different service, but not telling me what that service was, and it somehow broke the login such that I had to restart the browser to be able to sign in.

> Top tier is having the accounts seamlessly merged

Uhm, not without requiring you to log in with the other auth as well - otherwise your account security is as weak as the weakest supported auth instead of the just weakest auth you added.

Disagree, I don't think accounts should be automatically merged under any circumstances. It's definitely not expected behavior for me as a user and as mentioned in a sibling comment, it would negatively affect security.

If the service notices that an account with the same email already exists, you may ask me to login with the original provider again to link the accounts, and indeed, this would probably be my favorite solution. Second best would be to just create a second account without complaining.

Playing fast and loose with authentication processes in the way you're describing is a guaranteed way to lose me as a customer if your service handles any valuable personal/confidential information.

What if tomorrow a vulnerability is discovered where, say, Facebook provides the new unverified email address rather than the previous verified address during the OAuth login flow? It would immediately result in an arbitrary account takeover on your website. There are so many possible edge cases with this setup and the surface area increases with each new auth provider.

The Epic Games launcher has a bizarre behaviour here. If you first sign in with your Xbox account, you can later sign in with the credentials of your Xbox account (email and password), as a 'native' account. I'm not sure what's shared, but that process made me uncomfortable.

My hope is it's a password hash or they forward the sign in request to MS servers, but who knows.

I hate to be that guy but, can you not go to the DMV physically to do those things?

Edit: I was not done reading and realized he addressed this.

The very next sentence after the above quote: "Obviously I can do this in person, but who wants to GO to the DMV? Not I, that’s for sure."

The DMV gets a bad rap, but if you can pick a time which is less busy (wed. afternoon, instead of Sat. morning), it's fine.

Or - you can opportunistically pick a time when you drive by and there's no obvious line out the door.

Because I travel for work a lot my time actually at my place of business is important and valuable. Taking time off during a day that I'm there is something I avoid, but in this case I had to and you are right. In went in the middle of the afternoon and there was minimal line. I even got done some other items that I'd been putting off for literal years because I don't ever take time off work.

The rep is so awful, when I got my drivers license, my mom drove me out to a town about 45 minutes away, just because it was quieter, but also I probably waited less despite driving out farther, but also the driving test was less stressful than being in a more populated area, it was insanely calm.

Reply on news.ycombinator.com