Hacker News Reader

Comment by nightski | Hacker News Reader

I'm not saying it is the solution but the government already has systems which let you log in securely and verify identity, such as the IRS and SSA websites. Neither of them are much of a hassle to sign up for.

I think a slight inconvenience to signing up is better than having your comment drowned out in useless noise.

View on HN

Recently, the federal government has been internally promoting https://login.gov as an single sign-on system for all government services to the public.

I don't know how good it is at preventing fake accounts, but in my experience, it does get the basics right, with no max password length or character restrictions, and 2-factor authentication through phone calls or texts.

> 2-factor authentication through phone calls or texts.

isnt this bad? Tying to your phone number (while more convenient) provides another vector of attack (social engineering the telecoms to get device changed)

Or if someone loses their phone then there’s a window of time where an attacker can just pop in their sim.

You need both the password and the phone number, so compromising the phone number via social engineering still requires the password, and thus can't be less secure than just requiring the password.

That's… why it's called two factor authentication? Or are you suggesting they'd let you reset your password with just the phone number?

It also supports TOTP codes.

>Neither of them are much of a hassle to sign up for.

When I signed up for the IRS's website I had to verify my mailing address by receiving a letter in the mail. It's not a huge hassle but it delayed my account creation by about a week, and someone could argue (fairly, imo) that this would create a large enough barrier-to-entry to dissuade people from leaving their opinions.

In general having a good national ID or at least national single-sign on solution might be the answer. Edit: It could take advantage of the IRS and social security verification paths (I believe they require a SSN and verification of a previous year’s tax return values).

There would still be some fraud, just as social security and the IRS both suffer from identity theft and fraud today, but the barrier to entry might be higher and in theory having a unified system would allow citizens to manage their identity and safety more easily.

Considering the FCC is having to ask for permission just to add a captcha I doubt our government is capable of anything like this right now though.

Reply on news.ycombinator.com