Hacker News Reader

Comment by kstrauser | Hacker News Reader

Also Californian, and I envy Hawaii this. I've had the CA DMV Wallet app installed since its launch. Every single time I open it,

1. It tells me I need to refresh my license. I click the button.

2. It tells me I need to log into the DMV website. I grit my teeth and log in.

3. It tells me my password has expired and I need to update it because no one there has read the NIST guidelines. I snarl and update it.

4. I get an error message that the system is temporarily unavailable or something and my password can't be updated, so I can't log in, so I can't refresh my ID, so I can't use the app at all.

At this point I only keep testing it out of sheer bullheadedness and a high pain tolerance.

View on HN

Same here in Utah. We had crazies screaming about mark of the beast when digital ID first came up. They finally started it and it’s only through some garbage app. Probably someone connected or whatever.

I grew up in another state with a large population of religiously conservative residents. When Amazon emailed me an ad for their new Amazon One service[0] that lets you literally buy things with a palm scan, I was able to correctly name the people I knew who'd lose their freaking mind about it. I'm convinced that they didn't include one single evangelical in their focus group, or that they ignored the feedback.

[0]https://one.amazon.com

That doesn't appear to be specific to the app. I also have the same thing happen on the website itself, on a desktop. It's not clear that logging in to the DMV is possible at all if your password is expired.

Why so many government services in the US have such an obsession with scheduled periodic password resets, which the government's own standards body recommends against, is baffling.

Yeah, I just tried and confirmed that I still can't update my password on my desktop since I last tried on my phone this morning. It's just made that much harder to try on a phone.

I have no idea. OK, I lied. I have some idea. At a previous job I had a meeting with an enterprise customer who was auditing our security controls. Part of the conversation went a lot like this:

Them: How often do you require your employees to change their passwords?

Me: We don't.

Them: Hehe, you'll have to start doing that!

Me: We comply with NIST 800-63B section 5.1.1.2 that says not to do that unless you suspect a password's been compromised.

Them: Uh, what? Can you send me a link?

Me: You bet!

My boss, to me in Slack: OMFG did that really just happen?

Yes, I did have (and do have) that exact citation memorized because it came up often enough that it was handy to bust that out. "Do you rotate..." "NIST!" "...once every 90..." "SP 800-63B!" "...days?" "5 dot 1 dot 1 dot 2!"

Reply on news.ycombinator.com