It's the organization you use if you're sick, lost your job, where you get your social security etc. Basically a huge behemoth of all kinds of social or labor services.
While most of the code probably has little value for others (2000 different repos), I think it's quite noble that it's public, given it's made with tax payer money and serves our people. And when working there I found it quite cool to work in the open, a sense of pride in publishing everything we were doing. Also a bit funny, just checked the project I started 5 years ago: "last updated 42 minutes ago".
Just curious, since it's been a dream of mine to have public services powered by open software: How often do bugs in the services get reported either, with direct references to the underlying software (function names, line numbers, etc.), or as changesets/PRs with proposal fixes?
Especially for simpler things like style/accessibility issues, I could see this being somewhat common honestly.
Wow, looks pretty nice from the screenshots. Do you have experience using it? Does it work well/do what it claims? I recently moved to Spain, who has a digital identity system, but is a pretty disjointed attempt.
Speaking as an immigrant from America, I really like DigiD! I wish the US had something even remotely similar. The fact that we do not have a standardized national ID easily available to everyone is embarrassing.
DigiD has some minor annoyances, but it's a helluva lot better than some alternatives I could think of.
> The fact that we do not have a standardized national ID easily available to everyone is embarrassing.
Why? I’ve lived in a European country with common national IDs, in the US, and in a European country without national IDs, and I’m not sure that the absence of it is “embarrassing.” Note that in most European countries it’s an identifier of citizenship, not residence, with other ID cards such as residence permits, drivers licenses, or municipal registrations indicating residence. Therefore, it’s far from sufficient for many common use cases that depend on residence, and the countries that don’t have one such as the US or the UK typically use passports (or ad-hoc solutions such as US/Canada enhanced drivers licenses) for travel.
> The fact that we do not have a standardized national ID easily available to everyone is embarrassing.
Surely that's hyperbole. State IDs are pretty standardized, and even more so with the REAL ID system (if the mandates for it ever go into effect). When have you ever had a problem using one state's ID in another state?
It's was on purpose. Americans traditionally don't like the idea of a standard, mandatory national ID. But SSNs have basically been re-appropriated to serve that purpose, to get around that, despite them being explicitly listed as "not intended as a means of general identification."
I find the DigiD app to be one of the most annoying implementations of 2FA out there. You have to unlock the app with a pin code, then enter an app-generated code on the site, then scan a QR with the app, and then grant permission to login to that site.
If you compare that to 2FA for Office 365 for example, where you just have a push notification where you press a button to allow, then you can't help but think that some attention to UX would be helpful.
As it is, I usually pick SMS verification instead of using the app. Yes, less secure, but so much easier.
For an app that cost in the tens of millions to produce[1], and for which the company (gov-owned and operated) behind it charges implementors/users (not end-users ofc)[2] for each and every single successful DigID authentication event €0.13, DigID authorization event €0.88, and even for every digital message delivered into your "berichtenbox" €0.32, it could.. no rather it should indeed provide a much better experience than what we have now.
On the other side of this, push-phishing through MFA fatigue has become extremely frequently used to hack into enterprise O365 instances (as well as Google Cloud accounts and the like).
People don't generally read it when their phone apps send them a "please login" notification after the 200th one that day, they tend to approve it without thinking (or worse, accidentally approve a phishing notification while trying to login), especially when busy, which results in them letting phishers onto their device.
The DigiD login flow is a bit of a mess, but it seems very well designed to avoid that particular tendency. The entire process requires active involvement from the end-user, which means they'll be paying attention on whether it's them logging in or not.
That's a bad comparison, as you're comparing a full authentication process against just one step: with Office 365 (and SMS verification for DigiD) you additionally need to provide a username and password, which you don't need to do with the app.
I think the only part that can reasonably be simplified without compromising security is to use a push notification instead of having to scan the QR-code.
If you leave the country without setting up SMS you can’t ever use 2FA. They claim to support adding foreign numbers, support people being abroad, support adding new DigiD accounts from abroad, but oh no you can’t just add a number. Not even by going to an office or doing a virtual interview. I would think this violates EU law on discrimination. If you live in the UK post-Brexit it’s now totally impossible, I believe (since you aren’t even allowed to make a new account).
It's slightly easier on-device (where the app runs), still try opening your government messages inbox, that takes 5 taps/screens/faceID and a code. It always works though, and one does not use it very often.
I do appreciate that they keep is so secure (or perhaps I should say, not logged in by default). It works well in general imho.
I have dozens of 2FA codes now that requires searching for the correct one and I have to store backup codes in physical form. Which probably a lot of people keep unencrypted on their desktop somewhere.
With the Digid app you just need to remember the pin code or unlock with face id.
The app generates the codes for each login and then you just scan the QR. It's very simple to use.
Recently I lost my phone and had to set everything up again. I had to start digging for 2fa backup codes, but Digid I could easily set up again using the NFC chip in my passport.
The company making this clearly doesn't want to open up development, this code was released because the government was forced to. They stripped the commit history and some hard coded details and I don't think they'll develop on this repo either.
Some extra eyes on the current code might fix some small issues, but I doubt this is going to improve the app much.
It's pretty pathetic how many people feel the need to dunk on this bit of code just because it's not how they would write it. There's nothing really wrong with it. I'm sure the author was aware of alternative, perhaps more concise solutions using a string builder but they chose to be clear instead.
I vaguely suspect that this is a product of the sort of environment where you have to fill out a form in triplicate to get the static analyser to let you concatenate strings (which, to be clear, may not be inappropriate for something like this).
I do object to the variable being called ‘percentage’ tho, as it clearly isn't one.
I'm triggered by the lack of brackets after every if-expression. Sure it looks nicer this way but the default Visual Studio code style settings will complain if you don't do it, hence I'm used to it.
"...This code has been disclosed in response to a request under the Dutch Open Government Act ("Wet open Overheid")..."'
Sounds like it was not voluntary. Also not sure what kind of transparency is expected here, since there is no way to find if the source code published is the same used to build the app. Maybe decompilation is the way to go...
It's semi-voluntary; the request to open source the application came from the Dutch congress/2nd chamber if I recall, but took a while due to private information leaking concerns.
In order to verify your ID with the app your phone must have NFC support to scan the passport/id, and on the screen where you do the verification it says: if your phone doesnt have support find a friend with a phone that supports it, I kid you not..
How this is used in practice is when you log in to a government site, you provide your DigiD account name and password, and then (often but not always) verify that it's really you with either SMS or (apparently) by scanning a document with NFC. Since it's just a single-use authentication I don't see a particular problem with doing it on another device. The actual government interaction after you're logged in happens on the website anyway, not your friend's phone.
btw I see that attaching an nfc reader to your computer is also supported.
I don't think I've ever used DigiD to verify my passport, I was vaguely aware it had the capability though. On the other hand I use DigiD all the time to login to websites. My health insurance, government websites, etc. Super efficient and simple.
The passport feature is a new one to provide an alternative safer method of verifying ID for the times you need it. It isn't the default use of DigiD and is meant as an alternative to physically taking your passport places.
Access to a smartphone with NFC can indeed be an issue for some people, but it is still better than having to record videos of yourself holding your ID next to your face, then a couple of years later finding out that your personal data is freely circulating on the web because one of those sleezy identity verification services has been hacked.
I don't know why so many people are saying that this is bad code.
Besides the redundant checks, it's really simple, so simple that an intern, maybe even someone who doesn't code, can understand and update it.
It's performant, most compilers will cache the strings.
People trying to justify more complex one-liners with "what if you change the symbol, or just show 5 characters" etc. These scenarios wouldn't take more than 5 minutes to adapt this code, and anyone could do it.
For me, this code with a good set of tests doesn't get much better.
It's easy to read, simple to maintain, and performant code. Maybe one of those newer switch expressions would make the code even clearer, but they already left the redundant lower bound checks in so I think the way this looks is quite intentional.
Much easier to read than `int count = (int)Math.Floor(percentage / 10); return new String("#", count) + new String("-", 10 - count));` in my opinion and not worth writing a custom progress component for.
Do you live in Nederland still? You can request the verification via post instead of using your passport. If you lose your DigiD login, you can also create/request another. The account acts as a pointer to your official ID. My wife made a mistake and had to attempt the process 3 times. Not a problem.
Living overseas it took them several yesrs to realize that making a trip to an embassy overseas just to get a registration code was not a feasible way.
Luckily Corona made them realize you can also do it over a Skype call.
They explicitly say it's not intended for reuse, and various stuff has been redacted (though I've not identified any that would stop the code from working). Interestingly you are allowed to reuse the code under the EUPL license.
The interesting aspect of this is that it can be studied to write clients for platforms that are not officially supported -- currently, only Android and iOS are supported, but it'd be great to see a Linux client too.
It's a big shame that history has been rewritten and heavily redacted though. Version control history often has a lot of contextual information that's not immediately obvious in the source code itself.
I dont think self complied version would work with service like belasting etc.
I did not look in depth, but the source code would reveal how thing are getting encrypted and business flows but not the data. That is in the digid's infrastructure
Great so now we can be sure some hacker working at an intelligence agency or criminal syndicate reads this and now knows how to hack DigiD, which is basically the Dutch government's SSO. After you get in you can do all kinds of things like apply for student loans, passport taxes etc. There will be another layer of security but still.. this is not great. Don't get me wrong I am not against publishing source code but they ought to think about what they publish.
matsemann|3 years ago
It's the organization you use if you're sick, lost your job, where you get your social security etc. Basically a huge behemoth of all kinds of social or labor services.
While most of the code probably has little value for others (2000 different repos), I think it's quite noble that it's public, given it's made with tax payer money and serves our people. And when working there I found it quite cool to work in the open, a sense of pride in publishing everything we were doing. Also a bit funny, just checked the project I started 5 years ago: "last updated 42 minutes ago".
argulane|3 years ago
And not everything is there. ID Card software is hosted on Github https://github.com/open-eid
nixpulvis|3 years ago
Especially for simpler things like style/accessibility issues, I could see this being somewhat common honestly.
gunnihinn|3 years ago
conviencefee999|3 years ago
[deleted]
cloudify|3 years ago
This is the official government app (you can get benefits, pay taxes, etc...), downloaded by 30+ million citizens, stack is React Native + Typescript
college_physics|3 years ago
gorbypark|3 years ago
yurishimo|3 years ago
DigiD has some minor annoyances, but it's a helluva lot better than some alternatives I could think of.
vinay427|3 years ago
Why? I’ve lived in a European country with common national IDs, in the US, and in a European country without national IDs, and I’m not sure that the absence of it is “embarrassing.” Note that in most European countries it’s an identifier of citizenship, not residence, with other ID cards such as residence permits, drivers licenses, or municipal registrations indicating residence. Therefore, it’s far from sufficient for many common use cases that depend on residence, and the countries that don’t have one such as the US or the UK typically use passports (or ad-hoc solutions such as US/Canada enhanced drivers licenses) for travel.
I agree that digital IDs can be very useful.
pionar|3 years ago
Surely that's hyperbole. State IDs are pretty standardized, and even more so with the REAL ID system (if the mandates for it ever go into effect). When have you ever had a problem using one state's ID in another state?
seanw444|3 years ago
lucumo|3 years ago
If you compare that to 2FA for Office 365 for example, where you just have a push notification where you press a button to allow, then you can't help but think that some attention to UX would be helpful.
As it is, I usually pick SMS verification instead of using the app. Yes, less secure, but so much easier.
krono|3 years ago
1: https://www.rijksfinancien.nl/memorie-van-toelichting/2019/O...
2: https://logius.nl/onze-organisatie/zakendoen-met-logius/door...
noirscape|3 years ago
People don't generally read it when their phone apps send them a "please login" notification after the 200th one that day, they tend to approve it without thinking (or worse, accidentally approve a phishing notification while trying to login), especially when busy, which results in them letting phishers onto their device.
The DigiD login flow is a bit of a mess, but it seems very well designed to avoid that particular tendency. The entire process requires active involvement from the end-user, which means they'll be paying attention on whether it's them logging in or not.
Denvercoder9|3 years ago
I think the only part that can reasonably be simplified without compromising security is to use a push notification instead of having to scan the QR-code.
sambe|3 years ago
teekert|3 years ago
I do appreciate that they keep is so secure (or perhaps I should say, not logged in by default). It works well in general imho.
Kaotique|3 years ago
With the Digid app you just need to remember the pin code or unlock with face id. The app generates the codes for each login and then you just scan the QR. It's very simple to use.
Recently I lost my phone and had to set everything up again. I had to start digging for 2fa backup codes, but Digid I could easily set up again using the NFC chip in my passport.
sandos|3 years ago
dr_dshiv|3 years ago
On desktop, you use pin, type code, then scan. I find the flow quite smooth.
dr_dshiv|3 years ago
I suppose openness will enhance security over time?
jeroenhd|3 years ago
Some extra eyes on the current code might fix some small issues, but I doubt this is going to improve the app much.
kf|3 years ago
c7DJTLrn|3 years ago
So many big egos in software.
yread|3 years ago
rsynnott|3 years ago
I do object to the variable being called ‘percentage’ tho, as it clearly isn't one.
pelorat|3 years ago
jpnc|3 years ago
belter|3 years ago
Sounds like it was not voluntary. Also not sure what kind of transparency is expected here, since there is no way to find if the source code published is the same used to build the app. Maybe decompilation is the way to go...
noirscape|3 years ago
BasedInfra|3 years ago
- https://github.com/alphagov
- https://github.com/hmrc
- https://github.com/dwp
throwaway71271|3 years ago
edit, found it in the code:
https://github.com/MinBZK/woo-besluit-broncode-digid-app/blo...
bondarchuk|3 years ago
btw I see that attaching an nfc reader to your computer is also supported.
Dobbs|3 years ago
The passport feature is a new one to provide an alternative safer method of verifying ID for the times you need it. It isn't the default use of DigiD and is meant as an alternative to physically taking your passport places.
dessant|3 years ago
ivanhoe|3 years ago
jb1991|3 years ago
ecedeno|3 years ago
melvinmelih|3 years ago
jpcrs|3 years ago
Besides the redundant checks, it's really simple, so simple that an intern, maybe even someone who doesn't code, can understand and update it.
It's performant, most compilers will cache the strings.
People trying to justify more complex one-liners with "what if you change the symbol, or just show 5 characters" etc. These scenarios wouldn't take more than 5 minutes to adapt this code, and anyone could do it.
For me, this code with a good set of tests doesn't get much better.
jeroenhd|3 years ago
Much easier to read than `int count = (int)Math.Floor(percentage / 10); return new String("#", count) + new String("-", 10 - count));` in my opinion and not worth writing a custom progress component for.
seydor|3 years ago
wdb|3 years ago
yurishimo|3 years ago
Aeolun|3 years ago
Luckily Corona made them realize you can also do it over a Skype call.
Am4TIfIsER0ppos|3 years ago
contravariant|3 years ago
WhyNotHugo|3 years ago
The interesting aspect of this is that it can be studied to write clients for platforms that are not officially supported -- currently, only Android and iOS are supported, but it'd be great to see a Linux client too.
It's a big shame that history has been rewritten and heavily redacted though. Version control history often has a lot of contextual information that's not immediately obvious in the source code itself.
debarshri|3 years ago
I did not look in depth, but the source code would reveal how thing are getting encrypted and business flows but not the data. That is in the digid's infrastructure
fudgefactorfive|3 years ago
So you definitely can't use this unless you pull the strings from the compiled APK theyve published.
seanw444|3 years ago
gagabity|3 years ago
vips7L|3 years ago
gbraad|3 years ago
timwaagh|3 years ago
radicalbyte|3 years ago
Aeolun|3 years ago
Trusting it’s safe because you don’t know if its not sounds like a bad idea.
arp242|3 years ago
1. A safe that's been sitting on a public square for ten years, which the best safe-crackers in the world have tried – and failed – to break.
2. A safe hidden in a secret room that no one is allowed to access, but the manufacturer claims it's safe without real evidence beyond "trust me".
0daym|3 years ago
ClassyJacket|3 years ago