from Hacker News

Source code for Dutch DigiD app released under Dutch Open Government Act

by kf on 1/18/23, 11:41 AM with 157 comments

  • by matsemann on 1/18/23, 12:46 PM

    The Norwegian welfare agency publish most of their code on github: https://github.com/navikt/

    It's the organization you use if you're sick, lost your job, where you get your social security etc. Basically a huge behemoth of all kinds of social or labor services.

    While most of the code probably has little value for others (2000 different repos), I think it's quite noble that it's public, given it's made with tax payer money and serves our people. And when working there I found it quite cool to work in the open, a sense of pride in publishing everything we were doing. Also a bit funny, just checked the project I started 5 years ago: "last updated 42 minutes ago".

  • by cloudify on 1/18/23, 1:16 PM

    Italy does the same: https://github.com/pagopa/io-app

    This is the official government app (you can get benefits, pay taxes, etc...), downloaded by 30+ million citizens, stack is React Native + Typescript

  • by yurishimo on 1/18/23, 2:48 PM

    Speaking as an immigrant from America, I really like DigiD! I wish the US had something even remotely similar. The fact that we do not have a standardized national ID easily available to everyone is embarrassing.

    DigiD has some minor annoyances, but it's a helluva lot better than some alternatives I could think of.

  • by lucumo on 1/18/23, 1:18 PM

    I find the DigiD app to be one of the most annoying implementations of 2FA out there. You have to unlock the app with a pin code, then enter an app-generated code on the site, then scan a QR with the app, and then grant permission to login to that site.

    If you compare that to 2FA for Office 365 for example, where you just have a push notification where you press a button to allow, then you can't help but think that some attention to UX would be helpful.

    As it is, I usually pick SMS verification instead of using the app. Yes, less secure, but so much easier.

  • by dr_dshiv on 1/18/23, 12:12 PM

    It’s a great app. I mean, there can be challenges, but generally extremely effective.

    I suppose openness will enhance security over time?

  • by kf on 1/18/23, 11:43 AM

  • by belter on 1/18/23, 1:37 PM

    "...This code has been disclosed in response to a request under the Dutch Open Government Act ("Wet open Overheid")..."'

    Sounds like it was not voluntary. Also not sure what kind of transparency is expected here, since there is no way to find if the source code published is the same used to build the app. Maybe decompilation is the way to go...

  • by BasedInfra on 1/18/23, 1:22 PM

    There’s a lot of gov.uk stuff open source.

    - https://github.com/alphagov

    - https://github.com/hmrc

    - https://github.com/dwp

  • by throwaway71271 on 1/18/23, 12:08 PM

    In order to verify your ID with the app your phone must have NFC support to scan the passport/id, and on the screen where you do the verification it says: if your phone doesnt have support find a friend with a phone that supports it, I kid you not..

    edit, found it in the code:

    https://github.com/MinBZK/woo-besluit-broncode-digid-app/blo...

  • by melvinmelih on 1/18/23, 2:21 PM

  • by wdb on 1/18/23, 2:44 PM

    As a Dutch person this is the only bit I was never able to get/register for since it got introduced. Requested it since like 2003/2004 or something.

  • by Am4TIfIsER0ppos on 1/18/23, 12:01 PM

    Question: can you modify, compile, and run that code and still have it work for the same uses?

  • by seanw444 on 1/18/23, 5:25 PM

    This is one thing I wish the US government did more of. One of the few things I can envy about Europeans. It's taxpayer money, so let us see.

  • by gagabity on 1/18/23, 12:30 PM

    .Net cross platform!

  • by gbraad on 1/19/23, 1:48 AM

    Why not host on their own Gitlab of Forgejo/Gitea server? Has all to do with trust and ownership. Now it feels like a mere dump...

  • by timwaagh on 1/18/23, 3:44 PM

    Great so now we can be sure some hacker working at an intelligence agency or criminal syndicate reads this and now knows how to hack DigiD, which is basically the Dutch government's SSO. After you get in you can do all kinds of things like apply for student loans, passport taxes etc. There will be another layer of security but still.. this is not great. Don't get me wrong I am not against publishing source code but they ought to think about what they publish.

  • by 0daym on 1/18/23, 2:01 PM

    C# ?? How is an app written in C#?