It is one thing to write the needed software, it is a much bigger task to convince enough companies that they need a different approach to this problem.

However, what I can offer is that if someone has the backing to actually make a difference in this market, I'll volunteer 50 hours to act as a reviewer and test developer. But that is if your project is backed by someone I believe can make a difference.

The United States has it, too: https://login.gov

But with a government as large as America's it's going to take time to get everyone converted to the new system.

I believe most of it is open source: https://github.com/18F/identity-idp

> You are part of a federal agency or a state, local, or territory government

I'm talking about a more generic service that any random industry system or individual can use. The way many websites use Google's OAuth without using really using Google's APIs. Things that just want someone else (Google) to handle asking for and authenticating a name/password.

But that is not what we are talking about. It is not that you are browsing the web randomly and some random company identifies you as d1sxeyes.

It is that you can identify yourself towards any company if you choose to. Then you can decide if that is in your best interest or not.

Topic drift, but no tools should use google login. Doing that means handing over to google the authority to decide who can and can't use your tool. And we all know google support is nonexistent and unreachable, so once it fails it's forever.

If you market a tool, you'd really want to own the decision on who you can sell it to.

For a government organization though, I'd agree it makes sense to use a government-run login service. (government run, not outsourced so some for-profit third party!)

And that's pretty much my point. 2FA? Password Resets? Account Activation? Updating Email Address? No thanks. I would rather not have to deal with any of that. I literally just need a unique identifier to associate with your data and preferences.

Sorry if I wasn't clear. It is not that google will remove the service overnight (although they are infamous for canceling things, but not that bad). The problem is google will lock out users randomly for no reason and no recourse.

If that user was using google login to access your service/tool, you lost that user and there is nothing you can do. You really don't want to gate the access to your product via an unreachable unresponsive third party like google.

Would still need an audit to make sure sites are actually using the shared auth and not rolling their own.

I'm saying we need the digital equivalent of "show me your driver's license".

It's what the IRS uses.

Fundamentally, it has given control over the DNS records to a different country (.me == Montenegro).

It's training people that really, any domain could be a government domain, you'll never know.

Welcome to the neoliberal wet dream.

Yes, it's unfair that the US gets naked .gov - but that doesn't preclude the rest of the world from doing the right thing, and it certainly doesn't excuse the US government doing the stupid thing.

It's the company providing the service that the government could provide on its own, but that service is being provided by a private company through a lucrative contract agreement.

"Scan the front and back of your Driver's License."

[upload scan of front of DL @ 200DPI]

"Unable to find a face in the image you uploaded."

[upload scan of front of DL @ 300DPI]

"Unable to find a face in the image you uploaded."

Huh. Maybe I'll try with a lower resolution.

[upload scan of front of DL @ 72DPI]

"Thank you, now please upload the back of your Driver's License."

Hmm, 72DPI worked for the front, so...

[upload scan of back of DL @ 72DPI]

"Unable to read a barcode in the image you uploaded."

[upload scan of back of DL @ 200DPI]

"Unable to read a barcode in the image you uploaded."

[upload scan of back of DL @ 300DPI]

"Thank you for verifying your Driver's License".