US govt login portal could be one cyberattack away from collapse, say auditors

The US government's Login.gov identity verification system could be one cyberattack, or just a routine IT hiccup, away from serious trouble, say auditors, because it hasn't shown its backup testing policy is actually in use or effective. The US Government Accountability Office reported Tuesday that Login.gov, which is managed …

[Paul Dx]

Not a problem

The US government has so many cyber specialists and IT staff on the payroll that any problems will be sorted very quickly

[DS999]

Re: Not a problem

I'm sure if it collapses Musk will offer to have X provide that service for free, since it would give him permanent access to everyone dealing with the government electronically even after his DOGE boys are kicked out and Trump hopefully dies of a massive KFC induced heart attack.

No conflict of interest there, no siree!

[Anonymous Coward]

Re: Not a problem

I trust Musk and X more than 90% of the Senators, Congressmen and agencies. That doesn't mean I trust them much.

[IGotOut]

Great news.

No login, no peasants able to scrounge of the state. More money for the ultra rich.

[Doctor Syntax]

I can't say this often enough. The prime requirement of a DBA - or anyone else in IT these benighted times - is paranoia.

SQL knowledge, backup commands - you can get that out the product manual. If you're not paranoid with it you'll make the little slip that loses the whole lot and none of your SQL or product knowledge will do you any good.

[Anonymous Coward]

Unfortunately most management prefers to employ those that have memorised the manual. Intelligent and analytical thinkers have a habit of telling the truth to power. The types that pursue management chain career paths want order followers. OK there are exceptions but few.

[Anonymous Coward]

I could tell a tale of having to tell a CEO that the chip designed by a famous chip designer, that had just been taped out at high cost had a bug when a common event occurred.

but I might get sued

lets just say the company died not too long after

[HandlesMessiah]

In my days teaching folks how to be DBAs, paranoia was the first personality defect that I told them to cultivate. Anal retentiveness, control freakism, obsessive notetaking and the rest are all necessary, but paranoia was Number Zero.

[Oh Homer]

Say what?

Tax funded, unelected bureaucrats with disjointed, inadequate and archaic SOPs, that nobody even bothers to follow?

Shocking.

[martinusher]

Re: Say what?

You realize that anything you use is organized by 'unelected bureaucrats'? Commercial companies can easily be just as klunky as the government. Both a commercial operation that has market power and the government (who has market power by definition)lack an overriding incentive to make their sites super efficient, the know the customer can't just click away to some alternative supplier. Combine that with a healthy dose of "Not Invented Here" with a sprig of hubris and you've got a recipe for problems. So far, though, you can't fault the government for trying even if they're not quite state of the art.

I, tooo, have my Login.gov login. To me as a user its just got the usual login/password credentials. There might be some secret sauce in there but if there is its well hidden. I'd guess that the real magic is how the site exchanges credentials with innumerable agencies.

[nijam]

Re: Say what?

> I'd guess that the real magic is how the site exchanges credentials with innumerable agencies.

Simple, just the name and password. No need for the encrypted version, just use the plain text one that they have stored alongside it.

[Claptrap314]

Time to quote myself?

At my last job, I got handed a significant chunk of our compliance work.

It was bemusing to receive a questionnaire that assumed that backups were not immediately tested.

I don't know what you call an untested bunch of bits supposedly written somewhere without being restore tested, but it ain't "backup".

[Anonymous Coward]

Danger WIll Robinson

And still governments are so desperate to know everything and control everything the push forward with centralisation of logins and data. In fact going further and trying to collect everything from how many pimples people have to what groceries they buy.

[Anonymous Coward]

Re: Danger WIll Robinson

Self-evidently they - like the UK Statistics Agency- collect info about many-many things to gauge performance like GDP, metrics to guide Government spend and track impact of many input to society like inflation. Some levers controllable and/or measurable, others not (like impact of Ukrainian War and the weaponisation - and greed of speculation - on energy and commodities).

From their home page … note the code of practice and legal framework they operate within - unlike data slurpers like Facebook, Google, Xitter, Microsoft etc…/ and other companies in legal and illegal data sharing through shady brokers.

“The UK Statistics Authority (UKSA, Welsh: Awdurdod Ystadegau'r DU) is a non-ministerial government department of the Government of the United Kingdom responsible for oversight of the Office for National Statistics, maintaining a national code of practice for official statistics, and accrediting statistics that comply with the Code as National Statistics. UKSA was established on 1 April 2008 by the Statistics and Registration Service Act 2007, and is directly accountable to the Parliament of the United Kingdom.”