Everyone gangsta until they realize security for the sake of security isn’t a thing, but that it should strike a good balance between purpose and convenience

  • exdor@programming.dev
    2·
    1 day ago

    May I introduce you to the german “Elster” tax portal?

    Most fucking insane security mechanisms ever. They support fido2 but with their app, not via a browser. Their linux program is a 10MB shell script that crashed my text editor.

    They have a probably encrypted keyfile but that expires in 3 years and you need to

    • login
    • switch to desktop mode as otherwise they hide it
    • send a code per email
    • the site generated another code you also need
    • you get another email with another link, which also doesnt include any code in the URL
    • you need to log out to login again?
    • you need to enter the 2 different codes for whatever reason. One is generated on the site before you need to log out, the other from the email
    • then wait forever to create the keyfile
    • you also need to setup a new password for the keyfile

    So afaik you need a username, email, password, keyfile and password for the keyfile.

    • why a keyfile again?
    • why a username if it is never used?
    • why so many emails with all the secret credentials instead of secure e2ee login on the website?

    This should be illegal