2·
2 days agoMay I introduce you to the german “Elster” tax portal?
Most fucking insane security mechanisms ever. They support fido2 but with their app, not via a browser. Their linux program is a 10MB shell script that crashed my text editor.
They have a probably encrypted keyfile but that expires in 3 years and you need to
- login
- switch to desktop mode as otherwise they hide it
- send a code per email
- the site generated another code you also need
- you get another email with another link, which also doesnt include any code in the URL
- you need to log out to login again?
- you need to enter the 2 different codes for whatever reason. One is generated on the site before you need to log out, the other from the email
- then wait forever to create the keyfile
- you also need to setup a new password for the keyfile
So afaik you need a username, email, password, keyfile and password for the keyfile.
- why a keyfile again?
- why a username if it is never used?
- why so many emails with all the secret credentials instead of secure e2ee login on the website?
This should be illegal
This is so vague we dont even know if it’s a good thing