Maybe I missed it, but I was surprised there was no mention of passwords.
Mandatory password composition rules (excluding minimum length) and rotating passwords as well as all attempts at "replacing passwords" are inherintly dumb in my opinion.
The first have obvious consequences (people writing passwords down, choosing the same passwords, adding 1) leading to the second which have horrible / confusing UX (no I don't want to have my phone/random token generator on me any time I try to do something) and default to "passwords" anyway.
Please just let me choose a password of greater than X length containing or not containing any chachters I choose. That way I can actually remember it when I'm not using my phone/computer, in a foreign country, etc.
The identity side has allways been a problem (P)politically and technically.
I think the original GDS was completely correct in basically forcing services not to have them, they are unnecessary for almost/all transactional inerteractions - where they are useful is for things with long term, cosistent interactions i.e. where theres an actual relationship, such as benefits or tax - unfortunatly HMRC and DWP both want to "own" the relationship as individual departments (or even benefits) rather than as a part of the government, and the UK is adverse to anything that looks like a national identity system (ignoring the fact we already have national insurance numbers for everyone(?), passport numbers, etc.)
Where I think the loss of critical thinking bites the most though are the small things:
- cookie banner on gov.uk
- my DVLA password, had to have numbers etc (despite password compostion rules not been a recommeneded best practice for almost 10 years [thanks NIST / GCHQ])
- forms are now so simple due to the mantra of "only ask one thing at a time" that you lose all context as you now have a page for "name", "date of birth" etc. instead of one page for "personal details"
I'm genuinely curious if people still think gov.uk is a good example - or I guess, as good as it was.
I'm slightly biased from past experience but my feeling is a lot of the critical thinking that went into gov.uk has been lost. I just can't see the original form of GDS having an cookie banner on gov.uk for example. These were the guys that rightly pointed out that there is no actual need for people to have user accounts to access most govenment services and that no one cares about what govt department they are forced to interact with and yet, I reccently had to create a DVLA account to get an updated drivers liscence (something that happens once a decade).
Mandatory password composition rules (excluding minimum length) and rotating passwords as well as all attempts at "replacing passwords" are inherintly dumb in my opinion.
The first have obvious consequences (people writing passwords down, choosing the same passwords, adding 1) leading to the second which have horrible / confusing UX (no I don't want to have my phone/random token generator on me any time I try to do something) and default to "passwords" anyway.
Please just let me choose a password of greater than X length containing or not containing any chachters I choose. That way I can actually remember it when I'm not using my phone/computer, in a foreign country, etc.