特朗普政府推出America.gov作为联邦信息和服务的统一入口，承诺不使用广告cookie或第三方追踪器以保护用户隐私1。然而，底层认证系统Login.gov的代码显示存在隐私追踪问题。国家设计工作室在9月4日合并的代码添加了一个名为nds_experiment_uuid的函数，该函数创建了有效期为20年的持久浏览器标识符1。这一标识符在用户认证前即被生成，并于9月9日被添加到分析事件属性中1。
GitHub用户于9月12日对该设计提出质疑，询问为何需要如此长生命周期的标识符，以及是否进行了隐私影响评估1。值得注意的是，通用服务管理局发布的Login.gov隐私影响评估更新于2026年3月，时间早于nds_experiment_uuid变更六个月1。虽然用户可以在NDS界面中选择退出，但代码并不删除该标识符，而是记录退出状态1。平台计划在2027年早期阶段允许用户通过America.gov申请和跟踪联邦福利1，护照服务定于12月开始使用Login.gov认证1。
The Trump administration launched America.gov as a unified gateway for federal information and services, promising to protect user privacy by avoiding advertising cookies and third-party trackers 1. However, code in the underlying authentication system Login.gov reveals that the National Design Studio embedded a persistent browser identifier with a 20-year validity period, raising questions about whether the platform's privacy commitments have been compromised 1.
The problematic identifier, called nds_experiment_uuid, was merged into Login.gov's codebase on September 4 1. This function generates a unique browser identifier before users authenticate and persists for two decades 1. By September 9, this identifier had been added to the system's analytics event properties, effectively creating a long-term tracking mechanism 1. When users opt out through the NDS interface, the code records their withdrawal status but does not delete the nds_experiment_uuid itself, meaning the identifier continues to exist in the system 1.
The timing raises additional concerns about transparency. The General Services Administration's privacy impact assessment for Login.gov was updated in March 2026, approximately six months before the nds_experiment_uuid changes were implemented 1. A GitHub issue filed on September 12 questioned the necessity of a two-decade-long identifier and whether adequate privacy impact evaluations had been conducted 1. Looking forward, America.gov is expected to allow users to apply for and track federal benefits beginning in early 2027 1, and passport service authentication through Login.gov is scheduled to launch in December 1.
评论
还没有评论，欢迎留下第一条。