6 ms·

Until the IRS stops using social security numbers to file, it's insecure.

by nxzero 11y ago

privong 11y ago
> Until the IRS stops using social security numbers to file, it's insecure. But if they move to another form of unique identifier, that'll just shift the fraud to that new identifier. The problem with SSN's isn't the IRS using them, it's everyone else using them as a de facto national ID number.
- zeveb 11y ago
  They could move to a chip-and-pin smart card, e.g. a Common Access Card[0]. I know that a lot of folks don't want a national ID card. I don't either. But that's easy enough with a smart PKI: the federal government and its agencies can trust the state governments' issuing agencies. Each state could issue CAC-like cards to its citizens, and then those folks could sign their taxes and conduct other official business. It'd probably end up relied upon by other vendors, just like Social Security numbers, but at least a) it'd be more secure b) it'd be breakable only by the government, rather than by the government and anyone else. [0] https://en.wikipedia.org/wiki/Common_Access_Card https://en.wikipedia.org/wiki/Common_Access_Card
  - x1798DE 11y ago
    Something like a proper authentication protocol would be useful for sure, but I would bet good money that the government would roll out some weird homebrew nonsense that would be compromised in hours. Not to make the perfect the enemy of the good, but realistically I doubt we'd get anything actually secure.
    - zeveb 11y ago
      > Something like a proper authentication protocol would be useful for sure, but I would bet good money that the government would roll out some weird homebrew nonsense that would be compromised in hours. Did you read the linked article? CACs are in use by the DOD and have been for years.
  - toomuchtodo 11y ago
    Estonia does this [1], and it works brilliantly. https://en.wikipedia.org/wiki/Estonian_ID_card https://en.wikipedia.org/wiki/Estonian_ID_card
  - Shivetya 11y ago
    well the issue here is that the right will fight against a national id card on the basis of big brother and privacy and the left will claim it leads to disenfranchisement. both sides need to recognize that if absolute indemnification is required for tax purposes it is as well for voting rights because it protects both equally. the challenge is how to keep confirm the card is really held by the person holding it. pin numbers don't cut it
- vox_mollis 11y ago
  Right. One clear path to dramatically reducing fraud would be to eliminate the prevalence of refunds, thus eliminating the INCENTIVE for fraud. Instead of calculating exemptions and deductions on already-earned income, establish an accurate deduction schedule up-front such that your expected refund is $0. Or, better yet, eliminate payroll deductions entirely and ensure everyone has a liability come April. Pretty hard to defraud a liability.
  - rodovich 11y ago
    > Or, better yet, eliminate payroll deductions entirely and ensure everyone has a liability come April. Pretty hard to defraud a liability. Much easier to not pay a liability -- especially if it's a double-digit percentage of your annual income, and not just a small rounding error like it typically is today.
  - justinlardinois 11y ago
    > One clear path to dramatically reducing fraud would be to eliminate the prevalence of refunds, thus eliminating the INCENTIVE for fraud. This is good from a rational point of view, but there's a large number of people who enjoy having large tax refunds because they perceive it as free money. I'm not defending that mindset, but it would be hard to get people to get over it. > Or, better yet, eliminate payroll deductions entirely and ensure everyone has a liability come April. Part of the reason we have payroll deductions in the first place is that the government understandably doesn't trust people to save up money to pay their income taxes every year; it's much easier to deduct roughly how much someone owes and then settle the difference every April and much more likely to end with the government getting somewhat close to how much it's owed. I can't imagine how many people would have unpaid taxes each year, but it would be an insanely high number. I'm sure the tax relief assistance industry would love it, though.
fweespee_ch 11y ago
> Until the IRS stops using social security numbers to file, it's insecure. If it treated SSNs as a username and required everyone to generate some unique passwords...it would work.
- apaprocki 11y ago
  ... like it already does? Since 2008 the IRS has required a security PIN code to e-file. It's not the most secure system in the world, but everyone needs to understand you can't just e-file someone's taxes by knowing their SSN.
  - fweespee_ch 11y ago
    http://krebsonsecurity.com/2016/03/irs-suspends-insecure-get-ip-pin-feature/ http://krebsonsecurity.com/2016/03/irs-suspends-insecure-get... That isn't a password and its basically available based on public information, just like a SSN. The IRS created a system that is literally another username and called it a PIN.
    - apaprocki 11y ago
      The original PINs were sent in the mail and in order to retrieve it you had to fill in the AGI from the previous year's return, not those credit-bureau challenge/response questions. It seems they created some vulnerability there, but it wasn't always like that.
      - fweespee_ch 11y ago
        > The original PINs were sent in the mail and in order to retrieve it you had to fill in the AGI from the previous year's return, not those credit-bureau challenge/response questions. It seems they created some vulnerability there, but it wasn't always like that. The same information many people hand out as part of loan applications when they are asked for their tax returns as well as the IRS and other places. Hell, I had to do it in March and my AGI for 2014 is in god knows how many people's hands. Once again, that is a username and not a password. 1) Passwords are secret credentials possessed by one trusted party, yourself. 2) The hashed representation of which is stored by the opposing party for verification. You keep listing publicly available authentication factors which are effectively usernames, just like a SSN. If you need me to clarify further, I can. I'm just genuinely horrified people treat these things as confidential because they are not. I feel this is alot like my conversation here: https://news.ycombinator.com/item?id=11447435 https://news.ycombinator.com/item?id=11447435 People, even IT professionals, seem genuinely ignorant of the fact this data is essentially public knowledge and it simply requires a small amount of [potentially illegal] effort to acquire. They then go and build authentication schemes based on this information on the assumption literally no one on the planet is a criminal. That isn't "security" for anything that involving real money.

Until the IRS stops using social security numbers to file, it's insecure.

by nxzero 11y ago

Until the IRS stops using social security numbers to file, it's insecure.

> Until the IRS stops using social security numbers to file, it's insecure. But if they move to another form of unique identifier, that'll just shift the fraud to that new identifier. The problem with SSN's isn't the IRS using them, it's everyone else using them as a de facto national ID number.

zeveb 11y ago
They could move to a chip-and-pin smart card, e.g. a Common Access Card[0]. I know that a lot of folks don't want a national ID card. I don't either. But that's easy enough with a smart PKI: the federal government and its agencies can trust the state governments' issuing agencies. Each state could issue CAC-like cards to its citizens, and then those folks could sign their taxes and conduct other official business. It'd probably end up relied upon by other vendors, just like Social Security numbers, but at least a) it'd be more secure b) it'd be breakable only by the government, rather than by the government and anyone else. [0] https://en.wikipedia.org/wiki/Common_Access_Card https://en.wikipedia.org/wiki/Common_Access_Card
- x1798DE 11y ago
  Something like a proper authentication protocol would be useful for sure, but I would bet good money that the government would roll out some weird homebrew nonsense that would be compromised in hours. Not to make the perfect the enemy of the good, but realistically I doubt we'd get anything actually secure.
  - zeveb 11y ago
    > Something like a proper authentication protocol would be useful for sure, but I would bet good money that the government would roll out some weird homebrew nonsense that would be compromised in hours. Did you read the linked article? CACs are in use by the DOD and have been for years.
- toomuchtodo 11y ago
  Estonia does this [1], and it works brilliantly. https://en.wikipedia.org/wiki/Estonian_ID_card https://en.wikipedia.org/wiki/Estonian_ID_card
- Shivetya 11y ago
  well the issue here is that the right will fight against a national id card on the basis of big brother and privacy and the left will claim it leads to disenfranchisement. both sides need to recognize that if absolute indemnification is required for tax purposes it is as well for voting rights because it protects both equally. the challenge is how to keep confirm the card is really held by the person holding it. pin numbers don't cut it
vox_mollis 11y ago
Right. One clear path to dramatically reducing fraud would be to eliminate the prevalence of refunds, thus eliminating the INCENTIVE for fraud. Instead of calculating exemptions and deductions on already-earned income, establish an accurate deduction schedule up-front such that your expected refund is $0. Or, better yet, eliminate payroll deductions entirely and ensure everyone has a liability come April. Pretty hard to defraud a liability.
- rodovich 11y ago
  > Or, better yet, eliminate payroll deductions entirely and ensure everyone has a liability come April. Pretty hard to defraud a liability. Much easier to not pay a liability -- especially if it's a double-digit percentage of your annual income, and not just a small rounding error like it typically is today.
- justinlardinois 11y ago
  > One clear path to dramatically reducing fraud would be to eliminate the prevalence of refunds, thus eliminating the INCENTIVE for fraud. This is good from a rational point of view, but there's a large number of people who enjoy having large tax refunds because they perceive it as free money. I'm not defending that mindset, but it would be hard to get people to get over it. > Or, better yet, eliminate payroll deductions entirely and ensure everyone has a liability come April. Part of the reason we have payroll deductions in the first place is that the government understandably doesn't trust people to save up money to pay their income taxes every year; it's much easier to deduct roughly how much someone owes and then settle the difference every April and much more likely to end with the government getting somewhat close to how much it's owed. I can't imagine how many people would have unpaid taxes each year, but it would be an insanely high number. I'm sure the tax relief assistance industry would love it, though.

fweespee_ch 11y ago

> Until the IRS stops using social security numbers to file, it's insecure. If it treated SSNs as a username and required everyone to generate some unique passwords...it would work.

apaprocki 11y ago
... like it already does? Since 2008 the IRS has required a security PIN code to e-file. It's not the most secure system in the world, but everyone needs to understand you can't just e-file someone's taxes by knowing their SSN.
- fweespee_ch 11y ago
  http://krebsonsecurity.com/2016/03/irs-suspends-insecure-get-ip-pin-feature/ http://krebsonsecurity.com/2016/03/irs-suspends-insecure-get... That isn't a password and its basically available based on public information, just like a SSN. The IRS created a system that is literally another username and called it a PIN.
  - apaprocki 11y ago
    The original PINs were sent in the mail and in order to retrieve it you had to fill in the AGI from the previous year's return, not those credit-bureau challenge/response questions. It seems they created some vulnerability there, but it wasn't always like that.
    - fweespee_ch 11y ago
      > The original PINs were sent in the mail and in order to retrieve it you had to fill in the AGI from the previous year's return, not those credit-bureau challenge/response questions. It seems they created some vulnerability there, but it wasn't always like that. The same information many people hand out as part of loan applications when they are asked for their tax returns as well as the IRS and other places. Hell, I had to do it in March and my AGI for 2014 is in god knows how many people's hands. Once again, that is a username and not a password. 1) Passwords are secret credentials possessed by one trusted party, yourself. 2) The hashed representation of which is stored by the opposing party for verification. You keep listing publicly available authentication factors which are effectively usernames, just like a SSN. If you need me to clarify further, I can. I'm just genuinely horrified people treat these things as confidential because they are not. I feel this is alot like my conversation here: https://news.ycombinator.com/item?id=11447435 https://news.ycombinator.com/item?id=11447435 People, even IT professionals, seem genuinely ignorant of the fact this data is essentially public knowledge and it simply requires a small amount of [potentially illegal] effort to acquire. They then go and build authentication schemes based on this information on the assumption literally no one on the planet is a criminal. That isn't "security" for anything that involving real money.