18 ms·

IRS to ditch biometric requirement for online access

399 points by bonyt 5y ago

tims33 5y ago
IRS press release: https://www.irs.gov/newsroom/irs-announces-transition-away-from-use-of-third-party-verification-involving-facial-recognition https://www.irs.gov/newsroom/irs-announces-transition-away-f... Great news for everyone here. I still don't know how this provider was actually selected, but at least this change came relatively quickly.
throwawaysea 5y ago
What I would like to see next is an investigation into why this process was considered at all and how the vendor was selected. I find this entire situation deeply suspicious, since MOST online services (including financial services) do not need this kind of invasive verification process and do not require interfacing with a random third-party. My cynical guess is that id.me has some connection (like via political donations) to those who had the power to effect this change. It also looks like many states use id.me for various purposes (example https://www.reuters.com/business/states-using-idme-rival-identity-check-tools-jobless-claims-2021-07-22/ https://www.reuters.com/business/states-using-idme-rival-ide...). I would also want those decisions revisited and investigated.
- lotsofpulp 5y ago
  It is even more suspicious why ID.me would even be thought of when login.gov exists. Let us also find out why a non governmental entity is handling security screenings: https://en.wikipedia.org/wiki/Clear_Secure https://en.wikipedia.org/wiki/Clear_Secure
  - cheese_van 5y ago
    >Let us also find out why a non governmental entity is handling * Ex-gov here. It is baked into gov thinking that the most desirable solution to difficult problems is to give it to the commercial sector. To a degree, it recognizes that a core responsibility of US gov is to support US commerce. One may argue how that philosophy encourages certain forms of corruption (swinging door, price abominations etc) but it's an accepted cost of doing business. What's good for GM is still, in those corridors, felt to be good for America. I'm not arguing that this is a good thing. But it's how US gov thinks. That is why these problems are farmed out to the commercial sector. And as ex-gov, I can tell you that the government is a cash cow. And that's how they like it. And business. They like that too.
    - scotuswroteus 5y ago
      Has anyone identified which politician or subset of politicians helped give this specific idea life? Not the general one about contracting out work through bidding where the circumstances call for it. The specific one about doing so as a global approach to such an extent that we have non government entities handling so many core competencies.
- ribosometronome 5y ago
  >why this process was considered at all Tax Refund theft. The IRS pays out billions every year in returns filed by scammers.
toomuchtodo 5y ago
Success is possible. Fingers crossed Login.gov is the solution they’re moving to [1]. Big thanks to everyone who complained to the IRS or their Congressional reps. Onward to yeeting ID.me from state and local government next [2]. [1] “The IRS will also continue to work with its cross-government partners to develop authentication methods that protect taxpayer data and ensure broad access to online tools.” (From IRS’ press release on the topic in a sibling comment) [2] https://www.gsa.gov/blog/2021/02/18/logingov-to-provide-authentication-and-identity-proofing-services-to-a-limited-number-of-federally-funded-state-and-local-government-programs https://www.gsa.gov/blog/2021/02/18/logingov-to-provide-auth...
AdmiralAsshat 5y ago
The fact that this was even being considered shows how pitifully little anyone learned from the Equifax breach.
- imglorp 5y ago
  Forget Equifax ... how about the Office of Personnel Management? People may well have lost their lives as a result. We may not know for decades. https://www.lawfareblog.com/why-opm-hack-far-worse-you-imagine https://www.lawfareblog.com/why-opm-hack-far-worse-you-imagi... Oh, and the IRS has already been breached at least once. I'm not wild about waiting for the next one. Maybe government is not the best group to be holding your personal data. https://www.nytimes.com/2015/05/27/business/breach-exposes-irs-tax-returns.html https://www.nytimes.com/2015/05/27/business/breach-exposes-i...
  - woodruffw 5y ago
    All things being equal, the US government is simultaneously (1) the single most legitimate non-medical third party that needs to access my personal data, and (2) the single best entity to hold my data in terms of personal recourse. That's not saying much, but it is better than the open scorn and disrespect for my privacy that corporations offer. The solution to government breaches is what it's always been: to make the breached data less valuable. Hacking the IRS would be significantly less appealing if we criminalized corporate use of SSNs as credentials.
    - imglorp 5y ago
      Good point, gov has less reason to sell your data
      - dylan604 5y ago
        Yeah, that federal deficit surely doesn't need any help getting paid down /s However, this isn't to say that someone doesn't get the bright idea that they could fund some sort of slush fund with this.
ipsin 5y ago
So for anyone who's already used id.me, how hard will it be to purge the biometrics? (And same question for if you live in California)
strangesongs 5y ago
“Login.gov is already used to access 200 websites run by 28 Federal agencies and over 40 million Americans have accounts,” Wyden wrote in a letter to the IRS today. “Unfortunately, login.gov has not yet reached its full potential, in part because many agencies have flouted the Congressional mandate that they use it, and because successive Administrations have failed to prioritize digital identity. The cost of this inaction has been billions of dollars in fraud, which has in turn fueled a black market for stolen personal data, and enabled companies like ID.me to commercialize what should be a core government service.” not great!
- StanislavPetrov 5y ago
  Not great that there is billions of dollars in fraud or that the government uses a private company to harvest and retain the biometric data of over 40 million Americans. Great that the IRS is no longer part of this biometric data harvesting scheme that represents a massive attack on the privacy and dignity of every taxpayer.
- jackson1442 5y ago
  I was extremely confused when I was asked to create an ID.me account for IRS. I have implemented Login.gov for some projects and it's rather easy; I can't see why they'd choose something else.
  - Spooky23 5y ago
    Easy, the answer is right here: https://developers.login.gov/overview https://developers.login.gov/overview Login.gov is a fine authentication service, but cannot deliver the identity assurance level (IAL-2) required to identify people. (It may not be able to deliver AAL-2 authentication soon either as standard evolve.) Uploading a picture of your drivers license is not a meaningful validation of your identity. The reaction of the Senators here is the equivalent of “I’m shocked to hear there is gambling happening here”. Typical pandering. Literally every drivers license and ID in the country is running through a biometric identity provider run by a contractor to identity duplicate licenses. Many DMVs outsource credential production to a third party. I don’t think ID.me is the best solution, but it is better than providing a trivially stolen number “what was your AGI last year” that facilitates billions of dollars of fraud annually.
helper 5y ago
Now we just need to get all the state government agencies to drop this requirement as well (looking at you, California).
WalterGR 5y ago
124 comments about a week back: https://news.ycombinator.com/item?id=30126118 https://news.ycombinator.com/item?id=30126118
- dang 5y ago
  Thanks! Macroexpanded: Treasury reconsiders IRS’s use of ID.me face recognition for web - https://news.ycombinator.com/item?id=30126118 https://news.ycombinator.com/item?id=30126118 - Jan 2022 (121 comments) IRS Will Require Facial Recognition Scans to Access Your Taxes - https://news.ycombinator.com/item?id=30011145 https://news.ycombinator.com/item?id=30011145 - Jan 2022 (20 comments) IRS Will Soon Require Selfies for Online Access - https://news.ycombinator.com/item?id=29996614 https://news.ycombinator.com/item?id=29996614 - Jan 2022 (428 comments)
mwexler 5y ago
Hmm... In the US, login.gov still uses id.me for verification (at least on new signup), and this is the sso for TSA stuff like Global Entry, and the Social Security site. I guess it's used "less" now, but is still present for US Government services.
theduder99 5y ago
thank goodness. I received an ambiguous letter from the IRS last week talking about how I may need to file something special this year related to the $1400 covid credit. I was going to login to the IRS site to get more details until I saw the facial ID requirement and quickly noped away from there.
mistrial9 5y ago
here is a repeat of my comment a few weeks ago, which scored 134 on YNews. This was about using biometrics for getting social benefits.. later, someone said "hey! I object, taxes are not benefits" and I reply "the similarity is that biometric requirement to use (obviously efficient) online services. That includes both social benefits like unemployment, and also required interaction like taxes" .. hope that clears it up the core of the thought is -- if the government interaction is flawed such that it is not actually doing only what it says it is doing, to the detriment of most ordinary people, and is subject to insider gaming with rewards to do so THEN additional and perhaps draconian requirements on the ordinary individual, do not solve the flaws, burden and antagonize an ordinary person, and the implementation becomes a new attention target WITH new penalties attached, for the ordinary person. hth -- American here "perhaps better known as the online identity verification service that many states now use to help staunch the loss of billions of dollars in unemployment insurance and pandemic assistance stolen each year by identity thieves" In the great State of California, billions in unemployment benefits were sent to the wrong people.. because their internal systems were designed to delay, deny and deprive, I say. Actual people with real jobs were repeatedly refused, while insiders who knew how to fill out paperwork, and apparently knew where the blind spots were, filed hundreds of claims in the early pandemic days. A newly appointed Director (young, tech savvy woman) soon stopped making public statements, and the situation nearly two years later, is not resolved. This is at a time when California has record income to the State. Now, some people may jump on this and say "well, you see how photo ID would have helped that" and, with incomplete knowledge and personal opinion, I say no, it would not solve it. You see, people with real jobs, with every real paper filed, were denied benefits, while insiders were pulling checks with both hands, using certain kinds of identities that would slip through. How would ever more restriction, requirement and verification, have helped here? I am deeply against the collective government making ever more demands on citizens for "papers, please" enrollment to massive money social services (edit e.g. govt unemployment benefits). It is not going to have the desired effect, despite superficial evidence otherwise. Additionally this represents a slippery slope where the ability to interact as an individual will be eroded, and opportunity for insider graft will increase
deleted 5y ago
[deleted]
google234123 5y ago
Well, hopefully we wont have a 100+ billion dollars stolen from the US this year b/c of this decision.
hannibalhorn 5y ago
I actually gave it a try, and couldn't successfully signup due to the phone number check, even though my name is on the line. Figure I've wasted a couple hours on it in total. Unnecessary friction.
1121redblackgo 5y ago
I appreciate the institutional awareness and leadership and culture that, in this instance, is leading to the IRS changing their mind.
Unklejoe 5y ago
Well now I feel like an idiot for signing up. Is there any way to have ID.me delete all of my records? Or is that a lost cause?
- 3-cheese-sundae 5y ago
  To delete your account, follow this: https://help.id.me/hc/en-us/articles/203532014-How-do-I-close-delete-my-ID-me-account- https://help.id.me/hc/en-us/articles/203532014-How-do-I-clos... And now for some contradictory information, straight from id.me, which may indicate it's a lost cause. On that page it says: "What happens to my deleted account? Your account information is purged. After seven days, you can create a new ID.me account with the same email address you used in the one that was deleted." However, when following that exact process on the site, it states: "If you decide to create a new ID.me account (at any point in the future), you will not be allowed to use the email address(es) lined to your previous account." Both locations state: "ID.me will retain a portion of your account's attributes on file to comply with applicable laws and help us prevent fraud."
- neither_color 5y ago
  We really need our own version of the EU's right to be forgotten. https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/
operatingthetan 5y ago
I had a phone screen at ID.me and then some of the articles came out and I started looking more into them. They tried to have me start doing interviews but I declined. I watched a motivational video from their CEO and his energy was a bit of a turn off as well.
stjohnswarts 5y ago
I suspect this is more of a pause until it blows over.
NaturalPhallacy 5y ago
Oregon Unemployment uses it too. It's the most difficult login process I've ever encountered and I've lived on the internet since 1996. The fact that it's the only vendor you can use should be illegal. This barrier has been put between Oregonians and the unemployment benefits they're entitled to. <- This is a bigger story IMHO.
__coaxialcabal 5y ago
What was the vendor selection process for ID.me? Their UX, privacy, and security practices seem terrible. What’s the real story on how ID.me became so pervasive in the public sector with such a terrible product?
- Terretta 5y ago
  Gov cyber security, financial services cyber security, and anyone else who puts on their home page how they “take your security seriously”, all want to buy from ex mil execs. Must be to manage all that military grade encryption between your browser and their web site.
  - __coaxialcabal 5y ago
    ID.me does not have a monopoly on former military in the IDV space. Understand that lots of former military have clearance, relationships, etc., but does not explain the success of such a low quality solution being this ubiquitous in government at both the state and local level.
- strong2024 5y ago
  They are FedRAMP moderate, which follows NIST SP 800-53, so it can't be that bad?
knowaveragejoe 5y ago
pyronik19 5y ago
But it's somehow racist to show ID to vote.
- TheHypnotist 5y ago
  I'm glad you put the time and effort to look into some of the reasons they used in their decision to not implement it, particularly those mentioned in the article.
- scotuswroteus 5y ago
guerrilla 5y ago
Do people need to care about this if they're filing online with a firm like H&R Block?
- niij 5y ago
  No. But do note that H&R Block (along with Intuit and others) pay lobbyists to make filing your taxes a difficult costly process. I'd recommend using https://freetaxusa.com https://freetaxusa.com (legit, great site for only $15) or paying a local, independent CPA, to file your taxes instead. https://www.propublica.org/article/filing-taxes-could-be-free-simple-hr-block-intuit-lobbying-against-it https://www.propublica.org/article/filing-taxes-could-be-fre...
  - guerrilla 5y ago
    I'm aware of the cartel and their lobbying. Unfortunately I doubt FreeTaxUSA will work for me as ex-patriot in a slightly complicated situation and there are no CPAs here. I'll check it out though, thanks.
    - aww_dang 5y ago
      Expatriates still have a few cheapish options. Taxes for Expats or Expatfile. The first has more options for having a CPA. The second is self-serve.
      - guerrilla 5y ago
        The first is more expensive than what I use from H&R last time I looked; I'll check out the second, thanks.
    - niij 5y ago
      Oh, no! I'm sorry you have to deal with that situation. I've heard filing as an expat is terrible with FATCA reporting etc. I'm planning to move out of the country in retirement but it's still years away for me. If you don't mind me asking: how does managing your financial accounts work where you are? Do you still maintain USA bank/investment/retirements accounts (via mail forwarding?) or do you have them open in your country? What types of hurdles do you run into?
idontwantthis 5y ago
Was this just a Theranos level scam? It simply didn't work, right? I uploaded perfect scans of my passport and driver's license and it couldn't recognize them, so I had to wait several hours to video chat with a real person, who confirmed my identity.
jakeogh 5y ago
"Why come you don't have a tattoo?" -2006 Damn those anti-chippers!
furyg3 5y ago
I recently needed to access some information on the IRS website, and had to do a 3 hour, very annoying, ID.me registration. Everything failed. The OCR software thought the issue date of my passport was my birthday (so I wasn't old enough to register), fail. The 'link' they send via SMS to take photos of your ID, failed (wouldn't load). A VPN was needed to do some steps from outside the US. I was kicked out of the 'queue' twice to video call with a human where I have to hold up my 'biometric' printed-on-paper social security card. The killer? This morning I woke up to spam emails from ID.me offering me a discount on my first blue apron meal order. Where I am in the Netherlands there is a government-issued digital ID (DigID), that was very straightforward to sign up for and easy to use.
- ipython 5y ago
  I’m glad you mentioned the spam from id.me. When I first came across it a few years ago I thought it was a scam due to the heavy marketing of third party “deals” on the site. Not a good look.
raresp 5y ago
Interesting news. But I see a lot of negative comments regarding the biometrics. Here's my two cents. I'm the founder of a biometric users identity check solution, called Typing AI Biometrics ( https://typing.ai https://typing.ai ). We identify users by the way they type. Typing biometrics can be used as a two factor (2FA) or multi factor (MFA) authentication method. Instead of combining the usual username + password with an OTP code that you recive on your smartphone or email, you can combine the basic username + password with a typing pattern check, it's much more secure and efficient. The typing signature translated into a 300+ encrypted characters hash, which is (up until now) impossible to break. You can even remove the username + password and combine the typing biometrics check (known as keystroke dynamics) with an OTP verification. Biometrics are the future of authentication and authorization, because they are unique to each person, but only with the promise of not keeping and sharing the users data. You can AMA on this Show HN thread: https://news.ycombinator.com/item?id=30130447 https://news.ycombinator.com/item?id=30130447
- gigaflop 5y ago
  So then, I need to type the same password the same way every time? If I set up an account while I'm still waking up, and then try to use it after lunch and coffee, wouldn't I get locked out due to inputting faster than expected? Or what if I'm on the phone with someone, and trying to type with one hand? That would probably lock me out, right?
  - jfk13 5y ago
    How about when I break my wrist and it's in plaster for a couple of weeks? Seems unlikely that I'll maintain my characteristic typing pattern well enough to be recognised...
    - raresp 5y ago
      "How about when I break my wrist and it's in plaster for a couple of weeks?" - good question. Your "one-hand" typing is totally different than writing with two hands but we also got this covered. The authenticity detection rate won't be over 90%, but it will still be over 80%. In case of using the Typing AI as a two factor auth method, you can just skip to using a different factor, such as fingerprint/face recognition or OTP.
oversocialized 5y ago
Great - now lets fix Home Depot. As of Feb 1, veterans only receive their 10% discount if they submit their photo id to a website and use a phone at the register.

399 points by bonyt 5y ago

IRS press release: https://www.irs.gov/newsroom/irs-announces-transition-away-from-use-of-third-party-verification-involving-facial-recognition https://www.irs.gov/newsroom/irs-announces-transition-away-f... Great news for everyone here. I still don't know how this provider was actually selected, but at least this change came relatively quickly.

throwawaysea 5y ago

What I would like to see next is an investigation into why this process was considered at all and how the vendor was selected. I find this entire situation deeply suspicious, since MOST online services (including financial services) do not need this kind of invasive verification process and do not require interfacing with a random third-party. My cynical guess is that id.me has some connection (like via political donations) to those who had the power to effect this change. It also looks like many states use id.me for various purposes (example https://www.reuters.com/business/states-using-idme-rival-identity-check-tools-jobless-claims-2021-07-22/ https://www.reuters.com/business/states-using-idme-rival-ide...). I would also want those decisions revisited and investigated.

lotsofpulp 5y ago
It is even more suspicious why ID.me would even be thought of when login.gov exists. Let us also find out why a non governmental entity is handling security screenings: https://en.wikipedia.org/wiki/Clear_Secure https://en.wikipedia.org/wiki/Clear_Secure
- cheese_van 5y ago
  >Let us also find out why a non governmental entity is handling * Ex-gov here. It is baked into gov thinking that the most desirable solution to difficult problems is to give it to the commercial sector. To a degree, it recognizes that a core responsibility of US gov is to support US commerce. One may argue how that philosophy encourages certain forms of corruption (swinging door, price abominations etc) but it's an accepted cost of doing business. What's good for GM is still, in those corridors, felt to be good for America. I'm not arguing that this is a good thing. But it's how US gov thinks. That is why these problems are farmed out to the commercial sector. And as ex-gov, I can tell you that the government is a cash cow. And that's how they like it. And business. They like that too.
  - scotuswroteus 5y ago
    Has anyone identified which politician or subset of politicians helped give this specific idea life? Not the general one about contracting out work through bidding where the circumstances call for it. The specific one about doing so as a global approach to such an extent that we have non government entities handling so many core competencies.
ribosometronome 5y ago
>why this process was considered at all Tax Refund theft. The IRS pays out billions every year in returns filed by scammers.

toomuchtodo 5y ago

Success is possible. Fingers crossed Login.gov is the solution they’re moving to [1]. Big thanks to everyone who complained to the IRS or their Congressional reps. Onward to yeeting ID.me from state and local government next [2]. [1] “The IRS will also continue to work with its cross-government partners to develop authentication methods that protect taxpayer data and ensure broad access to online tools.” (From IRS’ press release on the topic in a sibling comment) [2] https://www.gsa.gov/blog/2021/02/18/logingov-to-provide-authentication-and-identity-proofing-services-to-a-limited-number-of-federally-funded-state-and-local-government-programs https://www.gsa.gov/blog/2021/02/18/logingov-to-provide-auth...

AdmiralAsshat 5y ago

The fact that this was even being considered shows how pitifully little anyone learned from the Equifax breach.

imglorp 5y ago
Forget Equifax ... how about the Office of Personnel Management? People may well have lost their lives as a result. We may not know for decades. https://www.lawfareblog.com/why-opm-hack-far-worse-you-imagine https://www.lawfareblog.com/why-opm-hack-far-worse-you-imagi... Oh, and the IRS has already been breached at least once. I'm not wild about waiting for the next one. Maybe government is not the best group to be holding your personal data. https://www.nytimes.com/2015/05/27/business/breach-exposes-irs-tax-returns.html https://www.nytimes.com/2015/05/27/business/breach-exposes-i...
- woodruffw 5y ago
  All things being equal, the US government is simultaneously (1) the single most legitimate non-medical third party that needs to access my personal data, and (2) the single best entity to hold my data in terms of personal recourse. That's not saying much, but it is better than the open scorn and disrespect for my privacy that corporations offer. The solution to government breaches is what it's always been: to make the breached data less valuable. Hacking the IRS would be significantly less appealing if we criminalized corporate use of SSNs as credentials.
  - imglorp 5y ago
    Good point, gov has less reason to sell your data
    - dylan604 5y ago
      Yeah, that federal deficit surely doesn't need any help getting paid down /s However, this isn't to say that someone doesn't get the bright idea that they could fund some sort of slush fund with this.

ipsin 5y ago

So for anyone who's already used id.me, how hard will it be to purge the biometrics? (And same question for if you live in California)

strangesongs 5y ago

“Login.gov is already used to access 200 websites run by 28 Federal agencies and over 40 million Americans have accounts,” Wyden wrote in a letter to the IRS today. “Unfortunately, login.gov has not yet reached its full potential, in part because many agencies have flouted the Congressional mandate that they use it, and because successive Administrations have failed to prioritize digital identity. The cost of this inaction has been billions of dollars in fraud, which has in turn fueled a black market for stolen personal data, and enabled companies like ID.me to commercialize what should be a core government service.” not great!

StanislavPetrov 5y ago
Not great that there is billions of dollars in fraud or that the government uses a private company to harvest and retain the biometric data of over 40 million Americans. Great that the IRS is no longer part of this biometric data harvesting scheme that represents a massive attack on the privacy and dignity of every taxpayer.
jackson1442 5y ago
I was extremely confused when I was asked to create an ID.me account for IRS. I have implemented Login.gov for some projects and it's rather easy; I can't see why they'd choose something else.
- Spooky23 5y ago
  Easy, the answer is right here: https://developers.login.gov/overview https://developers.login.gov/overview Login.gov is a fine authentication service, but cannot deliver the identity assurance level (IAL-2) required to identify people. (It may not be able to deliver AAL-2 authentication soon either as standard evolve.) Uploading a picture of your drivers license is not a meaningful validation of your identity. The reaction of the Senators here is the equivalent of “I’m shocked to hear there is gambling happening here”. Typical pandering. Literally every drivers license and ID in the country is running through a biometric identity provider run by a contractor to identity duplicate licenses. Many DMVs outsource credential production to a third party. I don’t think ID.me is the best solution, but it is better than providing a trivially stolen number “what was your AGI last year” that facilitates billions of dollars of fraud annually.

helper 5y ago

Now we just need to get all the state government agencies to drop this requirement as well (looking at you, California).

WalterGR 5y ago

124 comments about a week back: https://news.ycombinator.com/item?id=30126118 https://news.ycombinator.com/item?id=30126118

dang 5y ago
Thanks! Macroexpanded: Treasury reconsiders IRS’s use of ID.me face recognition for web - https://news.ycombinator.com/item?id=30126118 https://news.ycombinator.com/item?id=30126118 - Jan 2022 (121 comments) IRS Will Require Facial Recognition Scans to Access Your Taxes - https://news.ycombinator.com/item?id=30011145 https://news.ycombinator.com/item?id=30011145 - Jan 2022 (20 comments) IRS Will Soon Require Selfies for Online Access - https://news.ycombinator.com/item?id=29996614 https://news.ycombinator.com/item?id=29996614 - Jan 2022 (428 comments)

mwexler 5y ago

Hmm... In the US, login.gov still uses id.me for verification (at least on new signup), and this is the sso for TSA stuff like Global Entry, and the Social Security site. I guess it's used "less" now, but is still present for US Government services.

theduder99 5y ago

thank goodness. I received an ambiguous letter from the IRS last week talking about how I may need to file something special this year related to the $1400 covid credit. I was going to login to the IRS site to get more details until I saw the facial ID requirement and quickly noped away from there.

mistrial9 5y ago

here is a repeat of my comment a few weeks ago, which scored 134 on YNews. This was about using biometrics for getting social benefits.. later, someone said "hey! I object, taxes are not benefits" and I reply "the similarity is that biometric requirement to use (obviously efficient) online services. That includes both social benefits like unemployment, and also required interaction like taxes" .. hope that clears it up the core of the thought is -- if the government interaction is flawed such that it is not actually doing only what it says it is doing, to the detriment of most ordinary people, and is subject to insider gaming with rewards to do so THEN additional and perhaps draconian requirements on the ordinary individual, do not solve the flaws, burden and antagonize an ordinary person, and the implementation becomes a new attention target WITH new penalties attached, for the ordinary person. hth -- American here "perhaps better known as the online identity verification service that many states now use to help staunch the loss of billions of dollars in unemployment insurance and pandemic assistance stolen each year by identity thieves" In the great State of California, billions in unemployment benefits were sent to the wrong people.. because their internal systems were designed to delay, deny and deprive, I say. Actual people with real jobs were repeatedly refused, while insiders who knew how to fill out paperwork, and apparently knew where the blind spots were, filed hundreds of claims in the early pandemic days. A newly appointed Director (young, tech savvy woman) soon stopped making public statements, and the situation nearly two years later, is not resolved. This is at a time when California has record income to the State. Now, some people may jump on this and say "well, you see how photo ID would have helped that" and, with incomplete knowledge and personal opinion, I say no, it would not solve it. You see, people with real jobs, with every real paper filed, were denied benefits, while insiders were pulling checks with both hands, using certain kinds of identities that would slip through. How would ever more restriction, requirement and verification, have helped here? I am deeply against the collective government making ever more demands on citizens for "papers, please" enrollment to massive money social services (edit e.g. govt unemployment benefits). It is not going to have the desired effect, despite superficial evidence otherwise. Additionally this represents a slippery slope where the ability to interact as an individual will be eroded, and opportunity for insider graft will increase

deleted 5y ago

[deleted]

google234123 5y ago

Well, hopefully we wont have a 100+ billion dollars stolen from the US this year b/c of this decision.

hannibalhorn 5y ago

I actually gave it a try, and couldn't successfully signup due to the phone number check, even though my name is on the line. Figure I've wasted a couple hours on it in total. Unnecessary friction.

1121redblackgo 5y ago

I appreciate the institutional awareness and leadership and culture that, in this instance, is leading to the IRS changing their mind.

Unklejoe 5y ago

Well now I feel like an idiot for signing up. Is there any way to have ID.me delete all of my records? Or is that a lost cause?

3-cheese-sundae 5y ago
To delete your account, follow this: https://help.id.me/hc/en-us/articles/203532014-How-do-I-close-delete-my-ID-me-account- https://help.id.me/hc/en-us/articles/203532014-How-do-I-clos... And now for some contradictory information, straight from id.me, which may indicate it's a lost cause. On that page it says: "What happens to my deleted account? Your account information is purged. After seven days, you can create a new ID.me account with the same email address you used in the one that was deleted." However, when following that exact process on the site, it states: "If you decide to create a new ID.me account (at any point in the future), you will not be allowed to use the email address(es) lined to your previous account." Both locations state: "ID.me will retain a portion of your account's attributes on file to comply with applicable laws and help us prevent fraud."
neither_color 5y ago
We really need our own version of the EU's right to be forgotten. https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/

operatingthetan 5y ago

I had a phone screen at ID.me and then some of the articles came out and I started looking more into them. They tried to have me start doing interviews but I declined. I watched a motivational video from their CEO and his energy was a bit of a turn off as well.

stjohnswarts 5y ago

I suspect this is more of a pause until it blows over.

NaturalPhallacy 5y ago

Oregon Unemployment uses it too. It's the most difficult login process I've ever encountered and I've lived on the internet since 1996. The fact that it's the only vendor you can use should be illegal. This barrier has been put between Oregonians and the unemployment benefits they're entitled to. <- This is a bigger story IMHO.

__coaxialcabal 5y ago

What was the vendor selection process for ID.me? Their UX, privacy, and security practices seem terrible. What’s the real story on how ID.me became so pervasive in the public sector with such a terrible product?

Terretta 5y ago
Gov cyber security, financial services cyber security, and anyone else who puts on their home page how they “take your security seriously”, all want to buy from ex mil execs. Must be to manage all that military grade encryption between your browser and their web site.
- __coaxialcabal 5y ago
  ID.me does not have a monopoly on former military in the IDV space. Understand that lots of former military have clearance, relationships, etc., but does not explain the success of such a low quality solution being this ubiquitous in government at both the state and local level.
strong2024 5y ago
They are FedRAMP moderate, which follows NIST SP 800-53, so it can't be that bad?

knowaveragejoe 5y ago

pyronik19 5y ago

But it's somehow racist to show ID to vote.

TheHypnotist 5y ago
I'm glad you put the time and effort to look into some of the reasons they used in their decision to not implement it, particularly those mentioned in the article.
scotuswroteus 5y ago

guerrilla 5y ago

Do people need to care about this if they're filing online with a firm like H&R Block?

niij 5y ago
No. But do note that H&R Block (along with Intuit and others) pay lobbyists to make filing your taxes a difficult costly process. I'd recommend using https://freetaxusa.com https://freetaxusa.com (legit, great site for only $15) or paying a local, independent CPA, to file your taxes instead. https://www.propublica.org/article/filing-taxes-could-be-free-simple-hr-block-intuit-lobbying-against-it https://www.propublica.org/article/filing-taxes-could-be-fre...
- guerrilla 5y ago
  I'm aware of the cartel and their lobbying. Unfortunately I doubt FreeTaxUSA will work for me as ex-patriot in a slightly complicated situation and there are no CPAs here. I'll check it out though, thanks.
  - aww_dang 5y ago
    Expatriates still have a few cheapish options. Taxes for Expats or Expatfile. The first has more options for having a CPA. The second is self-serve.
    - guerrilla 5y ago
      The first is more expensive than what I use from H&R last time I looked; I'll check out the second, thanks.
  - niij 5y ago
    Oh, no! I'm sorry you have to deal with that situation. I've heard filing as an expat is terrible with FATCA reporting etc. I'm planning to move out of the country in retirement but it's still years away for me. If you don't mind me asking: how does managing your financial accounts work where you are? Do you still maintain USA bank/investment/retirements accounts (via mail forwarding?) or do you have them open in your country? What types of hurdles do you run into?

idontwantthis 5y ago

Was this just a Theranos level scam? It simply didn't work, right? I uploaded perfect scans of my passport and driver's license and it couldn't recognize them, so I had to wait several hours to video chat with a real person, who confirmed my identity.

jakeogh 5y ago

"Why come you don't have a tattoo?" -2006 Damn those anti-chippers!

furyg3 5y ago

I recently needed to access some information on the IRS website, and had to do a 3 hour, very annoying, ID.me registration. Everything failed. The OCR software thought the issue date of my passport was my birthday (so I wasn't old enough to register), fail. The 'link' they send via SMS to take photos of your ID, failed (wouldn't load). A VPN was needed to do some steps from outside the US. I was kicked out of the 'queue' twice to video call with a human where I have to hold up my 'biometric' printed-on-paper social security card. The killer? This morning I woke up to spam emails from ID.me offering me a discount on my first blue apron meal order. Where I am in the Netherlands there is a government-issued digital ID (DigID), that was very straightforward to sign up for and easy to use.

ipython 5y ago
I’m glad you mentioned the spam from id.me. When I first came across it a few years ago I thought it was a scam due to the heavy marketing of third party “deals” on the site. Not a good look.

raresp 5y ago

Interesting news. But I see a lot of negative comments regarding the biometrics. Here's my two cents. I'm the founder of a biometric users identity check solution, called Typing AI Biometrics ( https://typing.ai https://typing.ai ). We identify users by the way they type. Typing biometrics can be used as a two factor (2FA) or multi factor (MFA) authentication method. Instead of combining the usual username + password with an OTP code that you recive on your smartphone or email, you can combine the basic username + password with a typing pattern check, it's much more secure and efficient. The typing signature translated into a 300+ encrypted characters hash, which is (up until now) impossible to break. You can even remove the username + password and combine the typing biometrics check (known as keystroke dynamics) with an OTP verification. Biometrics are the future of authentication and authorization, because they are unique to each person, but only with the promise of not keeping and sharing the users data. You can AMA on this Show HN thread: https://news.ycombinator.com/item?id=30130447 https://news.ycombinator.com/item?id=30130447

gigaflop 5y ago
So then, I need to type the same password the same way every time? If I set up an account while I'm still waking up, and then try to use it after lunch and coffee, wouldn't I get locked out due to inputting faster than expected? Or what if I'm on the phone with someone, and trying to type with one hand? That would probably lock me out, right?
- jfk13 5y ago
  How about when I break my wrist and it's in plaster for a couple of weeks? Seems unlikely that I'll maintain my characteristic typing pattern well enough to be recognised...
  - raresp 5y ago
    "How about when I break my wrist and it's in plaster for a couple of weeks?" - good question. Your "one-hand" typing is totally different than writing with two hands but we also got this covered. The authenticity detection rate won't be over 90%, but it will still be over 80%. In case of using the Typing AI as a two factor auth method, you can just skip to using a different factor, such as fingerprint/face recognition or OTP.

oversocialized 5y ago

Great - now lets fix Home Depot. As of Feb 1, veterans only receive their 10% discount if they submit their photo id to a website and use a phone at the register.