11 ms·

“Login.gov is already used to access 200 websites run by 28 Federal agencies and over 40 million Americans have accounts,” Wyden wrote in a letter to the IRS to

“Login.gov is already used to access 200 websites run by 28 Federal agencies and over 40 million Americans have accounts,” Wyden wrote in a letter to the IRS today. “Unfortunately, login.gov has not yet reached its full potential, in part because many agencies have flouted the Congressional mandate that they use it, and because successive Administrations have failed to prioritize digital identity. The cost of this inaction has been billions of dollars in fraud, which has in turn fueled a black market for stolen personal data, and enabled companies like ID.me to commercialize what should be a core government service.” not great!

StanislavPetrov 5y ago
Not great that there is billions of dollars in fraud or that the government uses a private company to harvest and retain the biometric data of over 40 million Americans. Great that the IRS is no longer part of this biometric data harvesting scheme that represents a massive attack on the privacy and dignity of every taxpayer.
jackson1442 5y ago
I was extremely confused when I was asked to create an ID.me account for IRS. I have implemented Login.gov for some projects and it's rather easy; I can't see why they'd choose something else.
- Spooky23 5y ago
  Easy, the answer is right here: https://developers.login.gov/overview https://developers.login.gov/overview Login.gov is a fine authentication service, but cannot deliver the identity assurance level (IAL-2) required to identify people. (It may not be able to deliver AAL-2 authentication soon either as standard evolve.) Uploading a picture of your drivers license is not a meaningful validation of your identity. The reaction of the Senators here is the equivalent of “I’m shocked to hear there is gambling happening here”. Typical pandering. Literally every drivers license and ID in the country is running through a biometric identity provider run by a contractor to identity duplicate licenses. Many DMVs outsource credential production to a third party. I don’t think ID.me is the best solution, but it is better than providing a trivially stolen number “what was your AGI last year” that facilitates billions of dollars of fraud annually.
  - akersten 5y ago
    No third party/private solution is appropriate here. The government that oversees the issuing of these IDs and attests that they are sufficient for government use (Real ID) cannot themselves validate said ID? Corruption or incompetence are the only paths that lead to outsourcing federal identity verification.
    - Spooky23 5y ago
      The only IDs issued widely by the US government are military credentials, immigration credentials, and passports. Driver’s licenses are issued by states and other entities. They are also fraught with problems as millions of people do not have REAL IDs, yet need to interact with government. The problem is that any bartender who has scanned your drivers license has the information required to scam an online validation without some other validation. If you want good online validation for the public, you need a third party right now. In the future, in some states, you’ll be able to use a mobile drivers license, provided you own a smartphone. Also problematic, as the government has to support everyone. Foreign nationals pay tax. People in nursing homes who cannot appear before a DMV need to pay taxes. You can yak about corruption and incompetence, but that honestly attests to ignorance on the topic.
      - toomuchtodo 5y ago
        You continue to make some good points, but at the end of the day, this is a government function and responsibility, not that of a private company. Login.gov can use the same AWS services in GovCloud as ID.me uses (Rekognition, available since 2017 in GovCloud). With USDS and 18F, it cannot be argued GSA (which Login.gov falls under) doesn’t have the skills available to build this capability. This is a call to enhance Login.gov’s identity abilities, and US government citizen identity management in general. Login.gov (and perhaps USPS for in person proofing) should be funded to do this, not ID.me. Higher level, this is about building strong public goods and defending them.
        PaulDavisThe1st 5y ago
- xenophonf 5y ago
  I've also implemented login.gov as an identity provider of last resort for a system that requires identity proofing (IAL2). It works great once folks are signed up and verified for a login.gov account, but the identity assurance process always seems to end up requiring a piece of mail sent to new users' homes. The phone/utility verification process never seems to work right, and the postal mail option adds a week's delay (or more) to our user enrollment process. In my and several test users' cases, we've had our phone numbers in our names for literally decades, so it isn't a matter of public records being ambiguous. We've also had problems getting login.gov to proof new users with national but not state IDs. For example, we have someone with a passport but no driver's license. They should be able to use just the passport for identity proofing since the passport itself requires two or more forms of SUPERIOR/STRONG evidence (per NIST SP 800-63-3), but login.gov must not authenticate the passport with the State Department, meaning it fails 800-63A 4.4.1.2 (evidence collection requirements) rule 1 and must implement rule 2, instead (collect two pieces of STRONG evidence, i.e., national _and_ state IDs both). It's really frustrating because I cannot demand my users go out and get (pay for) state IDs they don't otherwise want or need. All that said, even though login.gov isn't perfect, I do like it and am very impressed with 18F/TTS's work. They've done a very thorough job with their SAML implementation compared to the ADFSes/Oktas/Pings/etc. of the world.
- FireBeyond 5y ago
  Not to mention, ID.me is horrible. Scanned my Driver's License at 200dpi. "Unable to find a face in the image you uploaded." Okay, 300dpi. "Unable to find a face in the image you uploaded." Huh. Scan at 72dpi. Success. Scan back of DL at 72dpi. "Unable to read barcode." Scan back of DL at 200dpi. "Unable to read barcode." Scan at 300dpi. Success. What a shitshow.
  - bladegash 5y ago
    Really? Not that I particularly wanted to, but all I had to do was take a photo of the front and back using my iPhone and it went through without any problem.
  - GCA10 5y ago
    Pixel phone user here. Very similar experience.
cproctor 5y ago
If the IRS (or Sen. Wyden) is looking for a "core government service" which has been inappropriately commercialized, they might start with tax preparation.
- apex3stoker 5y ago
  This article[1] has more details. Sen. Wyden[2] has been pushing for more funding to IRS to develop its free file program, but Turbotax has been successful via their lobbying of Republican politicians and some Democratic politicians in preventing it from happening. 1. https://www.propublica.org/article/inside-turbotax-20-year-fight-to-stop-americans-from-filing-their-taxes-for-free https://www.propublica.org/article/inside-turbotax-20-year-f... 2. https://www.nytimes.com/2021/07/19/opinion/intuit-turbotax-free-filing.html https://www.nytimes.com/2021/07/19/opinion/intuit-turbotax-f...
  - memish 5y ago
  - ThunderSizzle 5y ago
    Lol. Its always the Republicans. If it was priority for the Dems, they'd have done it. They have gotten through several other things the Republicans opposed. Anyhow, the better alternative is to return to lower the rates and remove deductions (aside from the standard deduction). Even simpler yet would be to go to a flat tax with an extremely high standard deduction (e.g. ~$50k with ~10% after that). I can't think of many good reasons to continue complicating the IRS code aside from political targeting and giving Congress more kickbacks.
    - throw10920 5y ago
      This is a really good point - if the tax code were a few dozen pages for the common case instead of a few hundred, then you might not even need tax-prep software in the first place. "The best program is the one that doesn't exist", to quote a popular refrain. Ongoing software projects require periodic refactoring to reduce complexity and increase comprehension - why would the law be any different?
Rebelgecko 5y ago
I recently had to sign up for login.gov (to renew my Global Entry, after they moved away from their own one-off CBP login system) and was pleasantly surprised with how good it was. Hopefully the TreasuryDirect.gov folks migrate some day
- monksy 5y ago
  Are they still giving out those decoder cards?
  - Rebelgecko 5y ago
    You can use a CAC card as your second factor with the mandatory 2FA, but if you don't have one I think Yubikey-type devices are the only other hardware auth option
rootusrootus 5y ago
I’m very happy Wyden is my senator. I made a point the last time I was in DC to stop by his office and express my support but his staffers were profoundly uninterested. Oh well, I voted for him, not them.
fishywang 5y ago
I have used login.gov for my global entry application and I'm actually impressed. The only complaints I have with it are: 1. It doesn't make it obvious on how to add additional u2f keys (you have to go to login.gov explicitly to do that) 2. I still can't find a way to remove u2f keys But then when I used id.me with CA DMV I'm also impressed by it (granted CA DMV does not require any crazy biometric stuff there like IRS planned to do).
- mshroyer 5y ago
  > I still can't find a way to remove u2f keys When I go to login.gov and click on "Your authentication methods", each of my security keys is listed with a "Remove key" link next to it...
  - fishywang 5y ago
    Oh you are right. I didn't realize that "You authentication methods" is clickable as the UI makes it look like just a header to me.
southerntofu 5y ago
That's debatable. login.gov would certainly be better than id.me, but a centralized database of everyone sounds like a problem in all cases. A unique identifier for everyone is the path to more social/technological control. Here in France, some people from the anti-nazi resistance from the 40s later got into heated arguments about the national ID card, which had been made mandatory by the collaborationist regime. The idea is that if there were reliable/secure unique identifiers during WWII, the resistance movement could not have existed at all, and could not have saved countless lives. To this day, France is one of the rare countries where it's perfectly legal to walk anywhere without any identifying document with you. This doesn't mean that you won't be harassed by fascist cops though, depending on what you look like. I'm pretty much against fraud in the common sense of the word. But the biggest frauds are done by the rich and don't require to make up new identities. They're hidden in plain sight with lawyers and contracts with offshore corporations. I personally couldn't care that social services fraud costs the government some millions every year, when tax evasion and corrupt-government contracts (remember the Pentagon audit?) account for literally trillions going missing and nobody in government wants to do anything about that.

StanislavPetrov 5y ago

Not great that there is billions of dollars in fraud or that the government uses a private company to harvest and retain the biometric data of over 40 million Americans. Great that the IRS is no longer part of this biometric data harvesting scheme that represents a massive attack on the privacy and dignity of every taxpayer.

jackson1442 5y ago

I was extremely confused when I was asked to create an ID.me account for IRS. I have implemented Login.gov for some projects and it's rather easy; I can't see why they'd choose something else.

Spooky23 5y ago
Easy, the answer is right here: https://developers.login.gov/overview https://developers.login.gov/overview Login.gov is a fine authentication service, but cannot deliver the identity assurance level (IAL-2) required to identify people. (It may not be able to deliver AAL-2 authentication soon either as standard evolve.) Uploading a picture of your drivers license is not a meaningful validation of your identity. The reaction of the Senators here is the equivalent of “I’m shocked to hear there is gambling happening here”. Typical pandering. Literally every drivers license and ID in the country is running through a biometric identity provider run by a contractor to identity duplicate licenses. Many DMVs outsource credential production to a third party. I don’t think ID.me is the best solution, but it is better than providing a trivially stolen number “what was your AGI last year” that facilitates billions of dollars of fraud annually.
- akersten 5y ago
  No third party/private solution is appropriate here. The government that oversees the issuing of these IDs and attests that they are sufficient for government use (Real ID) cannot themselves validate said ID? Corruption or incompetence are the only paths that lead to outsourcing federal identity verification.
  - Spooky23 5y ago
    The only IDs issued widely by the US government are military credentials, immigration credentials, and passports. Driver’s licenses are issued by states and other entities. They are also fraught with problems as millions of people do not have REAL IDs, yet need to interact with government. The problem is that any bartender who has scanned your drivers license has the information required to scam an online validation without some other validation. If you want good online validation for the public, you need a third party right now. In the future, in some states, you’ll be able to use a mobile drivers license, provided you own a smartphone. Also problematic, as the government has to support everyone. Foreign nationals pay tax. People in nursing homes who cannot appear before a DMV need to pay taxes. You can yak about corruption and incompetence, but that honestly attests to ignorance on the topic.
    - toomuchtodo 5y ago
      You continue to make some good points, but at the end of the day, this is a government function and responsibility, not that of a private company. Login.gov can use the same AWS services in GovCloud as ID.me uses (Rekognition, available since 2017 in GovCloud). With USDS and 18F, it cannot be argued GSA (which Login.gov falls under) doesn’t have the skills available to build this capability. This is a call to enhance Login.gov’s identity abilities, and US government citizen identity management in general. Login.gov (and perhaps USPS for in person proofing) should be funded to do this, not ID.me. Higher level, this is about building strong public goods and defending them.
      - PaulDavisThe1st 5y ago
xenophonf 5y ago
I've also implemented login.gov as an identity provider of last resort for a system that requires identity proofing (IAL2). It works great once folks are signed up and verified for a login.gov account, but the identity assurance process always seems to end up requiring a piece of mail sent to new users' homes. The phone/utility verification process never seems to work right, and the postal mail option adds a week's delay (or more) to our user enrollment process. In my and several test users' cases, we've had our phone numbers in our names for literally decades, so it isn't a matter of public records being ambiguous. We've also had problems getting login.gov to proof new users with national but not state IDs. For example, we have someone with a passport but no driver's license. They should be able to use just the passport for identity proofing since the passport itself requires two or more forms of SUPERIOR/STRONG evidence (per NIST SP 800-63-3), but login.gov must not authenticate the passport with the State Department, meaning it fails 800-63A 4.4.1.2 (evidence collection requirements) rule 1 and must implement rule 2, instead (collect two pieces of STRONG evidence, i.e., national _and_ state IDs both). It's really frustrating because I cannot demand my users go out and get (pay for) state IDs they don't otherwise want or need. All that said, even though login.gov isn't perfect, I do like it and am very impressed with 18F/TTS's work. They've done a very thorough job with their SAML implementation compared to the ADFSes/Oktas/Pings/etc. of the world.
FireBeyond 5y ago
Not to mention, ID.me is horrible. Scanned my Driver's License at 200dpi. "Unable to find a face in the image you uploaded." Okay, 300dpi. "Unable to find a face in the image you uploaded." Huh. Scan at 72dpi. Success. Scan back of DL at 72dpi. "Unable to read barcode." Scan back of DL at 200dpi. "Unable to read barcode." Scan at 300dpi. Success. What a shitshow.
- bladegash 5y ago
  Really? Not that I particularly wanted to, but all I had to do was take a photo of the front and back using my iPhone and it went through without any problem.
- GCA10 5y ago
  Pixel phone user here. Very similar experience.

cproctor 5y ago

If the IRS (or Sen. Wyden) is looking for a "core government service" which has been inappropriately commercialized, they might start with tax preparation.

apex3stoker 5y ago
This article[1] has more details. Sen. Wyden[2] has been pushing for more funding to IRS to develop its free file program, but Turbotax has been successful via their lobbying of Republican politicians and some Democratic politicians in preventing it from happening. 1. https://www.propublica.org/article/inside-turbotax-20-year-fight-to-stop-americans-from-filing-their-taxes-for-free https://www.propublica.org/article/inside-turbotax-20-year-f... 2. https://www.nytimes.com/2021/07/19/opinion/intuit-turbotax-free-filing.html https://www.nytimes.com/2021/07/19/opinion/intuit-turbotax-f...
- memish 5y ago
- ThunderSizzle 5y ago
  Lol. Its always the Republicans. If it was priority for the Dems, they'd have done it. They have gotten through several other things the Republicans opposed. Anyhow, the better alternative is to return to lower the rates and remove deductions (aside from the standard deduction). Even simpler yet would be to go to a flat tax with an extremely high standard deduction (e.g. ~$50k with ~10% after that). I can't think of many good reasons to continue complicating the IRS code aside from political targeting and giving Congress more kickbacks.
  - throw10920 5y ago
    This is a really good point - if the tax code were a few dozen pages for the common case instead of a few hundred, then you might not even need tax-prep software in the first place. "The best program is the one that doesn't exist", to quote a popular refrain. Ongoing software projects require periodic refactoring to reduce complexity and increase comprehension - why would the law be any different?

Rebelgecko 5y ago

I recently had to sign up for login.gov (to renew my Global Entry, after they moved away from their own one-off CBP login system) and was pleasantly surprised with how good it was. Hopefully the TreasuryDirect.gov folks migrate some day

monksy 5y ago
Are they still giving out those decoder cards?
- Rebelgecko 5y ago
  You can use a CAC card as your second factor with the mandatory 2FA, but if you don't have one I think Yubikey-type devices are the only other hardware auth option

rootusrootus 5y ago

I’m very happy Wyden is my senator. I made a point the last time I was in DC to stop by his office and express my support but his staffers were profoundly uninterested. Oh well, I voted for him, not them.

fishywang 5y ago

I have used login.gov for my global entry application and I'm actually impressed. The only complaints I have with it are: 1. It doesn't make it obvious on how to add additional u2f keys (you have to go to login.gov explicitly to do that) 2. I still can't find a way to remove u2f keys But then when I used id.me with CA DMV I'm also impressed by it (granted CA DMV does not require any crazy biometric stuff there like IRS planned to do).

mshroyer 5y ago
> I still can't find a way to remove u2f keys When I go to login.gov and click on "Your authentication methods", each of my security keys is listed with a "Remove key" link next to it...
- fishywang 5y ago
  Oh you are right. I didn't realize that "You authentication methods" is clickable as the UI makes it look like just a header to me.

southerntofu 5y ago

That's debatable. login.gov would certainly be better than id.me, but a centralized database of everyone sounds like a problem in all cases. A unique identifier for everyone is the path to more social/technological control. Here in France, some people from the anti-nazi resistance from the 40s later got into heated arguments about the national ID card, which had been made mandatory by the collaborationist regime. The idea is that if there were reliable/secure unique identifiers during WWII, the resistance movement could not have existed at all, and could not have saved countless lives. To this day, France is one of the rare countries where it's perfectly legal to walk anywhere without any identifying document with you. This doesn't mean that you won't be harassed by fascist cops though, depending on what you look like. I'm pretty much against fraud in the common sense of the word. But the biggest frauds are done by the rich and don't require to make up new identities. They're hidden in plain sight with lawyers and contracts with offshore corporations. I personally couldn't care that social services fraud costs the government some millions every year, when tax evasion and corrupt-government contracts (remember the Pentagon audit?) account for literally trillions going missing and nobody in government wants to do anything about that.