6 ms·

I was extremely confused when I was asked to create an ID.me account for IRS. I have implemented Login.gov for some projects and it's rather easy; I can't see w

I was extremely confused when I was asked to create an ID.me account for IRS. I have implemented Login.gov for some projects and it's rather easy; I can't see why they'd choose something else.

Spooky23 5y ago
Easy, the answer is right here: https://developers.login.gov/overview https://developers.login.gov/overview Login.gov is a fine authentication service, but cannot deliver the identity assurance level (IAL-2) required to identify people. (It may not be able to deliver AAL-2 authentication soon either as standard evolve.) Uploading a picture of your drivers license is not a meaningful validation of your identity. The reaction of the Senators here is the equivalent of “I’m shocked to hear there is gambling happening here”. Typical pandering. Literally every drivers license and ID in the country is running through a biometric identity provider run by a contractor to identity duplicate licenses. Many DMVs outsource credential production to a third party. I don’t think ID.me is the best solution, but it is better than providing a trivially stolen number “what was your AGI last year” that facilitates billions of dollars of fraud annually.
- akersten 5y ago
  No third party/private solution is appropriate here. The government that oversees the issuing of these IDs and attests that they are sufficient for government use (Real ID) cannot themselves validate said ID? Corruption or incompetence are the only paths that lead to outsourcing federal identity verification.
  - Spooky23 5y ago
    The only IDs issued widely by the US government are military credentials, immigration credentials, and passports. Driver’s licenses are issued by states and other entities. They are also fraught with problems as millions of people do not have REAL IDs, yet need to interact with government. The problem is that any bartender who has scanned your drivers license has the information required to scam an online validation without some other validation. If you want good online validation for the public, you need a third party right now. In the future, in some states, you’ll be able to use a mobile drivers license, provided you own a smartphone. Also problematic, as the government has to support everyone. Foreign nationals pay tax. People in nursing homes who cannot appear before a DMV need to pay taxes. You can yak about corruption and incompetence, but that honestly attests to ignorance on the topic.
    - toomuchtodo 5y ago
      You continue to make some good points, but at the end of the day, this is a government function and responsibility, not that of a private company. Login.gov can use the same AWS services in GovCloud as ID.me uses (Rekognition, available since 2017 in GovCloud). With USDS and 18F, it cannot be argued GSA (which Login.gov falls under) doesn’t have the skills available to build this capability. This is a call to enhance Login.gov’s identity abilities, and US government citizen identity management in general. Login.gov (and perhaps USPS for in person proofing) should be funded to do this, not ID.me. Higher level, this is about building strong public goods and defending them.
      - PaulDavisThe1st 5y ago
        > You continue to make some good points, but at the end of the day, this is a government function and responsibility, not that of a private company. I 100% agree. Problem is, the federal government (and the state governments and to a large extent big chunks of the citizenry) are fundamentally opposed to the issuance of a non-passport general citizen's ID and/or number. Those opposed to it don't have any good solution to "how to protect information the government keeps about you" either, so it's no good asking them. Devising an actual public system for identity verification when you're being told the government cannot identify people is ... challenging.
        michaelt 5y ago
        > Problem is, the federal government (and the state governments and to a large extent big chunks of the citizenry) are fundamentally opposed to the issuance of a non-passport general citizen's ID and/or number. I wonder if this mightn't change with states increasingly requiring voter ID. After all, it'd be pretty dumb to on one hand mandate that every voter have government-issued ID, and on the other to oppose it.
        PaulDavisThe1st 5y ago
        The bulk of those who are pushing for more voter ID are from the most political alliance most vocal about both (a) insisting the voting is a state matter (b) federal government issuing ID is not OK.
  - closeparen 5y ago
    The government cannot build a competent identity solution because a majority of voters believe that to do so presages something from genocide ("Papiere, bitte!") to the literal end of the world (“Mark of the Beast”).
    - vorpalhex 5y ago
      We are still in the same universe where the OPM breach happened, right? Like no, I don't trust the government to protect the big bucket of PII on everyone in digital form. Not because of lizard people but because the government can barely keep it's own sites secure. Giving them more dangerous data in the form of bulk PII is the wrong move. Login.gov was the first thing, in a long time, that was well executed. I need to see more things like that to restore my faith. ID.me is the wrong direction.
      - alistairSH 5y ago
        The IRS already has almost all our PII. Not sure how adding a photo materially changes anything in that regard. I do agree ID.me is the wrong approach. And login.gov should be used in some form over a private enterprise. But, my concern is two-fold… it’s a private entity that I don’t really want to do business with. And the process described by Krebs was impossible - can we really expect everybody to have email, valid phone (what if they aren’t the account owner for the phone), photo ID, and whatever else was required?
        vorpalhex 5y ago
        The IRS has our PII, but lots of it is not in a big bucket, it's quite diffuse. If PII is dynamite (and it is) then we want it divided up in silos, with firewalls, and limited access where nobody has universal access. Ideally a lot of it is protected by differential privacy - if I am getting audited, the auditor only see's my returns and not my identity, and someone else gets only my identity.
        Talanes 5y ago
        My father doesn't have any sort of web-connected camera, which caused a whole set of problems with his unemployment that I can't remember how they got fixed. On a similar note, I don't have a lot of documents tied to my name, so I had nothing that they wanted when my photo verification didn't work for whatever reason. Pretty sure I just never solved that one and left the last couple weeks I would have gotten unemployment on the table.
  - jdmichal 5y ago
    I generally agree with you. However: Real ID validates that you are the person you are at the time of issuance, but does not guarantee that the possessor of the ID is that person. This stems from the fact that an ID is "something you have". Like any secure system, you should use multifactor authentication. The facial scan is "something you are", so the combination of ID and scan provides that. One might also use "something you know", such as your adjusted gross income (AGI) that the IRS used before.
    - PaulDavisThe1st 5y ago
      I think the difficulty is that the (federal) government can't currently do anything except the "something you know" part. It can't use "something you have" (because too many people are opposed to federal government issued ID), and "something you are" appears beyond the scope of the federal govt to implement (correctly) at this time.
      - toomuchtodo 5y ago
        Every IRS, Social Security, DHS/CBP, and USPS branch are locations where they could proof your identity in person. It is simply a matter of will to implement the policy and enable the software features for government employees to perform the function. I would also propose finding ways to drastically reduce the cost of issuing smart passport cards, and slowly transforming that into a national ID over time as the electorate composition changes. Your passport number eventually becomes your national ID number.
- thesimon 5y ago
  What about sending a letter to the registered address?
- xenophonf 5y ago
  login.gov meets IAL2 since it NIST SP 800-63-3 "allows for remote or in-person identity proofing" (800-63A page 8). Likewise, TOTP is explicitly mentioned as an allowed multi-factor OTP authenticator (800-63B pages 20-21). I'm not aware of changes in SP 800-63-4 that would affect login.gov's current implementation, but it's been a minute since I last read the -4 draft and could be wrong.
  - mpyne 5y ago
    Login.gov permits me if the IRS could do identity proofing. The IRS can't do identity proofing (hence the need for ID.me, which is implementing "remote or in-person identity proofing"), and login.gov doesn't do it for the agency. Login.gov can only record whether the identity was created at IAL-1 or IAL-2. Use of login.gov is orthogonal to the question of ID.me.
xenophonf 5y ago
I've also implemented login.gov as an identity provider of last resort for a system that requires identity proofing (IAL2). It works great once folks are signed up and verified for a login.gov account, but the identity assurance process always seems to end up requiring a piece of mail sent to new users' homes. The phone/utility verification process never seems to work right, and the postal mail option adds a week's delay (or more) to our user enrollment process. In my and several test users' cases, we've had our phone numbers in our names for literally decades, so it isn't a matter of public records being ambiguous. We've also had problems getting login.gov to proof new users with national but not state IDs. For example, we have someone with a passport but no driver's license. They should be able to use just the passport for identity proofing since the passport itself requires two or more forms of SUPERIOR/STRONG evidence (per NIST SP 800-63-3), but login.gov must not authenticate the passport with the State Department, meaning it fails 800-63A 4.4.1.2 (evidence collection requirements) rule 1 and must implement rule 2, instead (collect two pieces of STRONG evidence, i.e., national _and_ state IDs both). It's really frustrating because I cannot demand my users go out and get (pay for) state IDs they don't otherwise want or need. All that said, even though login.gov isn't perfect, I do like it and am very impressed with 18F/TTS's work. They've done a very thorough job with their SAML implementation compared to the ADFSes/Oktas/Pings/etc. of the world.
FireBeyond 5y ago
Not to mention, ID.me is horrible. Scanned my Driver's License at 200dpi. "Unable to find a face in the image you uploaded." Okay, 300dpi. "Unable to find a face in the image you uploaded." Huh. Scan at 72dpi. Success. Scan back of DL at 72dpi. "Unable to read barcode." Scan back of DL at 200dpi. "Unable to read barcode." Scan at 300dpi. Success. What a shitshow.
- bladegash 5y ago
  Really? Not that I particularly wanted to, but all I had to do was take a photo of the front and back using my iPhone and it went through without any problem.
- GCA10 5y ago
  Pixel phone user here. Very similar experience.

I was extremely confused when I was asked to create an ID.me account for IRS. I have implemented Login.gov for some projects and it's rather easy; I can't see why they'd choose something else.

Spooky23 5y ago

Easy, the answer is right here: https://developers.login.gov/overview https://developers.login.gov/overview Login.gov is a fine authentication service, but cannot deliver the identity assurance level (IAL-2) required to identify people. (It may not be able to deliver AAL-2 authentication soon either as standard evolve.) Uploading a picture of your drivers license is not a meaningful validation of your identity. The reaction of the Senators here is the equivalent of “I’m shocked to hear there is gambling happening here”. Typical pandering. Literally every drivers license and ID in the country is running through a biometric identity provider run by a contractor to identity duplicate licenses. Many DMVs outsource credential production to a third party. I don’t think ID.me is the best solution, but it is better than providing a trivially stolen number “what was your AGI last year” that facilitates billions of dollars of fraud annually.

akersten 5y ago
No third party/private solution is appropriate here. The government that oversees the issuing of these IDs and attests that they are sufficient for government use (Real ID) cannot themselves validate said ID? Corruption or incompetence are the only paths that lead to outsourcing federal identity verification.
- Spooky23 5y ago
  The only IDs issued widely by the US government are military credentials, immigration credentials, and passports. Driver’s licenses are issued by states and other entities. They are also fraught with problems as millions of people do not have REAL IDs, yet need to interact with government. The problem is that any bartender who has scanned your drivers license has the information required to scam an online validation without some other validation. If you want good online validation for the public, you need a third party right now. In the future, in some states, you’ll be able to use a mobile drivers license, provided you own a smartphone. Also problematic, as the government has to support everyone. Foreign nationals pay tax. People in nursing homes who cannot appear before a DMV need to pay taxes. You can yak about corruption and incompetence, but that honestly attests to ignorance on the topic.
  - toomuchtodo 5y ago
    You continue to make some good points, but at the end of the day, this is a government function and responsibility, not that of a private company. Login.gov can use the same AWS services in GovCloud as ID.me uses (Rekognition, available since 2017 in GovCloud). With USDS and 18F, it cannot be argued GSA (which Login.gov falls under) doesn’t have the skills available to build this capability. This is a call to enhance Login.gov’s identity abilities, and US government citizen identity management in general. Login.gov (and perhaps USPS for in person proofing) should be funded to do this, not ID.me. Higher level, this is about building strong public goods and defending them.
    - PaulDavisThe1st 5y ago
      > You continue to make some good points, but at the end of the day, this is a government function and responsibility, not that of a private company. I 100% agree. Problem is, the federal government (and the state governments and to a large extent big chunks of the citizenry) are fundamentally opposed to the issuance of a non-passport general citizen's ID and/or number. Those opposed to it don't have any good solution to "how to protect information the government keeps about you" either, so it's no good asking them. Devising an actual public system for identity verification when you're being told the government cannot identify people is ... challenging.
      - michaelt 5y ago
        > Problem is, the federal government (and the state governments and to a large extent big chunks of the citizenry) are fundamentally opposed to the issuance of a non-passport general citizen's ID and/or number. I wonder if this mightn't change with states increasingly requiring voter ID. After all, it'd be pretty dumb to on one hand mandate that every voter have government-issued ID, and on the other to oppose it.
        PaulDavisThe1st 5y ago
        The bulk of those who are pushing for more voter ID are from the most political alliance most vocal about both (a) insisting the voting is a state matter (b) federal government issuing ID is not OK.
- closeparen 5y ago
  The government cannot build a competent identity solution because a majority of voters believe that to do so presages something from genocide ("Papiere, bitte!") to the literal end of the world (“Mark of the Beast”).
  - vorpalhex 5y ago
    We are still in the same universe where the OPM breach happened, right? Like no, I don't trust the government to protect the big bucket of PII on everyone in digital form. Not because of lizard people but because the government can barely keep it's own sites secure. Giving them more dangerous data in the form of bulk PII is the wrong move. Login.gov was the first thing, in a long time, that was well executed. I need to see more things like that to restore my faith. ID.me is the wrong direction.
    - alistairSH 5y ago
      The IRS already has almost all our PII. Not sure how adding a photo materially changes anything in that regard. I do agree ID.me is the wrong approach. And login.gov should be used in some form over a private enterprise. But, my concern is two-fold… it’s a private entity that I don’t really want to do business with. And the process described by Krebs was impossible - can we really expect everybody to have email, valid phone (what if they aren’t the account owner for the phone), photo ID, and whatever else was required?
      - vorpalhex 5y ago
        The IRS has our PII, but lots of it is not in a big bucket, it's quite diffuse. If PII is dynamite (and it is) then we want it divided up in silos, with firewalls, and limited access where nobody has universal access. Ideally a lot of it is protected by differential privacy - if I am getting audited, the auditor only see's my returns and not my identity, and someone else gets only my identity.
      - Talanes 5y ago
        My father doesn't have any sort of web-connected camera, which caused a whole set of problems with his unemployment that I can't remember how they got fixed. On a similar note, I don't have a lot of documents tied to my name, so I had nothing that they wanted when my photo verification didn't work for whatever reason. Pretty sure I just never solved that one and left the last couple weeks I would have gotten unemployment on the table.
- jdmichal 5y ago
  I generally agree with you. However: Real ID validates that you are the person you are at the time of issuance, but does not guarantee that the possessor of the ID is that person. This stems from the fact that an ID is "something you have". Like any secure system, you should use multifactor authentication. The facial scan is "something you are", so the combination of ID and scan provides that. One might also use "something you know", such as your adjusted gross income (AGI) that the IRS used before.
  - PaulDavisThe1st 5y ago
    I think the difficulty is that the (federal) government can't currently do anything except the "something you know" part. It can't use "something you have" (because too many people are opposed to federal government issued ID), and "something you are" appears beyond the scope of the federal govt to implement (correctly) at this time.
    - toomuchtodo 5y ago
      Every IRS, Social Security, DHS/CBP, and USPS branch are locations where they could proof your identity in person. It is simply a matter of will to implement the policy and enable the software features for government employees to perform the function. I would also propose finding ways to drastically reduce the cost of issuing smart passport cards, and slowly transforming that into a national ID over time as the electorate composition changes. Your passport number eventually becomes your national ID number.
thesimon 5y ago
What about sending a letter to the registered address?
xenophonf 5y ago
login.gov meets IAL2 since it NIST SP 800-63-3 "allows for remote or in-person identity proofing" (800-63A page 8). Likewise, TOTP is explicitly mentioned as an allowed multi-factor OTP authenticator (800-63B pages 20-21). I'm not aware of changes in SP 800-63-4 that would affect login.gov's current implementation, but it's been a minute since I last read the -4 draft and could be wrong.
- mpyne 5y ago
  Login.gov permits me if the IRS could do identity proofing. The IRS can't do identity proofing (hence the need for ID.me, which is implementing "remote or in-person identity proofing"), and login.gov doesn't do it for the agency. Login.gov can only record whether the identity was created at IAL-1 or IAL-2. Use of login.gov is orthogonal to the question of ID.me.

xenophonf 5y ago

I've also implemented login.gov as an identity provider of last resort for a system that requires identity proofing (IAL2). It works great once folks are signed up and verified for a login.gov account, but the identity assurance process always seems to end up requiring a piece of mail sent to new users' homes. The phone/utility verification process never seems to work right, and the postal mail option adds a week's delay (or more) to our user enrollment process. In my and several test users' cases, we've had our phone numbers in our names for literally decades, so it isn't a matter of public records being ambiguous. We've also had problems getting login.gov to proof new users with national but not state IDs. For example, we have someone with a passport but no driver's license. They should be able to use just the passport for identity proofing since the passport itself requires two or more forms of SUPERIOR/STRONG evidence (per NIST SP 800-63-3), but login.gov must not authenticate the passport with the State Department, meaning it fails 800-63A 4.4.1.2 (evidence collection requirements) rule 1 and must implement rule 2, instead (collect two pieces of STRONG evidence, i.e., national _and_ state IDs both). It's really frustrating because I cannot demand my users go out and get (pay for) state IDs they don't otherwise want or need. All that said, even though login.gov isn't perfect, I do like it and am very impressed with 18F/TTS's work. They've done a very thorough job with their SAML implementation compared to the ADFSes/Oktas/Pings/etc. of the world.

FireBeyond 5y ago

Not to mention, ID.me is horrible. Scanned my Driver's License at 200dpi. "Unable to find a face in the image you uploaded." Okay, 300dpi. "Unable to find a face in the image you uploaded." Huh. Scan at 72dpi. Success. Scan back of DL at 72dpi. "Unable to read barcode." Scan back of DL at 200dpi. "Unable to read barcode." Scan at 300dpi. Success. What a shitshow.

bladegash 5y ago
Really? Not that I particularly wanted to, but all I had to do was take a photo of the front and back using my iPhone and it went through without any problem.
GCA10 5y ago
Pixel phone user here. Very similar experience.