14 ms·

IRS to adopt Login.gov as user authentication tool

287 points by danso 5y ago

core-utility 5y ago
This is a good move. While it does consolidate logins to one single location that a bad actor can attack, the time and effort put into securing it is much better used as a pool and covered by a single entity than having each individual department (and often times teams within a department) creating and maintaining their own login methods.
spelunker 5y ago
Is this the same authentication platform that TreasuryDirect uses? edit - looks like no. On the one hand a single sign on to both would have been nice, OTOH TreasuryDirect's authentication system is a PITA.
- tempnow987 5y ago
  TD login is basically unusable in my view. I stopped using it simply because it was so painful.
- Someone1234 5y ago
  TreasuryDirect, the site that has case-insensitive passwords, disallows password managers, disallows the use of your actual keyboard to enter your password, and has this dumb on-screen keyboard with tiny keys that ultimately accomplishes nothing? Super trash. It still amuses me how few people, even those who claim security expertise, don't understand that commercial malware is able to hook the driver stack (and or browser's network stack) and intercept pre-encrypted HTTPS traffic. Hooking traffic rather than keystrokes is preferred because in order to resell that stolen data the data needs CONTEXT. A stream of keys is difficult to interpret into anything meaningful at scale, whereas "HTTPS POST Request to URI [xyz] with fields [X & Y] with values [J & W]" is very monetizable. What I am saying is TreasuryDirect's on-screen keyboard "security" stuff is complete nonsense, it has no technical merit at all. None. Worse still it also hurts users of accessible technologies, touch-screens, or users using password managers (essentially promoting password re-use, a common problem).
  - xxpor 5y ago
    The TreasuryDirect site makes me want to give the authority to the USDS/18F to proactively come in and say we're taking over your public facing website infrastructure to any executive branch agency. There's no excuse for something to look and behave like it hasn't been touched since 1996.
    - Spooky23 5y ago
      It’s been touched since then. Back in those days, their “MFA” was a wallet card that you had the match up for a code. It was like the old copy protection schemes used for games like Sim City.
      - xxpor 5y ago
        That almost makes it worse!
  - artful-hacker 5y ago
    Not that this should be necessary by any means but I usually right click the password input -> inspect element -> paste my password in the value from my password manager. The on screen keyboard is so ridiculous.
  - ewoodrich 5y ago
    On top of everything you mentioned, TreasuryDirect also has an insanely aggravating issue where if you click a navigation button twice (e.g clicking next again reflexively before the next page has fully loaded), it displays an error about invalid navigation and forces you to login again and start from the beginning. Even something as simple as disabling navigation links/buttons after being clicked before the next page load would mostly solve this and save hours of frustration having to re-login through their god awful signin flow every time.
  - YeBanKo 5y ago
    I am able to use Safari key chain to enter my password. Not sure about other password managers.
_fat_santa 5y ago
I'm glad they are adopting it. Login.gov was always kind of funny, like here use this to login to all US govt resources...except for this service, and this service, and all these services...
- deleted 5y ago
  [deleted]
wyc 5y ago
login.gov is open source! They also encrypt user data in a way that they can't access it without the user's password, precluding the formation of a national registry that could be used towards nefarious and anti-democratic purposes. As a result, account recovery looks a lot like re-registration, which I think is a great thing. https://github.com/18F/identity-idp https://github.com/18F/identity-idp It's built on Rails, and I'm really impressed at the engineering decisions that were made here, from choice of technologies to level of transparency. I wish all public sector projects could exhibit the same leadership and competence demonstrated for login.gov--the interface is even a pleasure to use, which is hard to say for most government online services outside of the UK and parts of Canada in my experience. Bravo!
- hanniabu 5y ago
  > They also encrypt user data in a way that they can't access it without the user's password I love how low our standards for government sites have gotten where this is seen as a plus and not something that's expected
  - ethbr0 5y ago
    Isn't the US corporate standard even lower? Outside of maybe Google, Facebook, or HIPAA-covered entities. Corporate customer databases I've seen have rarely even been need-to-know access limited, much less actually encrypted to internal users.
    - kube-system 5y ago
      I don't even think a HIPAA-covered entity could hold their data to the standard of zero-knowledge encryption... since, you know, they have to be able to use patient data.
      - chordalkeyboard 5y ago
        in theory they could but I doubt most patients want to have to remotely authorize their provider any time someone wants to access their record.
zht 5y ago
love that Americans are always worried about some sort of national ID/database of citizens being used for nefarious needs
- wyc 5y ago
  It's in our history to worry about it :')
  - Turing_Machine 5y ago
    There also the instructive examples of how such things were (and are) used in Nazi Germany, the Soviet Bloc, China...
- zdragnar 5y ago
  I'm not sure if this is sarcasm or not, but given history and human nature, it is not an unreasonable concern.
- jcadam 5y ago
  The main issue is if it's required. Not so worried about myself - I'm a veteran which means my fingerprints and DNA are already on file with the feds somewhere :), but US Citizens with no particular connection to the federal government absolutely shouldn't have to need a "National ID."
  - babypuncher 5y ago
    Everyone is already issued a social security number. I'm not sure how a more modern, cryptographic ally secure version would be any more concerning in this regard.
  - xxpor 5y ago
    And yet, everyone suffers because of it. We have endless SSN breaches because at the end of the day, having a unique ID for people is really valuable! We could have something way safer, but we get stuck with the status quo which satisfies no one.
ChrisLTD 5y ago
It's amazing they weren't going to do this originally. What a fiasco.
jcadam 5y ago
The VA still uses ID.me - so most veterans have an account anyway (I needed one to get a certificate of eligibility for a VA home loan). I had to add an authorization for the IRS on my ID.me to stop the child credit advance checks from coming last year (that should have never been an opt-out). I also had a few other govt systems I needed to access when I was a defense worker that used it. So hopefully other agencies will move away from ID.me as well.
- sputknick 5y ago
  ID.me was founded by two veterans, so unlikely to move off of that anytime soon.
bonestamp2 5y ago
If you use Customs and Border Patrol's trusted traveler programs (or some other gov sites), you may already have a login.gov account since that is what they have been using for a few years now.
- techsupporter 5y ago
  I just wonder what kind of extra hoops we'll have to go through to use an existing login.gov account with the IRS. I read in some article somewhere that the IRS didn't use login.gov because it isn't "as verified" or some kind of thing as the IRS needs. Yet the reason I have a login.gov account is for my NEXUS enrollment which means I've been fingerprinted, background checked, had my passport number linked, and been interviewed in person by two different governments. That seems pretty identity verified to me. If I have to go through some other step, especially if it involves yet another biometric or interview check, that's going to be annoying.
  - bonestamp2 5y ago
    Yes, same here... background checked by two countries! Not to mention iris scanned, and they even passports from two countries for me. Hopefully it's not too onerous, like you said... they can be pretty damned sure who we are at this point.
  - kube-system 5y ago
    Those steps were a prerequisite to get your NEXUS enrollment -- not to get a login.gov account. The only thing you have to do to enroll in login.gov is verify your email address. And optional feature of login.gov is to verify your identity further by uploading a photo of a state ID, and entering your SSN and phone number. When you validated your identity in person with CBP, this was not that.
    - techsupporter 5y ago
      > When you validated your identity in person with CBP, this was not that. This isn't snarking at you directly, just all I'm really hearing is that the government will happily mix whatever it knows about me for its own purposes but when it comes to making things easier for me (wherein they've literally seen me in person and looked over a stack of my identifying documents), no way that's "violating my privacy." If we are going to have an all-seeing panopticon can't it at least be convenient?
mdb31 5y ago
I'm a foreigner (yes, I know, sorry, sorry) who is a "US Person" and thus needs to (and, to be perfectly clear, is happy to, I'm sorry, I'm not-sorry, I'm sorry about being not-sorry?) pay US income tax. The IRS system is, by far, the worst I've ever had to deal with, and in this I'm comparing the US to countries like Rwanda, where, for some weird reason, I'm also required to pay taxes. Getting an ITIN (sort-of like a SSN, except you're not supposed to use it like that, otherwise they will send Ted Cruz after you...) is an absolute pain, mostly because you can only request it by phone, and literally nobody you talk to is able to spell your name right, DESPITE you repeating it endlessly in just about any spelling alphabet possible. So, you now have a dozen-or-so ITINs (again, like SSNs), all in different names, none of them yours. So, you file your taxes using the ITIN in the names that is closest to yours, and specify this on your tax forms. You send in your forms, and your check, which is cashed immediately. Repeat the next year, and so on. Now, after FOURTEEN years or so, you get sent a letter, informing you of a tax audit, and demanding you are physically present in Austin, Texas, two weeks from the postmark of the letter (never mind it reached you three months after that, and never mind you're located in Europe, which at that time was denied access to the US due to COVID-19). So, you get a lawyer, which costs close to US$ 8000. The lawyer contacts the IRS, which continues to insist on an in-person interview in the past. So, now you're out US$ 8000, and can never travel to the US again. But, yeah, lovely that they now allow additional login tools...
- netfortius 5y ago
  The fundamental issue here is that there is no meaningful voice of expats in the US, so any attempt to fight a system which wants your money, no matter where you are and make them, in the world, is prone to failure. The only real option is to renounce citizenship.
- hanniabu 5y ago
  > The IRS system is, by far, the worst I've ever had to deal with That's by design
  - jcadam 5y ago
    The byzantine rules exist to create deductions and loopholes for different interest groups. Raising the standard deduction was actually a good move, as it simplified my tax filing for sure (I don't bother to itemize now) -- but I imagine the tax preparation industry (amongst others) was not pleased.
throwhauser 5y ago
Good. There was something absurd about having to accept id.me's terms-of-service, which involved "deals, discounts, cash back rebates and employment and educational opportunities", to access government services online.
awb 5y ago
Has anyone here worked on government websites or APIs? I'm curious what the experience was like.
- deleted 5y ago
  [deleted]
- atlgator 5y ago
  It's standards based just like any other SSO these days: OpenID Connect and SAML. Is there something specific you want to know?
  - Jerrrry 5y ago
    This is correct. The "FedRamp" contract overhaul pretty much locks in the requirements and specifications to these above implementations. I have designed an API that revolves around and side-steps this that currently serves 60 million US civilians...but in the end, the security assessment pretty much comes down to the Privacy Acts interpretations and the common sense security landscape.
  - awb 5y ago
    How is it different from working with a private company? Lots of stakeholders? More documented testing procedures?
    - Spooky23 5y ago
      Someone said it best upthread: the incentives are different. If you are a leader in the bureaucracy, your incentive is to not personally fail, which is not the same as to succeed. There is an army of auditors waiting to question every decision, so the obvious way to avoid that is to not make any. Balancing the need to do something without deciding anything is an art of sorts.
      - wslack 5y ago
        Also, to be clear, those incentives aren't coming from within the bureaucracy. For example, let's say that a program tries to do something and it totally doesn't work. A news story about this will be roughly the same if $10,000 is spent as if $100,000 is spent as if $1,000,000 is spent. That creates an incentive never to label anything a failure and just keep pumping good money after bad - that's how to avoid the negative article.
danso 5y ago
As mentioned in the article, the IRS had originally planned to use ID.me — a private company — before backing down. Previous discussion here: https://news.ycombinator.com/item?id=30126118 https://news.ycombinator.com/item?id=30126118
- technofiend 5y ago
  And rather controversially require face recognition for login. Good idea in that having another secret only really you should own is good, poor execution in allowing a third party of collect and probably sell something so very personal. I'm glad they backed off.
- cyral 5y ago
  Note that they are currently using ID.me. I had to use it today to login.
mzs 5y ago
IRS statement itself: https://www.irs.gov/newsroom/irs-statement-new-features-put-in-place-for-irs-online-account-registration-process-strengthened-to-ensure-privacy-and-security https://www.irs.gov/newsroom/irs-statement-new-features-put-...
jimmaswell 5y ago
They should keep the data from id.me and migrate it instead of making people who used id.me sign up and verify all over again.
- kylehotchkiss 5y ago
  id.me probably wrote not doing this into their contract to prevent the IRS from trying to break it.
throw0101a 5y ago
In Canada, the Canada Revenue Agency (CRA) allows you you to leverage existing relationships with banks and credit unions, "Sign-in Partners": * https://www.canada.ca/en/revenue-agency/services/e-services/cra-login-services/list-sign-partners.html https://www.canada.ca/en/revenue-agency/services/e-services/... * https://www.canada.ca/en/revenue-agency/services/e-services/cra-login-services.html https://www.canada.ca/en/revenue-agency/services/e-services/... * https://verified.me/government-sign-in-by-verified-me/ https://verified.me/government-sign-in-by-verified-me/ You can also create a stand-alone account with the CRA if you wish. Other federal agencies use the 'partner' system as well. It's basically SAML.
- pokoleo 5y ago
  Major difference in Canada is the # of banks. The big five dominate[1] unlike in the US where there are 100+[2] [1] https://en.wikipedia.org/wiki/List_of_banks_and_credit_unions_in_Canada https://en.wikipedia.org/wiki/List_of_banks_and_credit_union... [2] https://en.wikipedia.org/wiki/List_of_largest_banks_in_the_United_States https://en.wikipedia.org/wiki/List_of_largest_banks_in_the_U...
- dgudkov 5y ago
  It's not a good choice. The Canadian government still doesn't understand the internet. There should be no obligatory private intermediaries between a citizen and the government no matter online or offline. It should provide an online identity service, just like it already provides offline government-issued IDs (e.g. passports) without involving banks or other private institutions.
  - nasalgoat 5y ago
    My favourite part of the CRA website is it has operating hours! It actually closes during non-work hours! Crazy.
  - throw0101a 5y ago
    > There should be no obligatory private intermediaries between a citizen and the government no matter online or offline. As I stated in my post: > You can also create a stand-alone account with the CRA if you wish. See Option 2: * https://www.canada.ca/en/revenue-agency/services/e-services/e-services-individuals/account-individuals.html https://www.canada.ca/en/revenue-agency/services/e-services/... The provinces of Alberta and BC also have identity providers (since they issue driver licenses and health cards) which the CRA allows (Option 3).
pandama 5y ago
If you check the previous stories tagged by ID.me (https://www.fedscoop.com/tag/id-me/ https://www.fedscoop.com/tag/id-me/), you'll see some awesome articles sponsored by the same about how Arizon has already saved $40 Billion and how this is great against cyber risk. Sponsored News needs a much more prominent badge. #bringbacktheblinktag
imwillofficial 5y ago
Why did they ever go with ID.me when they have their own comparable solution? I’ve used both and both are solid, one is expensive and externally managed though..
- megaman821 5y ago
  I thought it was that login.gov does single-sign-on (SSO) and ID.me does SSO and identify verification at both the signup and sign-in level.
  - zie 5y ago
    Login.gov absolutely cares about your identity. Case in point: login.gov will share your SSN to the provider(irs.gov in this case), if appropriate permissions are requested.
    - dqv 5y ago
      When does it ask for your identity? I just signed up and all it needed was my email, password, and my token. It doesn’t know who I am though. It didn’t even ask for my name.
      - atonse 5y ago
        They have two tiers. I love their system. The lower tier is like and Internet account. Validate with a password and 2fa, etc. The next tier is required to log in to certain sites and requires you to upload ID etc to verify. Once you have verified with that, you have an extra set of attributes to do more sensitive things on certain sites.
        dqv 5y ago
        Interesting. I’m looking forward to it when the IRS adopts it.
      - deleted 5y ago
        [deleted]
kylehotchkiss 5y ago
Now let’s hope the California DMV and health department make the same choice so ID.me isn’t further becoming a national ID replacement
iostream24 5y ago
Meanwhile, I’ve spent over a month trying to get verified as myself via ID.me and their broken process that can’t handle Americans living abroad, with foreign secondary documents. A typical round with customer service takes about a week, and then I was told that someone will be able to verify electric bills that aren’t in English, but then that turned out to be weeks ago and it’s yet to happen. This is all merely to set the stage for being ELIGIBLE for a human to do a video conference verification with me, which they hopefully will deign to do. A singular corporation (ID.me) holds every American’s ability to login to their government tax profile hostage, and we pay them for the pleasure of this rotten monopoly and abuse of public trust. I just want to pay my taxes, sigh. It should be as easy as any other bill or process. Making taxpayers suffer more does not generate extra revenue for the state. There is literally no call nor need for all this extra stressful nonsense making people sweat every April. It’s actually counterproductive to fund raising for state activities. Bureaucracy steals lives and health for wasteful ends that do not benefit the group. The likelihood of reforming our deliberately and absurdly arcane tax system is about as high as large corps and oligarchs paying their fair share, nevertheless we should insist. That said, I’m cautiously optimistic about this excellent announcement to reduce future peoples suffering. I also gladly submitted biometric video scans and it still wasn’t good enough for ID.me So, I wonder if I’ll still be trying to get verified by the time this new system rolls out…
- zzleeper 5y ago
  Same here. I hate ID.me and their piece of crap system. Never managed to get it working after wasting so much time. Luckily, I don't _need it_, so at the end I just gave up and used different methods. Would hate it if I'm actually unemployed and had to use that terrible firm.
- AndyMcConachie 5y ago
  I cannot upvote this comment enough! I'm an American abroad and I spent roughly 8 hours spread across 5 days getting access to my irs.gov account. And yes, I actually recorded time spent on this chore. The worst part was not the facial recognition. It was the fact that I had an address outside of the USA and they would not recognize a non-USA utility company for address verification. This was stupid for two reasons. The first being the obvious requirement that a non-resident have a contract with a utility company in the USA, and the second being that the IRS has been mailing me at my non-USA address for years. The IRS already had my address, but I had to verify it with ID.me. The other worst part was they never told me WHY my various utility bills and bank statements were being rejected. At one point they told me I had to translate a bank statement, and that was the most feedback I ever got. But then I translated it and they rejected it for an unknown reason. I eventually got my registration through them by getting a USA bank to recognize my foreign address. Luckily I also had an old W-2 laying around from years ago when I briefly worked in the states. Do they expect my current employer to give me a W-2? Finally, on their stupid video call I was told I needed to have all of this documentation, which I dutifully prepared, and then all the person cared about was me holding my passport up to the camera. Completely broken process for Americans abroad. To the point where they're likely breaking some US law by making it so difficult for non-residents to register for IRS access. I hated it and I hope ID.me dies in a pit of bankruptcy.
dokument 5y ago
Issues with login.gov don't make me very confident. Try putting in 2 lower security passwords but then backspace deleting them and you get. zxcvbn.feedback.use_a_few_words_avoid_common_phraseszxcvbn.feedback.no_need_for_symbols_digits_or_uppercase_letters visible on the screen. I get it isn't a technical issue but still, doesn't give me confidence
- klaussilveira 5y ago
  They fixed that recently: https://github.com/18F/identity-idp/commit/873c71ca8c0cf61d345e0eb9040209802eaefe1d https://github.com/18F/identity-idp/commit/873c71ca8c0cf61d3...
deleted 5y ago
[deleted]
Teknoman117 5y ago
That's the one I had to use to sign up for GlobalEntry and TSA Precheck. Highly recommend if you travel a lot ... or plan to again at some point given the current state of affairs.

287 points by danso 5y ago

This is a good move. While it does consolidate logins to one single location that a bad actor can attack, the time and effort put into securing it is much better used as a pool and covered by a single entity than having each individual department (and often times teams within a department) creating and maintaining their own login methods.

spelunker 5y ago

Is this the same authentication platform that TreasuryDirect uses? edit - looks like no. On the one hand a single sign on to both would have been nice, OTOH TreasuryDirect's authentication system is a PITA.

tempnow987 5y ago
TD login is basically unusable in my view. I stopped using it simply because it was so painful.
Someone1234 5y ago
TreasuryDirect, the site that has case-insensitive passwords, disallows password managers, disallows the use of your actual keyboard to enter your password, and has this dumb on-screen keyboard with tiny keys that ultimately accomplishes nothing? Super trash. It still amuses me how few people, even those who claim security expertise, don't understand that commercial malware is able to hook the driver stack (and or browser's network stack) and intercept pre-encrypted HTTPS traffic. Hooking traffic rather than keystrokes is preferred because in order to resell that stolen data the data needs CONTEXT. A stream of keys is difficult to interpret into anything meaningful at scale, whereas "HTTPS POST Request to URI [xyz] with fields [X & Y] with values [J & W]" is very monetizable. What I am saying is TreasuryDirect's on-screen keyboard "security" stuff is complete nonsense, it has no technical merit at all. None. Worse still it also hurts users of accessible technologies, touch-screens, or users using password managers (essentially promoting password re-use, a common problem).
- xxpor 5y ago
  The TreasuryDirect site makes me want to give the authority to the USDS/18F to proactively come in and say we're taking over your public facing website infrastructure to any executive branch agency. There's no excuse for something to look and behave like it hasn't been touched since 1996.
  - Spooky23 5y ago
    It’s been touched since then. Back in those days, their “MFA” was a wallet card that you had the match up for a code. It was like the old copy protection schemes used for games like Sim City.
    - xxpor 5y ago
      That almost makes it worse!
- artful-hacker 5y ago
  Not that this should be necessary by any means but I usually right click the password input -> inspect element -> paste my password in the value from my password manager. The on screen keyboard is so ridiculous.
- ewoodrich 5y ago
  On top of everything you mentioned, TreasuryDirect also has an insanely aggravating issue where if you click a navigation button twice (e.g clicking next again reflexively before the next page has fully loaded), it displays an error about invalid navigation and forces you to login again and start from the beginning. Even something as simple as disabling navigation links/buttons after being clicked before the next page load would mostly solve this and save hours of frustration having to re-login through their god awful signin flow every time.
- YeBanKo 5y ago
  I am able to use Safari key chain to enter my password. Not sure about other password managers.

_fat_santa 5y ago

I'm glad they are adopting it. Login.gov was always kind of funny, like here use this to login to all US govt resources...except for this service, and this service, and all these services...

deleted 5y ago
[deleted]

wyc 5y ago

login.gov is open source! They also encrypt user data in a way that they can't access it without the user's password, precluding the formation of a national registry that could be used towards nefarious and anti-democratic purposes. As a result, account recovery looks a lot like re-registration, which I think is a great thing. https://github.com/18F/identity-idp https://github.com/18F/identity-idp It's built on Rails, and I'm really impressed at the engineering decisions that were made here, from choice of technologies to level of transparency. I wish all public sector projects could exhibit the same leadership and competence demonstrated for login.gov--the interface is even a pleasure to use, which is hard to say for most government online services outside of the UK and parts of Canada in my experience. Bravo!

hanniabu 5y ago
> They also encrypt user data in a way that they can't access it without the user's password I love how low our standards for government sites have gotten where this is seen as a plus and not something that's expected
- ethbr0 5y ago
  Isn't the US corporate standard even lower? Outside of maybe Google, Facebook, or HIPAA-covered entities. Corporate customer databases I've seen have rarely even been need-to-know access limited, much less actually encrypted to internal users.
  - kube-system 5y ago
    I don't even think a HIPAA-covered entity could hold their data to the standard of zero-knowledge encryption... since, you know, they have to be able to use patient data.
    - chordalkeyboard 5y ago
      in theory they could but I doubt most patients want to have to remotely authorize their provider any time someone wants to access their record.

zht 5y ago

love that Americans are always worried about some sort of national ID/database of citizens being used for nefarious needs

wyc 5y ago
It's in our history to worry about it :')
- Turing_Machine 5y ago
  There also the instructive examples of how such things were (and are) used in Nazi Germany, the Soviet Bloc, China...
zdragnar 5y ago
I'm not sure if this is sarcasm or not, but given history and human nature, it is not an unreasonable concern.
jcadam 5y ago
The main issue is if it's required. Not so worried about myself - I'm a veteran which means my fingerprints and DNA are already on file with the feds somewhere :), but US Citizens with no particular connection to the federal government absolutely shouldn't have to need a "National ID."
- babypuncher 5y ago
  Everyone is already issued a social security number. I'm not sure how a more modern, cryptographic ally secure version would be any more concerning in this regard.
- xxpor 5y ago
  And yet, everyone suffers because of it. We have endless SSN breaches because at the end of the day, having a unique ID for people is really valuable! We could have something way safer, but we get stuck with the status quo which satisfies no one.

ChrisLTD 5y ago

It's amazing they weren't going to do this originally. What a fiasco.

jcadam 5y ago

The VA still uses ID.me - so most veterans have an account anyway (I needed one to get a certificate of eligibility for a VA home loan). I had to add an authorization for the IRS on my ID.me to stop the child credit advance checks from coming last year (that should have never been an opt-out). I also had a few other govt systems I needed to access when I was a defense worker that used it. So hopefully other agencies will move away from ID.me as well.

sputknick 5y ago
ID.me was founded by two veterans, so unlikely to move off of that anytime soon.

bonestamp2 5y ago

If you use Customs and Border Patrol's trusted traveler programs (or some other gov sites), you may already have a login.gov account since that is what they have been using for a few years now.

techsupporter 5y ago
I just wonder what kind of extra hoops we'll have to go through to use an existing login.gov account with the IRS. I read in some article somewhere that the IRS didn't use login.gov because it isn't "as verified" or some kind of thing as the IRS needs. Yet the reason I have a login.gov account is for my NEXUS enrollment which means I've been fingerprinted, background checked, had my passport number linked, and been interviewed in person by two different governments. That seems pretty identity verified to me. If I have to go through some other step, especially if it involves yet another biometric or interview check, that's going to be annoying.
- bonestamp2 5y ago
  Yes, same here... background checked by two countries! Not to mention iris scanned, and they even passports from two countries for me. Hopefully it's not too onerous, like you said... they can be pretty damned sure who we are at this point.
- kube-system 5y ago
  Those steps were a prerequisite to get your NEXUS enrollment -- not to get a login.gov account. The only thing you have to do to enroll in login.gov is verify your email address. And optional feature of login.gov is to verify your identity further by uploading a photo of a state ID, and entering your SSN and phone number. When you validated your identity in person with CBP, this was not that.
  - techsupporter 5y ago
    > When you validated your identity in person with CBP, this was not that. This isn't snarking at you directly, just all I'm really hearing is that the government will happily mix whatever it knows about me for its own purposes but when it comes to making things easier for me (wherein they've literally seen me in person and looked over a stack of my identifying documents), no way that's "violating my privacy." If we are going to have an all-seeing panopticon can't it at least be convenient?

mdb31 5y ago

I'm a foreigner (yes, I know, sorry, sorry) who is a "US Person" and thus needs to (and, to be perfectly clear, is happy to, I'm sorry, I'm not-sorry, I'm sorry about being not-sorry?) pay US income tax. The IRS system is, by far, the worst I've ever had to deal with, and in this I'm comparing the US to countries like Rwanda, where, for some weird reason, I'm also required to pay taxes. Getting an ITIN (sort-of like a SSN, except you're not supposed to use it like that, otherwise they will send Ted Cruz after you...) is an absolute pain, mostly because you can only request it by phone, and literally nobody you talk to is able to spell your name right, DESPITE you repeating it endlessly in just about any spelling alphabet possible. So, you now have a dozen-or-so ITINs (again, like SSNs), all in different names, none of them yours. So, you file your taxes using the ITIN in the names that is closest to yours, and specify this on your tax forms. You send in your forms, and your check, which is cashed immediately. Repeat the next year, and so on. Now, after FOURTEEN years or so, you get sent a letter, informing you of a tax audit, and demanding you are physically present in Austin, Texas, two weeks from the postmark of the letter (never mind it reached you three months after that, and never mind you're located in Europe, which at that time was denied access to the US due to COVID-19). So, you get a lawyer, which costs close to US$ 8000. The lawyer contacts the IRS, which continues to insist on an in-person interview in the past. So, now you're out US$ 8000, and can never travel to the US again. But, yeah, lovely that they now allow additional login tools...

netfortius 5y ago
The fundamental issue here is that there is no meaningful voice of expats in the US, so any attempt to fight a system which wants your money, no matter where you are and make them, in the world, is prone to failure. The only real option is to renounce citizenship.
hanniabu 5y ago
> The IRS system is, by far, the worst I've ever had to deal with That's by design
- jcadam 5y ago
  The byzantine rules exist to create deductions and loopholes for different interest groups. Raising the standard deduction was actually a good move, as it simplified my tax filing for sure (I don't bother to itemize now) -- but I imagine the tax preparation industry (amongst others) was not pleased.

throwhauser 5y ago

Good. There was something absurd about having to accept id.me's terms-of-service, which involved "deals, discounts, cash back rebates and employment and educational opportunities", to access government services online.

awb 5y ago

Has anyone here worked on government websites or APIs? I'm curious what the experience was like.

deleted 5y ago
[deleted]
atlgator 5y ago
It's standards based just like any other SSO these days: OpenID Connect and SAML. Is there something specific you want to know?
- Jerrrry 5y ago
  This is correct. The "FedRamp" contract overhaul pretty much locks in the requirements and specifications to these above implementations. I have designed an API that revolves around and side-steps this that currently serves 60 million US civilians...but in the end, the security assessment pretty much comes down to the Privacy Acts interpretations and the common sense security landscape.
- awb 5y ago
  How is it different from working with a private company? Lots of stakeholders? More documented testing procedures?
  - Spooky23 5y ago
    Someone said it best upthread: the incentives are different. If you are a leader in the bureaucracy, your incentive is to not personally fail, which is not the same as to succeed. There is an army of auditors waiting to question every decision, so the obvious way to avoid that is to not make any. Balancing the need to do something without deciding anything is an art of sorts.
    - wslack 5y ago
      Also, to be clear, those incentives aren't coming from within the bureaucracy. For example, let's say that a program tries to do something and it totally doesn't work. A news story about this will be roughly the same if $10,000 is spent as if $100,000 is spent as if $1,000,000 is spent. That creates an incentive never to label anything a failure and just keep pumping good money after bad - that's how to avoid the negative article.

danso 5y ago

As mentioned in the article, the IRS had originally planned to use ID.me — a private company — before backing down. Previous discussion here: https://news.ycombinator.com/item?id=30126118 https://news.ycombinator.com/item?id=30126118

technofiend 5y ago
And rather controversially require face recognition for login. Good idea in that having another secret only really you should own is good, poor execution in allowing a third party of collect and probably sell something so very personal. I'm glad they backed off.
cyral 5y ago
Note that they are currently using ID.me. I had to use it today to login.

mzs 5y ago

IRS statement itself: https://www.irs.gov/newsroom/irs-statement-new-features-put-in-place-for-irs-online-account-registration-process-strengthened-to-ensure-privacy-and-security https://www.irs.gov/newsroom/irs-statement-new-features-put-...

jimmaswell 5y ago

They should keep the data from id.me and migrate it instead of making people who used id.me sign up and verify all over again.

kylehotchkiss 5y ago
id.me probably wrote not doing this into their contract to prevent the IRS from trying to break it.

throw0101a 5y ago

In Canada, the Canada Revenue Agency (CRA) allows you you to leverage existing relationships with banks and credit unions, "Sign-in Partners": * https://www.canada.ca/en/revenue-agency/services/e-services/cra-login-services/list-sign-partners.html https://www.canada.ca/en/revenue-agency/services/e-services/... * https://www.canada.ca/en/revenue-agency/services/e-services/cra-login-services.html https://www.canada.ca/en/revenue-agency/services/e-services/... * https://verified.me/government-sign-in-by-verified-me/ https://verified.me/government-sign-in-by-verified-me/ You can also create a stand-alone account with the CRA if you wish. Other federal agencies use the 'partner' system as well. It's basically SAML.

pokoleo 5y ago
Major difference in Canada is the # of banks. The big five dominate[1] unlike in the US where there are 100+[2] [1] https://en.wikipedia.org/wiki/List_of_banks_and_credit_unions_in_Canada https://en.wikipedia.org/wiki/List_of_banks_and_credit_union... [2] https://en.wikipedia.org/wiki/List_of_largest_banks_in_the_United_States https://en.wikipedia.org/wiki/List_of_largest_banks_in_the_U...
dgudkov 5y ago
It's not a good choice. The Canadian government still doesn't understand the internet. There should be no obligatory private intermediaries between a citizen and the government no matter online or offline. It should provide an online identity service, just like it already provides offline government-issued IDs (e.g. passports) without involving banks or other private institutions.
- nasalgoat 5y ago
  My favourite part of the CRA website is it has operating hours! It actually closes during non-work hours! Crazy.
- throw0101a 5y ago
  > There should be no obligatory private intermediaries between a citizen and the government no matter online or offline. As I stated in my post: > You can also create a stand-alone account with the CRA if you wish. See Option 2: * https://www.canada.ca/en/revenue-agency/services/e-services/e-services-individuals/account-individuals.html https://www.canada.ca/en/revenue-agency/services/e-services/... The provinces of Alberta and BC also have identity providers (since they issue driver licenses and health cards) which the CRA allows (Option 3).

pandama 5y ago

If you check the previous stories tagged by ID.me (https://www.fedscoop.com/tag/id-me/ https://www.fedscoop.com/tag/id-me/), you'll see some awesome articles sponsored by the same about how Arizon has already saved $40 Billion and how this is great against cyber risk. Sponsored News needs a much more prominent badge. #bringbacktheblinktag

imwillofficial 5y ago

Why did they ever go with ID.me when they have their own comparable solution? I’ve used both and both are solid, one is expensive and externally managed though..

megaman821 5y ago
I thought it was that login.gov does single-sign-on (SSO) and ID.me does SSO and identify verification at both the signup and sign-in level.
- zie 5y ago
  Login.gov absolutely cares about your identity. Case in point: login.gov will share your SSN to the provider(irs.gov in this case), if appropriate permissions are requested.
  - dqv 5y ago
    When does it ask for your identity? I just signed up and all it needed was my email, password, and my token. It doesn’t know who I am though. It didn’t even ask for my name.
    - atonse 5y ago
      They have two tiers. I love their system. The lower tier is like and Internet account. Validate with a password and 2fa, etc. The next tier is required to log in to certain sites and requires you to upload ID etc to verify. Once you have verified with that, you have an extra set of attributes to do more sensitive things on certain sites.
      - dqv 5y ago
        Interesting. I’m looking forward to it when the IRS adopts it.
    - deleted 5y ago
      [deleted]

kylehotchkiss 5y ago

Now let’s hope the California DMV and health department make the same choice so ID.me isn’t further becoming a national ID replacement

iostream24 5y ago

Meanwhile, I’ve spent over a month trying to get verified as myself via ID.me and their broken process that can’t handle Americans living abroad, with foreign secondary documents. A typical round with customer service takes about a week, and then I was told that someone will be able to verify electric bills that aren’t in English, but then that turned out to be weeks ago and it’s yet to happen. This is all merely to set the stage for being ELIGIBLE for a human to do a video conference verification with me, which they hopefully will deign to do. A singular corporation (ID.me) holds every American’s ability to login to their government tax profile hostage, and we pay them for the pleasure of this rotten monopoly and abuse of public trust. I just want to pay my taxes, sigh. It should be as easy as any other bill or process. Making taxpayers suffer more does not generate extra revenue for the state. There is literally no call nor need for all this extra stressful nonsense making people sweat every April. It’s actually counterproductive to fund raising for state activities. Bureaucracy steals lives and health for wasteful ends that do not benefit the group. The likelihood of reforming our deliberately and absurdly arcane tax system is about as high as large corps and oligarchs paying their fair share, nevertheless we should insist. That said, I’m cautiously optimistic about this excellent announcement to reduce future peoples suffering. I also gladly submitted biometric video scans and it still wasn’t good enough for ID.me So, I wonder if I’ll still be trying to get verified by the time this new system rolls out…

zzleeper 5y ago
Same here. I hate ID.me and their piece of crap system. Never managed to get it working after wasting so much time. Luckily, I don't _need it_, so at the end I just gave up and used different methods. Would hate it if I'm actually unemployed and had to use that terrible firm.
AndyMcConachie 5y ago
I cannot upvote this comment enough! I'm an American abroad and I spent roughly 8 hours spread across 5 days getting access to my irs.gov account. And yes, I actually recorded time spent on this chore. The worst part was not the facial recognition. It was the fact that I had an address outside of the USA and they would not recognize a non-USA utility company for address verification. This was stupid for two reasons. The first being the obvious requirement that a non-resident have a contract with a utility company in the USA, and the second being that the IRS has been mailing me at my non-USA address for years. The IRS already had my address, but I had to verify it with ID.me. The other worst part was they never told me WHY my various utility bills and bank statements were being rejected. At one point they told me I had to translate a bank statement, and that was the most feedback I ever got. But then I translated it and they rejected it for an unknown reason. I eventually got my registration through them by getting a USA bank to recognize my foreign address. Luckily I also had an old W-2 laying around from years ago when I briefly worked in the states. Do they expect my current employer to give me a W-2? Finally, on their stupid video call I was told I needed to have all of this documentation, which I dutifully prepared, and then all the person cared about was me holding my passport up to the camera. Completely broken process for Americans abroad. To the point where they're likely breaking some US law by making it so difficult for non-residents to register for IRS access. I hated it and I hope ID.me dies in a pit of bankruptcy.

dokument 5y ago

Issues with login.gov don't make me very confident. Try putting in 2 lower security passwords but then backspace deleting them and you get. zxcvbn.feedback.use_a_few_words_avoid_common_phraseszxcvbn.feedback.no_need_for_symbols_digits_or_uppercase_letters visible on the screen. I get it isn't a technical issue but still, doesn't give me confidence

klaussilveira 5y ago
They fixed that recently: https://github.com/18F/identity-idp/commit/873c71ca8c0cf61d345e0eb9040209802eaefe1d https://github.com/18F/identity-idp/commit/873c71ca8c0cf61d3...

deleted 5y ago

[deleted]

Teknoman117 5y ago

That's the one I had to use to sign up for GlobalEntry and TSA Precheck. Highly recommend if you travel a lot ... or plan to again at some point given the current state of affairs.