3 ms·

Accessing government services should never result in your personal data being delivered into the hands of private for profit companies. If they want us to hand

Accessing government services should never result in your personal data being delivered into the hands of private for profit companies. If they want us to hand over our facial recognition data (something that has never been needed before and isn't actually needed now) the government should create their own service where any data collected is never used for anything else. I think it's just pure laziness and a total lack of concern for the public that government websites are full of Google trackers, but when I see a company like ID.me being used I assume somebody is getting a nice kickback somewhere for handing over the American public's data to a private company to exploit and enrich themselves with and all at the tax payers expense.

llimllib 4y ago
I think from the IRS' perspective, they wanted to reach a NIST-certified level of identity verification (NIST 800-63A IAL2 [1]), and there is no governmental service which offered the ability to do that[2], so they went to a private company. I have a lot of notes around this whole dustup; it's my opinion that: - The IRS acted in good faith trying to secure its website in the best way possible - It's very unfortunate that the US government at the same time promotes a particular standard, but does not provide a service matching that standard and seems to currently have no plans to do so [1]: https://pages.nist.gov/800-63-3/sp800-63a.html https://pages.nist.gov/800-63-3/sp800-63a.html [2]: login.gov is IAL1 but not IAL2 compliant; IAL2 compliance requires biometric verification and login.gov does not do this. I also think the IRS had concerns around scaling login.gov, but that the lack of biometric verification was decisive[3] [3]: https://twitter.com/llimllib/status/1490802056256532480 https://twitter.com/llimllib/status/1490802056256532480
- tomrod 4y ago
  I think the backlash also pole-vaulted login.gov to the forefront.
  - toomuchtodo 4y ago
    Good!
  - llimllib 4y ago
    Yes, absolutely. However, they still have to work through the scaling issues and the govvies need to figure out how to deal with the fact that login.gov not only does not, but will not implement IAL2.
- divbzero 4y ago
  > It's very unfortunate that the US government at the same time promotes a particular standard, but does not provide a service matching that standard and seems to currently have no plans to do so id.gov could be a great project for the US Digital Service [4] and 18F [5] who are the ones that delivered login.gov [6]. [4]: https://www.usds.gov/ https://www.usds.gov/ [5]: https://18f.gsa.gov/ https://18f.gsa.gov/ [6]: https://digital.gov/2017/08/28/government-launches-login-gov-to-simplify-access-to-public-services/ https://digital.gov/2017/08/28/government-launches-login-gov...
merely-unlikely 4y ago
The CA DMV sells personal data for $50m/yr [1] and I'm sure it's not the only one. Gov doesn't care about your privacy. [1] https://www.nbcsandiego.com/news/local/ca-dmv-makes-50m-selling-personal-data-report-says/2202432/ https://www.nbcsandiego.com/news/local/ca-dmv-makes-50m-sell...
- kevin_thibedeau 4y ago
  New York sells it to private companies in foreign countries.

llimllib 4y ago

I think from the IRS' perspective, they wanted to reach a NIST-certified level of identity verification (NIST 800-63A IAL2 [1]), and there is no governmental service which offered the ability to do that[2], so they went to a private company. I have a lot of notes around this whole dustup; it's my opinion that: - The IRS acted in good faith trying to secure its website in the best way possible - It's very unfortunate that the US government at the same time promotes a particular standard, but does not provide a service matching that standard and seems to currently have no plans to do so [1]: https://pages.nist.gov/800-63-3/sp800-63a.html https://pages.nist.gov/800-63-3/sp800-63a.html [2]: login.gov is IAL1 but not IAL2 compliant; IAL2 compliance requires biometric verification and login.gov does not do this. I also think the IRS had concerns around scaling login.gov, but that the lack of biometric verification was decisive[3] [3]: https://twitter.com/llimllib/status/1490802056256532480 https://twitter.com/llimllib/status/1490802056256532480

tomrod 4y ago
I think the backlash also pole-vaulted login.gov to the forefront.
- toomuchtodo 4y ago
  Good!
- llimllib 4y ago
  Yes, absolutely. However, they still have to work through the scaling issues and the govvies need to figure out how to deal with the fact that login.gov not only does not, but will not implement IAL2.
divbzero 4y ago
> It's very unfortunate that the US government at the same time promotes a particular standard, but does not provide a service matching that standard and seems to currently have no plans to do so id.gov could be a great project for the US Digital Service [4] and 18F [5] who are the ones that delivered login.gov [6]. [4]: https://www.usds.gov/ https://www.usds.gov/ [5]: https://18f.gsa.gov/ https://18f.gsa.gov/ [6]: https://digital.gov/2017/08/28/government-launches-login-gov-to-simplify-access-to-public-services/ https://digital.gov/2017/08/28/government-launches-login-gov...

merely-unlikely 4y ago

The CA DMV sells personal data for $50m/yr [1] and I'm sure it's not the only one. Gov doesn't care about your privacy. [1] https://www.nbcsandiego.com/news/local/ca-dmv-makes-50m-selling-personal-data-report-says/2202432/ https://www.nbcsandiego.com/news/local/ca-dmv-makes-50m-sell...

kevin_thibedeau 4y ago
New York sells it to private companies in foreign countries.