6 ms·

Irs.gov set to require 3rd party auth next filing season

6 points by paws 3y ago

paws 3y ago
Apparently starting next filing season, irs.gov will require the public to use "something else" to login vs the traditional username/password I've been using for a while, presumably managed by the IRS's own servers. Two questions: 1) id.me seems to have a spotty track record given the $86 million we paid for the two year contract [1]. Setting aside the weirdness of being required to go through a private corporation to see my own government data, I noticed their terms [2] Section 19 lists _mandatory arbitration_. Awful (Of mild interest, irs.gov doesn't appear to even have a terms page, rather only a Privacy Policy and Accessibility page.) It's 2023 and the public is online. Why should the public be required to go through a third party to access government services they already paid for? 2) Anyone know what happened to login.gov? Right now the login page [3] lists only id.me. Over a year ago it was announced [4] login.gov was supposed to be available [5]. Login.gov appears to be a USDS/18F project [6] and would seem more palatable than id.me. Why did it fail this year? [1] https://www.nytimes.com/2022/02/21/us/politics/irs-facial-recognition.html https://www.nytimes.com/2022/02/21/us/politics/irs-facial-re... [2] https://www.id.me/terms https://www.id.me/terms [3] https://sa.www4.irs.gov/secureaccess/ui/ https://sa.www4.irs.gov/secureaccess/ui/ [4] https://federalnewsnetwork.com/agency-oversight/2022/02/irs-plans-pivot-to-login-gov-lets-users-create-online-accounts-without-facial-recognition/ https://federalnewsnetwork.com/agency-oversight/2022/02/irs-... [5] https://www.nextgov.com/it-modernization/2023/03/irs-cio-moving-treasury-cto-post/383780/ https://www.nextgov.com/it-modernization/2023/03/irs-cio-mov... [6] https://www.usds.gov/report-to-congress/2017/07/login-dot-gov/ https://www.usds.gov/report-to-congress/2017/07/login-dot-go...
- erik_seaberg 3y ago
  login.gov works fine with ssa.gov, it looks like irs.gov needs to add them as an option.
  - paws 3y ago
    > login.gov works fine with ssa.gov Could you please be more specific? How do you know? The flow I've been using goes like this, starting at the IRS website: 1) irs.gov homepage -> click 'Sign in to Your Account' 2) https://www.irs.gov/payments/your-online-account https://www.irs.gov/payments/your-online-account -> click 'Sign in to your Online Account' 3) https://sa.www4.irs.gov/secureaccess/ui/?TYPE=blahblah https://sa.www4.irs.gov/secureaccess/ui/?TYPE=blahblah (uuid/session url param) I'd consider using login.gov, but apparently someone didn't finish the job yet even though it's been at least one year since this was announced. It occurs to me SSO is nice in theory but one might surmise the diffusion of responsibility is problematic.
    - toomuchtodo 3y ago
      https://www.theverge.com/2022/2/22/22946108/irs-login-gov-id-me-tax-season-facial-recognition https://www.theverge.com/2022/2/22/22946108/irs-login-gov-id... https://www.biometricupdate.com/202303/irs-gutsy-move-plug-in-login-gov-at-the-last-minute-for-id-verification https://www.biometricupdate.com/202303/irs-gutsy-move-plug-i... https://fcw.com/digital-government/2023/03/planned-login-dot-gov-deployment-irs-postponed/384476/ https://fcw.com/digital-government/2023/03/planned-login-dot...
      - paws 3y ago
        Thank you. Of all those links I found this the best primary source https://www.gsaig.gov/sites/default/files/ipa-reports/GSA%20Misled%20Customers%20on%20Login.gov%27s%20Compliance%20with%20Digital%20Identity%20Standards%20%28JE23-003%29_Redacted.pdf https://www.gsaig.gov/sites/default/files/ipa-reports/GSA%20... I don't really understand it, but IMO it will be a real shame if interagency squabbling or whatever this is forces the public to using id.me for login. Fingers crossed things shape up!
        deleted 3y ago
        [deleted]
    - erik_seaberg 3y ago
LinuxBender 3y ago
The only option I was given a couple years ago was to use id.me. Did they remove that restriction?
- paws 3y ago
  I seem to recall having the opposite experience - vanilla username/password was the only option a few years ago, then later at some point id.me showed up as an option. If id.me ends up being required, that will be pretty gross...
  - LinuxBender 3y ago
    It was certainly the only option when I signed up otherwise I would have been fine with a u/p on their site. Perhaps I was part of some A/B testing? I only signed up because the IRS said they were closing the BofA/Wells PO boxes. Perhaps they were bluffing.

6 points by paws 3y ago

paws 3y ago

Apparently starting next filing season, irs.gov will require the public to use "something else" to login vs the traditional username/password I've been using for a while, presumably managed by the IRS's own servers. Two questions: 1) id.me seems to have a spotty track record given the $86 million we paid for the two year contract [1]. Setting aside the weirdness of being required to go through a private corporation to see my own government data, I noticed their terms [2] Section 19 lists _mandatory arbitration_. Awful (Of mild interest, irs.gov doesn't appear to even have a terms page, rather only a Privacy Policy and Accessibility page.) It's 2023 and the public is online. Why should the public be required to go through a third party to access government services they already paid for? 2) Anyone know what happened to login.gov? Right now the login page [3] lists only id.me. Over a year ago it was announced [4] login.gov was supposed to be available [5]. Login.gov appears to be a USDS/18F project [6] and would seem more palatable than id.me. Why did it fail this year? [1] https://www.nytimes.com/2022/02/21/us/politics/irs-facial-recognition.html https://www.nytimes.com/2022/02/21/us/politics/irs-facial-re... [2] https://www.id.me/terms https://www.id.me/terms [3] https://sa.www4.irs.gov/secureaccess/ui/ https://sa.www4.irs.gov/secureaccess/ui/ [4] https://federalnewsnetwork.com/agency-oversight/2022/02/irs-plans-pivot-to-login-gov-lets-users-create-online-accounts-without-facial-recognition/ https://federalnewsnetwork.com/agency-oversight/2022/02/irs-... [5] https://www.nextgov.com/it-modernization/2023/03/irs-cio-moving-treasury-cto-post/383780/ https://www.nextgov.com/it-modernization/2023/03/irs-cio-mov... [6] https://www.usds.gov/report-to-congress/2017/07/login-dot-gov/ https://www.usds.gov/report-to-congress/2017/07/login-dot-go...

erik_seaberg 3y ago
login.gov works fine with ssa.gov, it looks like irs.gov needs to add them as an option.
- paws 3y ago
  > login.gov works fine with ssa.gov Could you please be more specific? How do you know? The flow I've been using goes like this, starting at the IRS website: 1) irs.gov homepage -> click 'Sign in to Your Account' 2) https://www.irs.gov/payments/your-online-account https://www.irs.gov/payments/your-online-account -> click 'Sign in to your Online Account' 3) https://sa.www4.irs.gov/secureaccess/ui/?TYPE=blahblah https://sa.www4.irs.gov/secureaccess/ui/?TYPE=blahblah (uuid/session url param) I'd consider using login.gov, but apparently someone didn't finish the job yet even though it's been at least one year since this was announced. It occurs to me SSO is nice in theory but one might surmise the diffusion of responsibility is problematic.
  - toomuchtodo 3y ago
    https://www.theverge.com/2022/2/22/22946108/irs-login-gov-id-me-tax-season-facial-recognition https://www.theverge.com/2022/2/22/22946108/irs-login-gov-id... https://www.biometricupdate.com/202303/irs-gutsy-move-plug-in-login-gov-at-the-last-minute-for-id-verification https://www.biometricupdate.com/202303/irs-gutsy-move-plug-i... https://fcw.com/digital-government/2023/03/planned-login-dot-gov-deployment-irs-postponed/384476/ https://fcw.com/digital-government/2023/03/planned-login-dot...
    - paws 3y ago
      Thank you. Of all those links I found this the best primary source https://www.gsaig.gov/sites/default/files/ipa-reports/GSA%20Misled%20Customers%20on%20Login.gov%27s%20Compliance%20with%20Digital%20Identity%20Standards%20%28JE23-003%29_Redacted.pdf https://www.gsaig.gov/sites/default/files/ipa-reports/GSA%20... I don't really understand it, but IMO it will be a real shame if interagency squabbling or whatever this is forces the public to using id.me for login. Fingers crossed things shape up!
      - deleted 3y ago
        [deleted]
  - erik_seaberg 3y ago

LinuxBender 3y ago

The only option I was given a couple years ago was to use id.me. Did they remove that restriction?

paws 3y ago
I seem to recall having the opposite experience - vanilla username/password was the only option a few years ago, then later at some point id.me showed up as an option. If id.me ends up being required, that will be pretty gross...
- LinuxBender 3y ago
  It was certainly the only option when I signed up otherwise I would have been fine with a u/p on their site. Perhaps I was part of some A/B testing? I only signed up because the IRS said they were closing the BofA/Wells PO boxes. Perhaps they were bluffing.