4 ms·

Tell HN: IRS Forcing ID.me Logins

35 points by arkadiyt 3y ago

A year or so ago the IRS was starting to force people to use ID.me logins, a 3rd party service which collected your biometrics, instead of the existing login.gov login. The internet revolted and they relented for a while, but it seems like they made the switch afterall - you can now only login using ID.me.

piperswe 3y ago
Yikes... login.gov is such a well-made piece of software in my experience, it's a shame the IRS is using something from the private sector. The GSA makes some surprisingly good tech for being a part of the federal government.
- robcohen 3y ago
  I believe login.gov was made by 18F, a highly specialized group of hackers. Yes they technically are out of GSA but their individual backgrounds are no joke. Check out their GitHub https://github.com/18F https://github.com/18F
atrettel 3y ago
I do not know why the IRS is still using ID.me, but Login.gov does now have identity verification [1], so the IRS cannot claim anymore that a lack of identify verification with Login.gov is the reason why they only allow ID.me. I did the Login.gov identity verification process in March and it was quick and streamlined. It only took about 15 minutes and required photos of my driver's license and some additional information. Afterwards, when you log in to Login.gov, at the top of the page is a green checkmark with the label "Verified Account" confirming that your identity has been verified by Login.gov. I should also note that some news media [2] have reported that the IRS is almost ready to start using Login.gov. This article is from March, and obviously the IRS did not start using Login.gov in the time frame described in the article. Again, I do not know why the IRS is still using ID.me, but the justification keeps getting weaker and weaker in my opinion. [1] https://www.login.gov/help/verify-your-identity/overview/ https://www.login.gov/help/verify-your-identity/overview/ [2] https://www.nextgov.com/it-modernization/2023/03/plans-approve-use-login-dot-gov-tax-day-nears/383932/ https://www.nextgov.com/it-modernization/2023/03/plans-appro...
- deleted 3y ago
  [deleted]
- toomuchtodo 3y ago
  This was the sticking point and why IRS adopting Login.gov was delayed. In short, ID.me's face scanning is what Login.gov was missing to provide strong identity assurance for IRS. I am not aware of how Login.gov intends to replicate this assurance. > In particular, that report found that the General Services Administration had continued to bill agencies for Identity Assurance Level 2-complaint services, even though Login.gov did not meet IAL2 standards. > Login.gov does not meet IAL2, which is an identity proofing requirement set by the National Institute of Standards and Technology as part of its SP 800-63 guidance series that provides crucial technical requirements and guidance for identity proofing by government IT systems on open networks. https://fedscoop.com/internal-revenue-service-to-expand-use-of-login-gov/ https://fedscoop.com/internal-revenue-service-to-expand-use-... NIST SP 800-63 IAL2 Remote Identity Proofing https://pages.nist.gov/800-63-3-Implementation-Resources/63A/ial2remote/ https://pages.nist.gov/800-63-3-Implementation-Resources/63A...
  - atrettel 3y ago
    Interesting, I was unaware of these standards. It seems that different agencies want different things, since the existing identity verification by Login.gov was good enough for one federal agency but not good enough for the IRS. The federal government is not monolithic.
  - idontwantthis 3y ago
    ID.me didn't meet any face scanning requirement either. It was a pure scam the time I had to try to use it. Rejected me and my perfectly scanned passport and I had to wait in a digital queue for a real person to look at my face through the webcam.
    - toomuchtodo 3y ago
      https://www.id.me/business/identity-verification https://www.id.me/business/identity-verification > ID.me uses liveness detection and advanced machine learning technologies to determine match between applicant’s image on their government identity document and the applicant’s image on their selfie.
voakbasda 3y ago
Well, I will no longer be using their web site, I guess. I’m simply not going to hand over my information to ID.me.

35 points by arkadiyt 3y ago

piperswe 3y ago

Yikes... login.gov is such a well-made piece of software in my experience, it's a shame the IRS is using something from the private sector. The GSA makes some surprisingly good tech for being a part of the federal government.

robcohen 3y ago
I believe login.gov was made by 18F, a highly specialized group of hackers. Yes they technically are out of GSA but their individual backgrounds are no joke. Check out their GitHub https://github.com/18F https://github.com/18F

atrettel 3y ago

I do not know why the IRS is still using ID.me, but Login.gov does now have identity verification [1], so the IRS cannot claim anymore that a lack of identify verification with Login.gov is the reason why they only allow ID.me. I did the Login.gov identity verification process in March and it was quick and streamlined. It only took about 15 minutes and required photos of my driver's license and some additional information. Afterwards, when you log in to Login.gov, at the top of the page is a green checkmark with the label "Verified Account" confirming that your identity has been verified by Login.gov. I should also note that some news media [2] have reported that the IRS is almost ready to start using Login.gov. This article is from March, and obviously the IRS did not start using Login.gov in the time frame described in the article. Again, I do not know why the IRS is still using ID.me, but the justification keeps getting weaker and weaker in my opinion. [1] https://www.login.gov/help/verify-your-identity/overview/ https://www.login.gov/help/verify-your-identity/overview/ [2] https://www.nextgov.com/it-modernization/2023/03/plans-approve-use-login-dot-gov-tax-day-nears/383932/ https://www.nextgov.com/it-modernization/2023/03/plans-appro...

deleted 3y ago
[deleted]
toomuchtodo 3y ago
This was the sticking point and why IRS adopting Login.gov was delayed. In short, ID.me's face scanning is what Login.gov was missing to provide strong identity assurance for IRS. I am not aware of how Login.gov intends to replicate this assurance. > In particular, that report found that the General Services Administration had continued to bill agencies for Identity Assurance Level 2-complaint services, even though Login.gov did not meet IAL2 standards. > Login.gov does not meet IAL2, which is an identity proofing requirement set by the National Institute of Standards and Technology as part of its SP 800-63 guidance series that provides crucial technical requirements and guidance for identity proofing by government IT systems on open networks. https://fedscoop.com/internal-revenue-service-to-expand-use-of-login-gov/ https://fedscoop.com/internal-revenue-service-to-expand-use-... NIST SP 800-63 IAL2 Remote Identity Proofing https://pages.nist.gov/800-63-3-Implementation-Resources/63A/ial2remote/ https://pages.nist.gov/800-63-3-Implementation-Resources/63A...
- atrettel 3y ago
  Interesting, I was unaware of these standards. It seems that different agencies want different things, since the existing identity verification by Login.gov was good enough for one federal agency but not good enough for the IRS. The federal government is not monolithic.
- idontwantthis 3y ago
  ID.me didn't meet any face scanning requirement either. It was a pure scam the time I had to try to use it. Rejected me and my perfectly scanned passport and I had to wait in a digital queue for a real person to look at my face through the webcam.
  - toomuchtodo 3y ago
    https://www.id.me/business/identity-verification https://www.id.me/business/identity-verification > ID.me uses liveness detection and advanced machine learning technologies to determine match between applicant’s image on their government identity document and the applicant’s image on their selfie.

voakbasda 3y ago

Well, I will no longer be using their web site, I guess. I’m simply not going to hand over my information to ID.me.