4 ms·

It also seems weird since the US government runs login.gov

by dangus 3y ago

tomrod 3y ago
Apparently login.gov doesn't have the right security process in place to meet the right CISA standard (paraphrasing). So instead of funding it, we continue issuing 95% of maintenance funding each boxing round between showboating legislators issuing continuing resolutions.
- toomuchtodo 3y ago
  Login.gov does not provide a sufficient level of identity assurance (IAL2 [1]) to serve as the IDP for this pilot and IRS functions in general (ID.me liveness check and facial recognition). IRS is working with Login.gov to upgrade Login.gov to deprecate ID.me for this purpose [2] [3]. Would it make sense to not proceed with this pilot until this was ready? Certainly not; Login.gov will catch up and meet IRS in the future as Direct File expands next filing season. Very similar to when Social Security Administration (ssa.gov) transitioned from ID.me and their internal IDP to Login.gov on September 18, 2021 [4]. (Login.gov partners with USPS to perform in person identity proofing for those who cannot perform remote proofing via a mobile device; a bar code is generated, which you print out or display on a mobile device for presentation to a USPS clerk with a government credential) [1] https://pages.nist.gov/800-63-3-Implementation-Resources/63A/ial2remote/ https://pages.nist.gov/800-63-3-Implementation-Resources/63A... [2] https://news.ycombinator.com/item?id=30430851 https://news.ycombinator.com/item?id=30430851 [3] https://fedscoop.com/irs-to-adopt-login-gov-as-user-authentication-tool/ https://fedscoop.com/irs-to-adopt-login-gov-as-user-authenti... [4] https://faq.ssa.gov/en-US/Topic/article/KA-03217 https://faq.ssa.gov/en-US/Topic/article/KA-03217
  - tomrod 3y ago
    Thank you, thank you, thank you for the info update! My understanding was clearly incomplete.
  - thfuran 3y ago
    >Would it make sense to not proceed with this pilot until this was ready? Certainly not Absolutely, yes.
    - eropple 3y ago
      Why? Iteration is something to be embraced rather than stigmatized in moving towards a more responsive set of government services. Login.gov is the future of government identity in the United States, but IAL2 is a higher bar than most government services need; waiting for IAL2 implementation is a tradeoff in favor of understandable-but-abstract risks against addressing a concrete harm that exists now. You have an opt-out (use the existing methods of filing, including mail), and you're not harmed or even treated less preferentially by the existence of the ID.me option.
      - thfuran 3y ago
        Because a US government service should not be outsourcing to a .me domain. I don't really care whether their internal service has IAL2, but it should be on .gov.
        Atotalnoob 3y ago
        It’s just a domain name? It resolves to US based nameservers, the company is US based, with offices in the US, the founders are US citizens. Would idme.com make you happy? As much as I dislike Id.me, the domain name isn’t something to get upset at, it’s just branding…
        tomrod 3y ago
        I think parent comment assumes the DNS mapping is owned by the `.me` TLD owner, setting up an external contact that may or may not be hostile to owners of `.gov` TLD owner (the US), setting up a potential for nefarious activity. "just a domain name" but MITM DNS attacks exist.
      - lupire 3y ago
        The government is putting citizens at risk by allowing a bad solution (ID.me) and wasting time supporting it that could be spent working on login.gov.
jeff_carr 3y ago
The IRS being accused of being criminal all the time doesn't gain any confidence running it's own user authentication through a foreign country instead of login.gov.
- gumby 3y ago
  > The IRS being accused of being criminal all the time What?? I read the news a lot and don’t see this. I doubt login.me has any connection to Montenegro except for which registrars manage the domain name itself. This is not a defense of their choice of vendor.
  - macinjosh 3y ago
    Just one example: https://www.msn.com/en-us/news/us/irs-committed-alarming-civil-liberties-abuses-with-unannounced-field-visits-congressional-report-finds/ar-AA1j6VrJ https://www.msn.com/en-us/news/us/irs-committed-alarming-civ...
    - gumby 3y ago
      Ah yes, the “subcommittee on weaponizing government”, a credible, neutral group. I do believe this was an issue (in fact suborned by FBI practices) in the 1960s against civil rights targets, but I haven’t seen any credible accusations since the Nixon era.
      - lupire 3y ago
        I can forgive you for not reading the article on the MSN spam site. Here's the original: https://www.nationalreview.com/news/irs-committed-alarming-civil-liberties-abuses-with-unannounced-field-visits-congressional-report-finds/ https://www.nationalreview.com/news/irs-committed-alarming-c... It's literally an investigation into the government weopanizing the IRS. The IRS published documents you can view yourself to see their misdeeds. The IRS has since apologized and updated policy to curtail (but not eliminate) the authoritarian behavior. You don't give yourself credibility by making up names.
gumby 3y ago
I think the IRS should use login.gov, but there is a legitimate argument for them not doing so (not that I consider their choice responsible). The argument is that for the tax system to work, collection should live in a silo: drug dealers should pay tax without fear of prosecution (except for tax evasion), etc. This is the same reason TSA (if its mission were to keep people safe) should not look for anything but threats: we don’t want drug smugglers to invest in concealment technology when they fly. The downside of the IRS using login.gov is that it theoretically could make interagency data sharing easier. In practice, though, it would probably makes things more secure.
- nottorp 3y ago
  So how many drug dealers actually pay tax in the US?
  - jwie 3y ago
    This is essentially the purpose of money laundering, so a lot.
    - thfuran 3y ago
      No, money laundering exists largely because we don't have that. They're talking about just declaring the income from selling drugs on tax filings.
      - gumby 3y ago
        Non-IRS authorities (e.g. FINCEN) can also track the flow so in the US money laundering is more to thwart them, though lower taxes is a bonus.
      - lupire 3y ago
        jwie has the argument slightly wrong. Taxes are a side benefit of money laundering, which makes it unnecessary to report drug income directly for taxes. Money laundering's purpose is to fabricate proof of legal income, to divert suspicion from the observable existence of wealth that has no legal explanation.

It also seems weird since the US government runs login.gov

by dangus 3y ago

It also seems weird since the US government runs login.gov

Apparently login.gov doesn't have the right security process in place to meet the right CISA standard (paraphrasing). So instead of funding it, we continue issuing 95% of maintenance funding each boxing round between showboating legislators issuing continuing resolutions.

toomuchtodo 3y ago
Login.gov does not provide a sufficient level of identity assurance (IAL2 [1]) to serve as the IDP for this pilot and IRS functions in general (ID.me liveness check and facial recognition). IRS is working with Login.gov to upgrade Login.gov to deprecate ID.me for this purpose [2] [3]. Would it make sense to not proceed with this pilot until this was ready? Certainly not; Login.gov will catch up and meet IRS in the future as Direct File expands next filing season. Very similar to when Social Security Administration (ssa.gov) transitioned from ID.me and their internal IDP to Login.gov on September 18, 2021 [4]. (Login.gov partners with USPS to perform in person identity proofing for those who cannot perform remote proofing via a mobile device; a bar code is generated, which you print out or display on a mobile device for presentation to a USPS clerk with a government credential) [1] https://pages.nist.gov/800-63-3-Implementation-Resources/63A/ial2remote/ https://pages.nist.gov/800-63-3-Implementation-Resources/63A... [2] https://news.ycombinator.com/item?id=30430851 https://news.ycombinator.com/item?id=30430851 [3] https://fedscoop.com/irs-to-adopt-login-gov-as-user-authentication-tool/ https://fedscoop.com/irs-to-adopt-login-gov-as-user-authenti... [4] https://faq.ssa.gov/en-US/Topic/article/KA-03217 https://faq.ssa.gov/en-US/Topic/article/KA-03217
- tomrod 3y ago
  Thank you, thank you, thank you for the info update! My understanding was clearly incomplete.
- thfuran 3y ago
  >Would it make sense to not proceed with this pilot until this was ready? Certainly not Absolutely, yes.
  - eropple 3y ago
    Why? Iteration is something to be embraced rather than stigmatized in moving towards a more responsive set of government services. Login.gov is the future of government identity in the United States, but IAL2 is a higher bar than most government services need; waiting for IAL2 implementation is a tradeoff in favor of understandable-but-abstract risks against addressing a concrete harm that exists now. You have an opt-out (use the existing methods of filing, including mail), and you're not harmed or even treated less preferentially by the existence of the ID.me option.
    - thfuran 3y ago
      Because a US government service should not be outsourcing to a .me domain. I don't really care whether their internal service has IAL2, but it should be on .gov.
      - Atotalnoob 3y ago
        It’s just a domain name? It resolves to US based nameservers, the company is US based, with offices in the US, the founders are US citizens. Would idme.com make you happy? As much as I dislike Id.me, the domain name isn’t something to get upset at, it’s just branding…
        tomrod 3y ago
        I think parent comment assumes the DNS mapping is owned by the `.me` TLD owner, setting up an external contact that may or may not be hostile to owners of `.gov` TLD owner (the US), setting up a potential for nefarious activity. "just a domain name" but MITM DNS attacks exist.
    - lupire 3y ago
      The government is putting citizens at risk by allowing a bad solution (ID.me) and wasting time supporting it that could be spent working on login.gov.

jeff_carr 3y ago

The IRS being accused of being criminal all the time doesn't gain any confidence running it's own user authentication through a foreign country instead of login.gov.

gumby 3y ago
> The IRS being accused of being criminal all the time What?? I read the news a lot and don’t see this. I doubt login.me has any connection to Montenegro except for which registrars manage the domain name itself. This is not a defense of their choice of vendor.
- macinjosh 3y ago
  Just one example: https://www.msn.com/en-us/news/us/irs-committed-alarming-civil-liberties-abuses-with-unannounced-field-visits-congressional-report-finds/ar-AA1j6VrJ https://www.msn.com/en-us/news/us/irs-committed-alarming-civ...
  - gumby 3y ago
    Ah yes, the “subcommittee on weaponizing government”, a credible, neutral group. I do believe this was an issue (in fact suborned by FBI practices) in the 1960s against civil rights targets, but I haven’t seen any credible accusations since the Nixon era.
    - lupire 3y ago
      I can forgive you for not reading the article on the MSN spam site. Here's the original: https://www.nationalreview.com/news/irs-committed-alarming-civil-liberties-abuses-with-unannounced-field-visits-congressional-report-finds/ https://www.nationalreview.com/news/irs-committed-alarming-c... It's literally an investigation into the government weopanizing the IRS. The IRS published documents you can view yourself to see their misdeeds. The IRS has since apologized and updated policy to curtail (but not eliminate) the authoritarian behavior. You don't give yourself credibility by making up names.

gumby 3y ago

I think the IRS should use login.gov, but there is a legitimate argument for them not doing so (not that I consider their choice responsible). The argument is that for the tax system to work, collection should live in a silo: drug dealers should pay tax without fear of prosecution (except for tax evasion), etc. This is the same reason TSA (if its mission were to keep people safe) should not look for anything but threats: we don’t want drug smugglers to invest in concealment technology when they fly. The downside of the IRS using login.gov is that it theoretically could make interagency data sharing easier. In practice, though, it would probably makes things more secure.

nottorp 3y ago
So how many drug dealers actually pay tax in the US?
- jwie 3y ago
  This is essentially the purpose of money laundering, so a lot.
  - thfuran 3y ago
    No, money laundering exists largely because we don't have that. They're talking about just declaring the income from selling drugs on tax filings.
    - gumby 3y ago
      Non-IRS authorities (e.g. FINCEN) can also track the flow so in the US money laundering is more to thwart them, though lower taxes is a bonus.
    - lupire 3y ago
      jwie has the argument slightly wrong. Taxes are a side benefit of money laundering, which makes it unnecessary to report drug income directly for taxes. Money laundering's purpose is to fabricate proof of legal income, to divert suspicion from the observable existence of wealth that has no legal explanation.