3 ms·

Apparently login.gov doesn't have the right security process in place to meet the right CISA standard (paraphrasing). So instead of funding it, we continue iss

by tomrod 3y ago

Apparently login.gov doesn't have the right security process in place to meet the right CISA standard (paraphrasing). So instead of funding it, we continue issuing 95% of maintenance funding each boxing round between showboating legislators issuing continuing resolutions.

toomuchtodo 3y ago
Login.gov does not provide a sufficient level of identity assurance (IAL2 [1]) to serve as the IDP for this pilot and IRS functions in general (ID.me liveness check and facial recognition). IRS is working with Login.gov to upgrade Login.gov to deprecate ID.me for this purpose [2] [3]. Would it make sense to not proceed with this pilot until this was ready? Certainly not; Login.gov will catch up and meet IRS in the future as Direct File expands next filing season. Very similar to when Social Security Administration (ssa.gov) transitioned from ID.me and their internal IDP to Login.gov on September 18, 2021 [4]. (Login.gov partners with USPS to perform in person identity proofing for those who cannot perform remote proofing via a mobile device; a bar code is generated, which you print out or display on a mobile device for presentation to a USPS clerk with a government credential) [1] https://pages.nist.gov/800-63-3-Implementation-Resources/63A/ial2remote/ https://pages.nist.gov/800-63-3-Implementation-Resources/63A... [2] https://news.ycombinator.com/item?id=30430851 https://news.ycombinator.com/item?id=30430851 [3] https://fedscoop.com/irs-to-adopt-login-gov-as-user-authentication-tool/ https://fedscoop.com/irs-to-adopt-login-gov-as-user-authenti... [4] https://faq.ssa.gov/en-US/Topic/article/KA-03217 https://faq.ssa.gov/en-US/Topic/article/KA-03217
- tomrod 3y ago
  Thank you, thank you, thank you for the info update! My understanding was clearly incomplete.
- thfuran 3y ago
  >Would it make sense to not proceed with this pilot until this was ready? Certainly not Absolutely, yes.
  - eropple 3y ago
    Why? Iteration is something to be embraced rather than stigmatized in moving towards a more responsive set of government services. Login.gov is the future of government identity in the United States, but IAL2 is a higher bar than most government services need; waiting for IAL2 implementation is a tradeoff in favor of understandable-but-abstract risks against addressing a concrete harm that exists now. You have an opt-out (use the existing methods of filing, including mail), and you're not harmed or even treated less preferentially by the existence of the ID.me option.
    - thfuran 3y ago
      Because a US government service should not be outsourcing to a .me domain. I don't really care whether their internal service has IAL2, but it should be on .gov.
      - Atotalnoob 3y ago
        It’s just a domain name? It resolves to US based nameservers, the company is US based, with offices in the US, the founders are US citizens. Would idme.com make you happy? As much as I dislike Id.me, the domain name isn’t something to get upset at, it’s just branding…
        tomrod 3y ago
        I think parent comment assumes the DNS mapping is owned by the `.me` TLD owner, setting up an external contact that may or may not be hostile to owners of `.gov` TLD owner (the US), setting up a potential for nefarious activity. "just a domain name" but MITM DNS attacks exist.
    - lupire 3y ago
      The government is putting citizens at risk by allowing a bad solution (ID.me) and wasting time supporting it that could be spent working on login.gov.

by tomrod 3y ago

toomuchtodo 3y ago

Login.gov does not provide a sufficient level of identity assurance (IAL2 [1]) to serve as the IDP for this pilot and IRS functions in general (ID.me liveness check and facial recognition). IRS is working with Login.gov to upgrade Login.gov to deprecate ID.me for this purpose [2] [3]. Would it make sense to not proceed with this pilot until this was ready? Certainly not; Login.gov will catch up and meet IRS in the future as Direct File expands next filing season. Very similar to when Social Security Administration (ssa.gov) transitioned from ID.me and their internal IDP to Login.gov on September 18, 2021 [4]. (Login.gov partners with USPS to perform in person identity proofing for those who cannot perform remote proofing via a mobile device; a bar code is generated, which you print out or display on a mobile device for presentation to a USPS clerk with a government credential) [1] https://pages.nist.gov/800-63-3-Implementation-Resources/63A/ial2remote/ https://pages.nist.gov/800-63-3-Implementation-Resources/63A... [2] https://news.ycombinator.com/item?id=30430851 https://news.ycombinator.com/item?id=30430851 [3] https://fedscoop.com/irs-to-adopt-login-gov-as-user-authentication-tool/ https://fedscoop.com/irs-to-adopt-login-gov-as-user-authenti... [4] https://faq.ssa.gov/en-US/Topic/article/KA-03217 https://faq.ssa.gov/en-US/Topic/article/KA-03217

tomrod 3y ago
Thank you, thank you, thank you for the info update! My understanding was clearly incomplete.
thfuran 3y ago
>Would it make sense to not proceed with this pilot until this was ready? Certainly not Absolutely, yes.
- eropple 3y ago
  Why? Iteration is something to be embraced rather than stigmatized in moving towards a more responsive set of government services. Login.gov is the future of government identity in the United States, but IAL2 is a higher bar than most government services need; waiting for IAL2 implementation is a tradeoff in favor of understandable-but-abstract risks against addressing a concrete harm that exists now. You have an opt-out (use the existing methods of filing, including mail), and you're not harmed or even treated less preferentially by the existence of the ID.me option.
  - thfuran 3y ago
    Because a US government service should not be outsourcing to a .me domain. I don't really care whether their internal service has IAL2, but it should be on .gov.
    - Atotalnoob 3y ago
      It’s just a domain name? It resolves to US based nameservers, the company is US based, with offices in the US, the founders are US citizens. Would idme.com make you happy? As much as I dislike Id.me, the domain name isn’t something to get upset at, it’s just branding…
      - tomrod 3y ago
        I think parent comment assumes the DNS mapping is owned by the `.me` TLD owner, setting up an external contact that may or may not be hostile to owners of `.gov` TLD owner (the US), setting up a potential for nefarious activity. "just a domain name" but MITM DNS attacks exist.
  - lupire 3y ago
    The government is putting citizens at risk by allowing a bad solution (ID.me) and wasting time supporting it that could be spent working on login.gov.