7 ms·

You have to give up your privacy to even login to IRS.gov because to use ID.me one must: * Consent to the collection, use, and sharing of their personal inform

You have to give up your privacy to even login to IRS.gov because to use ID.me one must: * Consent to the collection, use, and sharing of their personal information to third parties (i.e. data brokers). * Agree to binding arbitration and a waiver of class action rights. * Agree to limits on liability for any indirect, punitive, special, exemplary, incidental, or consequential damages. * Consent to arbitrary termination of the account at any time for any reason. Login.gov (https://login.gov/ https://login.gov/) is the obvious choice for a login service. Enough excuses.

JumpCrisscross 3y ago
Reproducing toomuchtodo’s excellent rebuttal [0] in the sibling thread where you posted the same thing: Login.gov does not provide a sufficient level of identity assurance (IAL2 [1]) to serve as the IDP for this pilot and IRS functions in general (ID.me liveness check and facial recognition). IRS is working with Login.gov to upgrade Login.gov to deprecate ID.me for this purpose [2] [3]. Would it make sense to not proceed with this pilot until this was ready? Certainly not; Login.gov will catch up and meet IRS in the future as Direct File expands next filing season. Very similar to when Social Security Administration (ssa.gov) transitioned from ID.me and their internal IDP to Login.gov. (Login.gov partners with USPS to perform in person identity proofing for those who cannot perform remote proofing via a mobile device) [0] https://news.ycombinator.com/item?id=39691325 https://news.ycombinator.com/item?id=39691325 [1] https://pages.nist.gov/800-63-3-Implementation-Resources/63A/ial2remote/ https://pages.nist.gov/800-63-3-Implementation-Resources/63A... [2] https://news.ycombinator.com/item?id=30430851 https://news.ycombinator.com/item?id=30430851 [3] https://fedscoop.com/irs-to-adopt-login-gov-as-user-authentication-tool/ https://fedscoop.com/irs-to-adopt-login-gov-as-user-authenti...
- generalizations 3y ago
  Seems like what you said can be summed up as: - Yes, the privacy infractions listed by esbranson are accurate. - But we don't have an alternative right now. - But something better is coming! It's totally right around the corner!
  - toomuchtodo 3y ago
    Perfect is the enemy of good enough. The call to action is to ensure, through pressure, that the desired outcome is reached. Are we on track? It appears so.
    - generalizations 3y ago
      IDK. I've seen too much bureaucracy where a bad solution (with properties the bureaucrat likes) is implemented with promises to improve later (into something the petitioner wants). But after the initial solution is implemented, all they gotta do is procrastinate - and the whole time they procrastinate, they get what they want. Why change it? All the bureaucrat has gotta deal with is a bit of complaining.
      - sanderjd 3y ago
        The far more common problem with bureaucracy is that nothing ever gets done because every incremental step is met with "but this isn't perfect so you shouldn't do it!" from one faction or another, which ensures that no step is ever made, if given credence.
        generalizations 3y ago
        The other problem with bureaucracy: "We must do something! This is something. Let's do it." Just because it's important to get something done, doesn't mean we should be satisfied with something that messes other stuff up.
        sanderjd 3y ago
        Again, the far more common problem is the one I described. Lots of people say the problem you're describing is the bigger problem, but I've spent a lot of time in the adult world now, and I conclude that no, that is not the bigger problem, at least in the US. I'm very pleased to see dissatisfaction of the form "this isn't good enough; here are ideas for incremental improvements to it", but have totally lost my patience with the far more common "this isn't good enough; we should do nothing instead".
- xxpor 3y ago
  the IRS doesn't require IAL2 for other preparers, like TurboTax. Why would they impose it on themselves?
  - deleted 3y ago
    [deleted]
  - JumpCrisscross 3y ago
    > Why would they impose it on themselves? They’re a government agency. Especially for a voluntary pilot, it makes no sense to lower standards that way.
    - xxpor 3y ago
      Unless you're trying to sabotage your pilot, there's no reason to turn people away with a dumb login. Again, they already accept efile from providers that do not follow these standards. There's 0 benefit to upping the requirements here.
      - JumpCrisscross 3y ago
        > no reason to turn people away with a dumb login No evidence of this happening. If anything, the pilot is proving they made the right call. It’s doing well despite ID.me.
    - sanderjd 3y ago
      Did you write this exactly backwards? Especially for a voluntary pilot, it makes sense to not wait to launch it until it is better than every other option in every way. That's a pretty big part of the whole "pilot" idea... that something is launched smaller and faster and then incrementally improved and expanded. It's a very good idea to do things in this way!
  - PopAlongKid 3y ago
    TurboTax is not a "preparer", the preparer is the taxpayer themself. For paid, professional preparers (who don't use TurboTax, but rather commercially available software designed for practitioners who prepare dozens or hundreds of returns), the security requirements are higher, even if not quite IAL2. The IRS has worked for a number of years now on a "Security Summit" in concert with all the pro software vendors to tighten up their security, resulting in drastically less filing fraud than in previous years. By "filing fraud" I mean filing returns using a false identity, not simply reporting wrong income or deductions.
- dataflow 3y ago
  > Login.gov will catch up and meet IRS in the future Do you have any evidence they're even working on this right now? Last news I heard was 2 years ago when they promised ID.me was a temporary solution for that tax season, but it sure looks like that was to make the public happy, and ID.me is here to stay. Note: This isn't an argument against releasing the tax tool, I'm just commenting on the login.
- JohnFen 3y ago
  > Would it make sense to not proceed with this pilot until this was ready? Certainly not Maybe not, but it absolutely makes sense for me to ignore this pilot until/unless they stop using something like id.me.
  - sanderjd 3y ago
    That's your prerogative, but you're doing a disservice to anyone less technical to yourself who you advise to do the same. This pilot is, in its current form, better than what the vast majority of people use to file their taxes. If you're already super-privacy-sensitive in your choice of tax-filing software, then great, you do you, but I'd wager that upwards of 99% of taxpayers don't know or care about this and definitely aren't choosing their tax-filing solution based on it. Maybe some of those people are getting better privacy than this, incidentally, but if so, it's not because they are seeking that out.
    - JohnFen 3y ago
      I'm not advising anyone else about how they deal with their taxes, so I'm doing nobody a disservice. If not wanting to have my data exposed to yet another data broker makes me "super-privacy-sensitive", then so be it. As currently implemented, this program is simply a nonstarter for me because of the use of id.me. I am immensely disappointed because I really want to be able to file my taxes in the way this program is aimed. Well, what I actually want is for the IRS to compute my taxes for me and send me a bill, but this would be better than nothing.
      - sanderjd 3y ago
        It does indeed make you "super-privacy-sensitive". It's hard to see that from within our bubble here, but this is absolutely the case. I'm also "super-privacy-sensitive", though less than you and others here, merely by virtue of being aware of this kind of issue at all, and strongly agreeing with the general sense here that people should care about this. But people broadly just ... don't ... care about this, regardless of what we think. I'm also disappointed that I can't use this this year, because I'm not in one of the pilot states. But that's what makes it a pilot program! It's explicitly not intended to be used by everyone at this stage. If this were to become required for everyone, and still leaked tons of data to a third-party at that point, then I would be right there with all of you that it's unacceptable. But we're far from that point.
- liveoneggs 3y ago
  id.me, including it's horrible facial recognition, has to be one of the worst systems out on the internet
- jd3 3y ago
  I don't know why this was so hard to track down, but it's due to a lack of biometric verification atm; roadmap says they will be certified by 2024. > Login.gov’s identity verification process does not currently conform to the IAL2 specification because it does not include biometric verification. https://www.login.gov/partners/our-services/ https://www.login.gov/partners/our-services/ > Login.gov continues to work toward achieving certification of compliance with NIST’s IAL2 standard from a third-party assessment organization. https://www.login.gov/policy/how-does-it-work/ https://www.login.gov/policy/how-does-it-work/ https://developers.login.gov/overview/ https://developers.login.gov/overview/ https://developers.login.gov/attributes/ https://developers.login.gov/attributes/ > In FY 2024, Login.gov plans to offer a solution that complies with the IAL2 level of NIST 800-63 Digital Identity Guidelines. https://www.login.gov/docs/login-gov-roadmap-november-2023.pdf https://www.login.gov/docs/login-gov-roadmap-november-2023.p...
- jrochkind1 3y ago
  > Login.gov will catch up and meet IRS in the future as Direct File expands next filing season Are you confident login.gov will be caught up and avaialable by next filing season and if so based on what? Your cite at [3] above (thanks!), is dated Feb 2022, and doesn't have a timeline, but also sort of implies that login.gov should be ready by the "next" tax season (Feb 2023), when it says "While Login.gov is not expected to be ready in time for use by taxpayers during the current tax season…" So this is now the third tax season since then that login.gov is still not available. What leads you think it'll be available next filing season? (Note: I am not saying it may not make sense to move ahead with the pilot in parallel anyway, instead of blocking on waiting for auth solution work. Certainly in a normal industry software engineering scenario, parallel development is often better than blocking. I don't really have an opinion here. I do wonder what the budget allocation to login.gov looks like and if it's really being considered a necessary component of this product or not…). [3] https://fedscoop.com/irs-to-adopt-login-gov-as-user-authentication-tool/ https://fedscoop.com/irs-to-adopt-login-gov-as-user-authenti...
- dragonwriter 3y ago
  > Login.gov does not provide a sufficient level of identity assurance (IAL2 [1]) to serve as the IDP for this pilot and IRS functions in general (ID.me liveness check and facial recognition). IRS functions in general when conducted via paper or electronically via existing third parties also do not have to this level of identity assurance, so its kind of hard for me to believe that this is a hard minimum for the function. That justifies compromising privacy.
- deleted 3y ago
  [deleted]
- jononor 3y ago
  Of the 3 countries I have experience with, neither Norway, Sweden or Germany require a "liveness check" or facial recognition for delivering taxes online. And I think it was possible to do it without that in US too? I think it would have been better to work to remove those restrictions. Especially since there are a sizable portion of the population in the US who are very concerned about governmental control.
  - Ekaros 3y ago
    Add Finland to list. Did my taxes yesterday with essentially 2FA id provided by my bank. I could swear I had already filled all the info and they lost it, but mine are so simple not much time was lost.
tiffanyh 3y ago
> You have to give up your privacy to even login to IRS.gov I'm all for privacy, but isn't privacy the opposite of what is needed on IRS.gov If you're logged into the government website to file your taxes (or get a refund), there should be strong KYC controls in place asserting with extremely high levels of assurance - the individual logged in is who they claim to be. How can you do that, anonymously (in a private way)? -- EDIT: it seems like folks are saying this is primary due to using a 3rd party biometric service for login. The IRS announced over 2-years ago, they are transitioning away from that. https://www.irs.gov/newsroom/irs-announces-transition-away-from-use-of-third-party-verification-involving-facial-recognition https://www.irs.gov/newsroom/irs-announces-transition-away-f...
- taeric 3y ago
  I think the concerns are more on the third party there having this?
- kevincox 3y ago
  The problem isn't proving your identity to IRS.gov. The problem is allowing a third party to store and sell your personal information. If IRS.gov is going to use a third-party verification service their agreement should require that the collected information is used solely for providing the identification service and deleted after an appropriate timeframe.
- kevin_b_er 3y ago
  This is disingenuous take. We're not talking about the IRS, but the company they outsourced to that demands a lot from you. You lose the basic right to access courts of law, and ID.me gains nearly unlimited capacity to harm you without repercussions.
- Dudhbbh3343 3y ago
  Why is biometric verification required to file online with the IRS when I can mail in a paper return or use TurboTax without anything like that?
  - ufmace 3y ago
donmcronald 3y ago
Does the auth flow for id.me go through that domain on the ccTLD or do they use a different gTLD for the auth flow? If the auth flow for a government service goes through a foreign nation's ccTLD, that's a terrible, terrible precedent to set. Hopefully the US is on good terms with Montenegro, now and forever.
- esbranson 3y ago
  Montenegro and Domen D.O.O. Podgorica, the company that runs the .me domain, can redirect the domain as desired, without effective repercussion or recourse. Domen's and the Montenegro government's beneficial owners are not publicly known. One would hope that the security relationship between the IRS and ID.me would be effective enough to defeat such an attack, but we don't know who the beneficial owners of ID.me are either, or anything about its infrastructure and supplier security... But one expects they would happily sell that information anyways.

JumpCrisscross 3y ago

Reproducing toomuchtodo’s excellent rebuttal [0] in the sibling thread where you posted the same thing: Login.gov does not provide a sufficient level of identity assurance (IAL2 [1]) to serve as the IDP for this pilot and IRS functions in general (ID.me liveness check and facial recognition). IRS is working with Login.gov to upgrade Login.gov to deprecate ID.me for this purpose [2] [3]. Would it make sense to not proceed with this pilot until this was ready? Certainly not; Login.gov will catch up and meet IRS in the future as Direct File expands next filing season. Very similar to when Social Security Administration (ssa.gov) transitioned from ID.me and their internal IDP to Login.gov. (Login.gov partners with USPS to perform in person identity proofing for those who cannot perform remote proofing via a mobile device) [0] https://news.ycombinator.com/item?id=39691325 https://news.ycombinator.com/item?id=39691325 [1] https://pages.nist.gov/800-63-3-Implementation-Resources/63A/ial2remote/ https://pages.nist.gov/800-63-3-Implementation-Resources/63A... [2] https://news.ycombinator.com/item?id=30430851 https://news.ycombinator.com/item?id=30430851 [3] https://fedscoop.com/irs-to-adopt-login-gov-as-user-authentication-tool/ https://fedscoop.com/irs-to-adopt-login-gov-as-user-authenti...

generalizations 3y ago
Seems like what you said can be summed up as: - Yes, the privacy infractions listed by esbranson are accurate. - But we don't have an alternative right now. - But something better is coming! It's totally right around the corner!
- toomuchtodo 3y ago
  Perfect is the enemy of good enough. The call to action is to ensure, through pressure, that the desired outcome is reached. Are we on track? It appears so.
  - generalizations 3y ago
    IDK. I've seen too much bureaucracy where a bad solution (with properties the bureaucrat likes) is implemented with promises to improve later (into something the petitioner wants). But after the initial solution is implemented, all they gotta do is procrastinate - and the whole time they procrastinate, they get what they want. Why change it? All the bureaucrat has gotta deal with is a bit of complaining.
    - sanderjd 3y ago
      The far more common problem with bureaucracy is that nothing ever gets done because every incremental step is met with "but this isn't perfect so you shouldn't do it!" from one faction or another, which ensures that no step is ever made, if given credence.
      - generalizations 3y ago
        The other problem with bureaucracy: "We must do something! This is something. Let's do it." Just because it's important to get something done, doesn't mean we should be satisfied with something that messes other stuff up.
        sanderjd 3y ago
        Again, the far more common problem is the one I described. Lots of people say the problem you're describing is the bigger problem, but I've spent a lot of time in the adult world now, and I conclude that no, that is not the bigger problem, at least in the US. I'm very pleased to see dissatisfaction of the form "this isn't good enough; here are ideas for incremental improvements to it", but have totally lost my patience with the far more common "this isn't good enough; we should do nothing instead".
xxpor 3y ago
the IRS doesn't require IAL2 for other preparers, like TurboTax. Why would they impose it on themselves?
- deleted 3y ago
  [deleted]
- JumpCrisscross 3y ago
  > Why would they impose it on themselves? They’re a government agency. Especially for a voluntary pilot, it makes no sense to lower standards that way.
  - xxpor 3y ago
    Unless you're trying to sabotage your pilot, there's no reason to turn people away with a dumb login. Again, they already accept efile from providers that do not follow these standards. There's 0 benefit to upping the requirements here.
    - JumpCrisscross 3y ago
      > no reason to turn people away with a dumb login No evidence of this happening. If anything, the pilot is proving they made the right call. It’s doing well despite ID.me.
  - sanderjd 3y ago
    Did you write this exactly backwards? Especially for a voluntary pilot, it makes sense to not wait to launch it until it is better than every other option in every way. That's a pretty big part of the whole "pilot" idea... that something is launched smaller and faster and then incrementally improved and expanded. It's a very good idea to do things in this way!
- PopAlongKid 3y ago
  TurboTax is not a "preparer", the preparer is the taxpayer themself. For paid, professional preparers (who don't use TurboTax, but rather commercially available software designed for practitioners who prepare dozens or hundreds of returns), the security requirements are higher, even if not quite IAL2. The IRS has worked for a number of years now on a "Security Summit" in concert with all the pro software vendors to tighten up their security, resulting in drastically less filing fraud than in previous years. By "filing fraud" I mean filing returns using a false identity, not simply reporting wrong income or deductions.
dataflow 3y ago
> Login.gov will catch up and meet IRS in the future Do you have any evidence they're even working on this right now? Last news I heard was 2 years ago when they promised ID.me was a temporary solution for that tax season, but it sure looks like that was to make the public happy, and ID.me is here to stay. Note: This isn't an argument against releasing the tax tool, I'm just commenting on the login.
JohnFen 3y ago
> Would it make sense to not proceed with this pilot until this was ready? Certainly not Maybe not, but it absolutely makes sense for me to ignore this pilot until/unless they stop using something like id.me.
- sanderjd 3y ago
  That's your prerogative, but you're doing a disservice to anyone less technical to yourself who you advise to do the same. This pilot is, in its current form, better than what the vast majority of people use to file their taxes. If you're already super-privacy-sensitive in your choice of tax-filing software, then great, you do you, but I'd wager that upwards of 99% of taxpayers don't know or care about this and definitely aren't choosing their tax-filing solution based on it. Maybe some of those people are getting better privacy than this, incidentally, but if so, it's not because they are seeking that out.
  - JohnFen 3y ago
    I'm not advising anyone else about how they deal with their taxes, so I'm doing nobody a disservice. If not wanting to have my data exposed to yet another data broker makes me "super-privacy-sensitive", then so be it. As currently implemented, this program is simply a nonstarter for me because of the use of id.me. I am immensely disappointed because I really want to be able to file my taxes in the way this program is aimed. Well, what I actually want is for the IRS to compute my taxes for me and send me a bill, but this would be better than nothing.
    - sanderjd 3y ago
      It does indeed make you "super-privacy-sensitive". It's hard to see that from within our bubble here, but this is absolutely the case. I'm also "super-privacy-sensitive", though less than you and others here, merely by virtue of being aware of this kind of issue at all, and strongly agreeing with the general sense here that people should care about this. But people broadly just ... don't ... care about this, regardless of what we think. I'm also disappointed that I can't use this this year, because I'm not in one of the pilot states. But that's what makes it a pilot program! It's explicitly not intended to be used by everyone at this stage. If this were to become required for everyone, and still leaked tons of data to a third-party at that point, then I would be right there with all of you that it's unacceptable. But we're far from that point.
liveoneggs 3y ago
id.me, including it's horrible facial recognition, has to be one of the worst systems out on the internet
jd3 3y ago
I don't know why this was so hard to track down, but it's due to a lack of biometric verification atm; roadmap says they will be certified by 2024. > Login.gov’s identity verification process does not currently conform to the IAL2 specification because it does not include biometric verification. https://www.login.gov/partners/our-services/ https://www.login.gov/partners/our-services/ > Login.gov continues to work toward achieving certification of compliance with NIST’s IAL2 standard from a third-party assessment organization. https://www.login.gov/policy/how-does-it-work/ https://www.login.gov/policy/how-does-it-work/ https://developers.login.gov/overview/ https://developers.login.gov/overview/ https://developers.login.gov/attributes/ https://developers.login.gov/attributes/ > In FY 2024, Login.gov plans to offer a solution that complies with the IAL2 level of NIST 800-63 Digital Identity Guidelines. https://www.login.gov/docs/login-gov-roadmap-november-2023.pdf https://www.login.gov/docs/login-gov-roadmap-november-2023.p...
jrochkind1 3y ago
> Login.gov will catch up and meet IRS in the future as Direct File expands next filing season Are you confident login.gov will be caught up and avaialable by next filing season and if so based on what? Your cite at [3] above (thanks!), is dated Feb 2022, and doesn't have a timeline, but also sort of implies that login.gov should be ready by the "next" tax season (Feb 2023), when it says "While Login.gov is not expected to be ready in time for use by taxpayers during the current tax season…" So this is now the third tax season since then that login.gov is still not available. What leads you think it'll be available next filing season? (Note: I am not saying it may not make sense to move ahead with the pilot in parallel anyway, instead of blocking on waiting for auth solution work. Certainly in a normal industry software engineering scenario, parallel development is often better than blocking. I don't really have an opinion here. I do wonder what the budget allocation to login.gov looks like and if it's really being considered a necessary component of this product or not…). [3] https://fedscoop.com/irs-to-adopt-login-gov-as-user-authentication-tool/ https://fedscoop.com/irs-to-adopt-login-gov-as-user-authenti...
dragonwriter 3y ago
> Login.gov does not provide a sufficient level of identity assurance (IAL2 [1]) to serve as the IDP for this pilot and IRS functions in general (ID.me liveness check and facial recognition). IRS functions in general when conducted via paper or electronically via existing third parties also do not have to this level of identity assurance, so its kind of hard for me to believe that this is a hard minimum for the function. That justifies compromising privacy.
deleted 3y ago
[deleted]
jononor 3y ago
Of the 3 countries I have experience with, neither Norway, Sweden or Germany require a "liveness check" or facial recognition for delivering taxes online. And I think it was possible to do it without that in US too? I think it would have been better to work to remove those restrictions. Especially since there are a sizable portion of the population in the US who are very concerned about governmental control.
- Ekaros 3y ago
  Add Finland to list. Did my taxes yesterday with essentially 2FA id provided by my bank. I could swear I had already filled all the info and they lost it, but mine are so simple not much time was lost.

tiffanyh 3y ago

> You have to give up your privacy to even login to IRS.gov I'm all for privacy, but isn't privacy the opposite of what is needed on IRS.gov If you're logged into the government website to file your taxes (or get a refund), there should be strong KYC controls in place asserting with extremely high levels of assurance - the individual logged in is who they claim to be. How can you do that, anonymously (in a private way)? -- EDIT: it seems like folks are saying this is primary due to using a 3rd party biometric service for login. The IRS announced over 2-years ago, they are transitioning away from that. https://www.irs.gov/newsroom/irs-announces-transition-away-from-use-of-third-party-verification-involving-facial-recognition https://www.irs.gov/newsroom/irs-announces-transition-away-f...

taeric 3y ago
I think the concerns are more on the third party there having this?
kevincox 3y ago
The problem isn't proving your identity to IRS.gov. The problem is allowing a third party to store and sell your personal information. If IRS.gov is going to use a third-party verification service their agreement should require that the collected information is used solely for providing the identification service and deleted after an appropriate timeframe.
kevin_b_er 3y ago
This is disingenuous take. We're not talking about the IRS, but the company they outsourced to that demands a lot from you. You lose the basic right to access courts of law, and ID.me gains nearly unlimited capacity to harm you without repercussions.
Dudhbbh3343 3y ago
Why is biometric verification required to file online with the IRS when I can mail in a paper return or use TurboTax without anything like that?
- ufmace 3y ago

donmcronald 3y ago

Does the auth flow for id.me go through that domain on the ccTLD or do they use a different gTLD for the auth flow? If the auth flow for a government service goes through a foreign nation's ccTLD, that's a terrible, terrible precedent to set. Hopefully the US is on good terms with Montenegro, now and forever.

esbranson 3y ago
Montenegro and Domen D.O.O. Podgorica, the company that runs the .me domain, can redirect the domain as desired, without effective repercussion or recourse. Domen's and the Montenegro government's beneficial owners are not publicly known. One would hope that the security relationship between the IRS and ID.me would be effective enough to defeat such an attack, but we don't know who the beneficial owners of ID.me are either, or anything about its infrastructure and supplier security... But one expects they would happily sell that information anyways.