2 ms·

The government is putting citizens at risk by allowing a bad solution (ID.me) and wasting time supporting it that could be spent working on login.gov.

by lupire 3y ago

toomuchtodo 3y ago
ID.me is already plugged in to IRS' platform, and is used today for all IRS account services to prevent fraud (return fraud being previously very prevalent [1], but there are other threat actor concerns with regards to IRS and identity). Throwing more people at Login.gov will not cause a solution to be arrived at tomorrow [2] [3]. It's suboptimal, but the world runs on duct tape, and a fix is underway. There is always risk, it is about managing that risk effectively. Personally, I believe saving tens of billions of dollars in potential fraud costs every tax filing season buys a lot of tolerance to people complaining about the interim solution. The complaints are valid, but so are the attempts at fraud. And so, we balance the risk of the implementation. [1] https://www.justice.gov/tax/stolen-identity-refund-fraud https://www.justice.gov/tax/stolen-identity-refund-fraud ("The IRS estimated that during the 2013 filing season alone, over 5 million tax returns were filed using stolen identities, claiming approximately $30 billion in refunds. The IRS was able to stop or recover over $24 billion of that total, or approximately 81% of the fraudulent claims.") [2] https://en.wikipedia.org/wiki/The_Mythical_Man-Month https://en.wikipedia.org/wiki/The_Mythical_Man-Month [3] https://en.wikipedia.org/wiki/Brooks%27s_law https://en.wikipedia.org/wiki/Brooks%27s_law (interviewed with a team that worked on fraud prevention at IRS as part of a US Digital Service interview)
- creer 3y ago
  Are they though (that much plugged in)? I have done quite a few iterations of IRS contacts, checking on returns, paying fees online, paying taxes online, etc over the past few years. Without yet having to deal with ID.me. Enough that at this point I would definitely do some work before giving in. So are they that prevalent really? Certainly NOT used for all account services.
  - toomuchtodo 3y ago
    ID.me is currently the only login/identity mechanism that can be used for handling business with the IRS online, although it is possible to file a return without an ID.me account. Paper filings, of course, require no online account. https://cyberscoop.com/irs-facial-recognition-identity-privacy/ https://cyberscoop.com/irs-facial-recognition-identity-priva... https://www.cbsnews.com/news/irs-id-me-tax-file-2022/ https://www.cbsnews.com/news/irs-id-me-tax-file-2022/ https://www.irs.gov/newsroom/new-identity-verification-process-to-access-certain-irs-online-tools-and-services https://www.irs.gov/newsroom/new-identity-verification-proce...
    - creer 3y ago
      Oh I had heard of it, of course. And heard that it was being replaced / phased out - quite a while back. For a few years now. And still haven't had to deal with it once (for contacts, for filings other than tax returns, for fee and tax payments.) So I was only questioning "that much plugged in".
eropple 3y ago
Federal workers are not project-fungible in such a way as to make what you suggest possible. And it's not just the federal government, either; ask any large corporation. There is no path to "well the IRS's developers should just go make Login.gov happen faster", even if you get a hall pass from the mythical man-month. So, now that we've acknowledged reality--what now? Do nothing, while the active harm continues, because of fear of a hypothetical future (but with a limited time horizon) one?

The government is putting citizens at risk by allowing a bad solution (ID.me) and wasting time supporting it that could be spent working on login.gov.

by lupire 3y ago

The government is putting citizens at risk by allowing a bad solution (ID.me) and wasting time supporting it that could be spent working on login.gov.

toomuchtodo 3y ago

ID.me is already plugged in to IRS' platform, and is used today for all IRS account services to prevent fraud (return fraud being previously very prevalent [1], but there are other threat actor concerns with regards to IRS and identity). Throwing more people at Login.gov will not cause a solution to be arrived at tomorrow [2] [3]. It's suboptimal, but the world runs on duct tape, and a fix is underway. There is always risk, it is about managing that risk effectively. Personally, I believe saving tens of billions of dollars in potential fraud costs every tax filing season buys a lot of tolerance to people complaining about the interim solution. The complaints are valid, but so are the attempts at fraud. And so, we balance the risk of the implementation. [1] https://www.justice.gov/tax/stolen-identity-refund-fraud https://www.justice.gov/tax/stolen-identity-refund-fraud ("The IRS estimated that during the 2013 filing season alone, over 5 million tax returns were filed using stolen identities, claiming approximately $30 billion in refunds. The IRS was able to stop or recover over $24 billion of that total, or approximately 81% of the fraudulent claims.") [2] https://en.wikipedia.org/wiki/The_Mythical_Man-Month https://en.wikipedia.org/wiki/The_Mythical_Man-Month [3] https://en.wikipedia.org/wiki/Brooks%27s_law https://en.wikipedia.org/wiki/Brooks%27s_law (interviewed with a team that worked on fraud prevention at IRS as part of a US Digital Service interview)

creer 3y ago
Are they though (that much plugged in)? I have done quite a few iterations of IRS contacts, checking on returns, paying fees online, paying taxes online, etc over the past few years. Without yet having to deal with ID.me. Enough that at this point I would definitely do some work before giving in. So are they that prevalent really? Certainly NOT used for all account services.
- toomuchtodo 3y ago
  ID.me is currently the only login/identity mechanism that can be used for handling business with the IRS online, although it is possible to file a return without an ID.me account. Paper filings, of course, require no online account. https://cyberscoop.com/irs-facial-recognition-identity-privacy/ https://cyberscoop.com/irs-facial-recognition-identity-priva... https://www.cbsnews.com/news/irs-id-me-tax-file-2022/ https://www.cbsnews.com/news/irs-id-me-tax-file-2022/ https://www.irs.gov/newsroom/new-identity-verification-process-to-access-certain-irs-online-tools-and-services https://www.irs.gov/newsroom/new-identity-verification-proce...
  - creer 3y ago
    Oh I had heard of it, of course. And heard that it was being replaced / phased out - quite a while back. For a few years now. And still haven't had to deal with it once (for contacts, for filings other than tax returns, for fee and tax payments.) So I was only questioning "that much plugged in".

eropple 3y ago

Federal workers are not project-fungible in such a way as to make what you suggest possible. And it's not just the federal government, either; ask any large corporation. There is no path to "well the IRS's developers should just go make Login.gov happen faster", even if you get a hall pass from the mythical man-month. So, now that we've acknowledged reality--what now? Do nothing, while the active harm continues, because of fear of a hypothetical future (but with a limited time horizon) one?