4 ms·

TreasuryDirect: Prepare for ID.me – Your New Way to Log In

63 points by Mindless2112 2mo ago

toomuchtodo 2mo ago
Unfortunate it’s not login.gov but definitely an improvement over their bespoke customer identity and access management solution.
- ghaff 2mo ago
  And 1990s era website design (maybe). I'll have to retrieve my credentials from somewhere I guess. Not sure why they're not unifying it with other government websites.
  - toomuchtodo 2mo ago
    The arc of progress is like the visibility curve over the horizon. We keep sailing.
- qgin 2mo ago
  Does anyone remember their crazy Ovaltine-decoder-ring two factor auth that they had for a while? They mailed you a physical card with custom grid of numbers and letters and the login challenge would be to submit the letters an numbers at various grid points.
  - zbentley 2mo ago
    That type of system is actually still in use in a lot of industries—either as a primary factor or a fallback for folks who might need to log in without a working device. Think healthcare workers who forgot their phone but need to order a surgery, or outdoor safety workers updating the toughbook after a day of work that might damage phones.
  - altairprime 2mo ago
    I still have mine! It was really excellent before camera phones.
  - fallinghawks 2mo ago
    Yes, I had one of those cards. It made you feel like you were accessing government secrets. In 2007.
  - britta 2mo ago
    I’ve compiled the entire sordid history of TreasuryDirect authentication in their Wikipedia article: https://en.wikipedia.org/wiki/TreasuryDirect https://en.wikipedia.org/wiki/TreasuryDirect
    - qgin 2mo ago
      This is amazing, thank you
  - SoftTalker 2mo ago
    So like a one-time-pad? Except not, since it sounds like they re-use it for each login. If they had sent you a pad of codes, with instructions to tear off the top page each time, that would be closer.
    - Gormo 2mo ago
      A one time pad would have a finite number of uses available, which could lead to logistical complexity if it was being used as a primary auth mechanism. The card actually makes sense, as it amounts to a physical artifact that implements a unique encryption key. If there's enough entropy in generating the card, and the process of using it encodes enough bits of data, it's probably a reasonable solution.
- dbalatero 2mo ago
  Yeah, there's no mandate for government agencies to use login.gov AFAIK, so they can either go with login.gov or buy the private id.me solution. In general it's not a slamdunk to get agencies to cooperate and use their services, it seems.
  - toomuchtodo 2mo ago
    Login.gov had/has some technical gaps for agency customer identity use cases, which is why you don’t see it used by some agencies yet (depending on their customer identity assurance requirements). The outstanding technical gaps will be closed eventually, at which point id.me can be phased out as a private for profit idp vendor. https://legis1.com/news/logingov-technical-issues-gsas-platform-lacks https://legis1.com/news/logingov-technical-issues-gsas-platf... > GSA has closed most of the gaps GAO identified in 2024 and 2025, but the remaining recommendation has a direct operational consequence. GSA has developed a public roadmap and created a Partner Advisory Group, but GAO says those steps do not demonstrate that the specific technical challenges agencies identified have been resolved or that mutually agreed-upon time frames have been established. > GAO will continue monitoring GSA's progress. Until those time frames are established, the federal government's government-wide identity verification service retains an unresolved implementation gap as fraud and identity-theft threats continue to evolve. https://www.gao.gov/products/gao-26-109261 https://www.gao.gov/products/gao-26-109261
- rcleveng 2mo ago
  I was happy when they got rid of the virtual keyboard you had to type your password onto, such a pain since you also couldn't paste into the password field to autocomplete from a password manager. Had to constantly popup Chrome DevTools and "fix" the dom element to let paste work.
  - pwg 2mo ago
    With Firefox you can set to false the about:config setting "dom.event.clipboardevents.enabled" and websites can no longer block paste.
  - dlcarrier 2mo ago
    If they let you paste your password, you might use a long, randomly generated password stored in a password manager, instead of choosing a short, easy-to-type password and using the same one everywhere.
- AnthonyMouse 2mo ago
  > definitely an improvement over their bespoke customer identity and access management solution Is it though? With a service-specific system, if the system gets compromised, you lose your data on that system. With a centralized system that still happens, but then on top of that, there is also a centralized service to get compromised where you also lose your data on that system and every other system using it. The centralized system also ossifies with whatever flaws were present in the naive early implementation like the ancient credit card networks have, because once untold agencies and private entities are using it, anyone who wants to change anything about it is inundated with objections from thousands of entities who don't want to have to redo their integrations. Meanwhile your activity is then correlated between different accounts. You have retailers using id.me to "verify military, student, teacher, nurse, or first responder status" for discounts. Not only do they get your name via computer instead of a physical document you would object if they tried to copy, you're now using the same system you use for taxes and healthcare. Is ICE going to use this against people? Are foreign intelligence agencies going to silently compromise it and use it against the domestic population? That's inevitable once you allow a centralized system like that to exist. If you want to do this properly then you publish a reference implementation for an authentication system and let every organization run their own independent instance of it. That way a) none of the accounts are tied together and b) you can improve the system whenever you want and people can adopt the new version independently instead of needing to coordinate the entire world before you can change a single API parameter.
bramhaag 2mo ago
Why did the US gov decide to rely on a TLD controlled by Montenegro for this seemingly important and sensitive service?
- isiahl 2mo ago
  It’s not even a government service. It’s a private business they have entrusted with authentication for the government.
  - varispeed 2mo ago
    textbook fascism (marriage of corporations and government).
    - rho138 2mo ago
      [flagged]
      - gjsman-1000 2mo ago
        No system has ever provably worked; otherwise we wouldn’t have had revolutions.
        DANmode 2mo ago
        and?
        forestrywat 2mo ago
        That's a different bar. Probably doesn't work is much easier to meet, and narrower. The person didn't ask for provably works. They are probably comfortable with "might work might not, but at least it's not provably wrong".
      - brookst 2mo ago
        Nah, I’m downvoting for the ludicrous claim that government paying a private company to provide a service is necessarily fascism.
waldrews 2mo ago
TreasuryDirect's login and account recovery experience has been notorious for years, both for user experience and for people easily getting locked out for weeks. It's good they're being careful with this rollout, as it serves both individual and institutional accounts where dollar amounts involved are epic even by bank standards, and rarely checked by hand, so even single account breaches are serious.
shevy-java 2mo ago
> To set up a new ID.me account, you’ll need two government-issued forms of identity ready. That will be rolled out before anyone can access the world wide web. And they will continue to claim it is for the protection of kids ...
Animats 2mo ago
The IRS backed off from using "ID.me" back in 2022.[1] But apparently it is back. Is Treasury requiring face recognition, like last time? And of course this will be used to track down illegal aliens. [1] https://www.biometricupdate.com/202202/downwind-of-irs-decision-to-back-off-biometric-authentication-more-change https://www.biometricupdate.com/202202/downwind-of-irs-decis...
chenxiaolong 2mo ago
In case anyone is interested in using TOTP two-factor authentication with their ID.md account, I made a script for setting that up: https://github.com/chenxiaolong/id-me-otpauth https://github.com/chenxiaolong/id-me-otpauth They used to support TOTP directly, but removed it in favor of their proprietary mobile apps. It's still TOTP under the hood though, just requires a couple API calls to "activate" it.
- ButlerianJihad 2mo ago
  Though they recommend their own app, id.me directly supports any standard compatible authenticator app. I use it with Google Authenticator TOTP. It's also SOTA for creating and accepting passkeys on ChromeOS as well as Android. Probably Apple, too! Other built-in available MFA methods include: security key; NFC mobile security key; Push Notifications (id.me app); text message or phone call; and passkeys.
  - chenxiaolong 2mo ago
    I don't know if it's an A/B test, but they no longer allow adding new TOTP authenticators for my family member's account. Existing setups continue to work fine. That's why I had to do the hackery of having the script pretend to be the mobile app to set that up.
cebert 2mo ago
This makes me so angry.
Dusseldorf 2mo ago
Does anyone know if there are any reasonable alternatives here if I don't want to create an ID.me account and hand my PII over to them? Do I just need to liquidate my positions and close my account out, or can I manage it offline via correspondence somehow? Seems absurd to have so quick a turnaround on this with no alternative options.
- sillystuff 2mo ago
  Even if you liquidate your account, without an id.me account, you will not be able to access your 1099.
  - ButlerianJihad 2mo ago
    That is a lie. The IRS provides offline/paper-based methods for requesting transcripts and information. There is a very obvious link, right next to the ID.me link, that offers you alternatives if you don't want to deal with them online. Here it is. https://www.irs.gov/payments/online-account-for-individuals#alternatives https://www.irs.gov/payments/online-account-for-individuals#...
    - sillystuff 2mo ago
      Are you suggesting that a person can request a copy of a 1099, for the current tax year, via the IRS? I don't know if this is possible. It is an interesting suggestion, if that is what you had in mind. This interpretation required steel-manning as your actual comment suggests that you may not realize that Treasury Direct and the IRS are two different things. I contacted Treasury Direct, after receiving the email notification about their plans to migrate to id.me, asking how to get a 1099 without an id.me account. But, I haven't received any response from Treasury Direct yet. Please tone down your aggression if you reply to this, "This is a lie." is both incorrect and highly aggressive. If, ultimately, a way is demonstrated to get access to a 1099, for a Treasury Direct account, without having to create an id.me account, that will be a good thing.
      - 1mo ago
dlcarrier 2mo ago
Last time I filed state taxes, I didn't qualify to use free electronic filing, because I was too poor, so I mailed in my taxes. I was a little concerned that postal employees present a security risk, but I'm not convinced it's more than the increased attack surface from whatever third parties handle electronic submission. The more third parties they throw into the mix, especially when it's just to increase security theater, the more convinced I am that I should be mailing in any financial government paperwork, even if I am eligible to do so electronically.
rgovostes 2mo ago
A young relative of mine is having a miserable time cashing Treasury bonds that were gifted to her through TreasuryDirect for her tuition. Treasury is requiring she get a medallion signature guarantee from a bank to access her funds but, like 40%+ of her generation, she uses online banking with no accessible branch. Treasury insists she can get this from any bank, but as the guarantor is liable for a loss, there's no way they will provide this to a non-client. They generally won't even make their ordinary notary public available. So she is now switching financial institutions simply to access a modest amount in her TreasuryDirect account. If you are thinking about gifting saving bonds to someone: do them a favor and don't.
- greyface- 2mo ago
  Brick-and-mortar banks often don't want to provide these to existing clients, either. I got the runaround from mine when I tried to open a TreasuryDirect account.
- ghaff 2mo ago
  I had a real PITA with medallion signature a while back. The local branch couldn't do it and, in spite of providing all my documents, the central location also couldn't do it for some reason. Ended up having to drive 45 minutes to my brokerage and they handled in about 5 minutes (was a stock transfer) but it was a real nuisance. It seemed like a bunch of things were suddenly much easier during COVID but they seem to have mostly reverted. I got some I bonds from Treasury Direct when interest rates were going crazy. It's not a lot in the scheme of things. I should clear them out and consolidate as I've done with other investments.
greenchair 2mo ago
good grief. Guess I'll redeem my i series now. btw AI says print the redemption confirmation details while logged in prior to the cutover because you'll need them for taxes in 2027.
foresto 2mo ago
https://www.id.me/biometric https://www.id.me/biometric
hkchad 2mo ago
Why on earth are they not using login.gov
- jambalaya8 2mo ago
  Many gov sites allow one or the other. Really neither is a good solution. Is it "safe" to have everyone in the country, citizen or not, in possession of a login on a .gov site?

63 points by Mindless2112 2mo ago

Unfortunate it’s not login.gov but definitely an improvement over their bespoke customer identity and access management solution.

ghaff 2mo ago
And 1990s era website design (maybe). I'll have to retrieve my credentials from somewhere I guess. Not sure why they're not unifying it with other government websites.
- toomuchtodo 2mo ago
  The arc of progress is like the visibility curve over the horizon. We keep sailing.
qgin 2mo ago
Does anyone remember their crazy Ovaltine-decoder-ring two factor auth that they had for a while? They mailed you a physical card with custom grid of numbers and letters and the login challenge would be to submit the letters an numbers at various grid points.
- zbentley 2mo ago
  That type of system is actually still in use in a lot of industries—either as a primary factor or a fallback for folks who might need to log in without a working device. Think healthcare workers who forgot their phone but need to order a surgery, or outdoor safety workers updating the toughbook after a day of work that might damage phones.
- altairprime 2mo ago
  I still have mine! It was really excellent before camera phones.
- fallinghawks 2mo ago
  Yes, I had one of those cards. It made you feel like you were accessing government secrets. In 2007.
- britta 2mo ago
  I’ve compiled the entire sordid history of TreasuryDirect authentication in their Wikipedia article: https://en.wikipedia.org/wiki/TreasuryDirect https://en.wikipedia.org/wiki/TreasuryDirect
  - qgin 2mo ago
    This is amazing, thank you
- SoftTalker 2mo ago
  So like a one-time-pad? Except not, since it sounds like they re-use it for each login. If they had sent you a pad of codes, with instructions to tear off the top page each time, that would be closer.
  - Gormo 2mo ago
    A one time pad would have a finite number of uses available, which could lead to logistical complexity if it was being used as a primary auth mechanism. The card actually makes sense, as it amounts to a physical artifact that implements a unique encryption key. If there's enough entropy in generating the card, and the process of using it encodes enough bits of data, it's probably a reasonable solution.
dbalatero 2mo ago
Yeah, there's no mandate for government agencies to use login.gov AFAIK, so they can either go with login.gov or buy the private id.me solution. In general it's not a slamdunk to get agencies to cooperate and use their services, it seems.
- toomuchtodo 2mo ago
  Login.gov had/has some technical gaps for agency customer identity use cases, which is why you don’t see it used by some agencies yet (depending on their customer identity assurance requirements). The outstanding technical gaps will be closed eventually, at which point id.me can be phased out as a private for profit idp vendor. https://legis1.com/news/logingov-technical-issues-gsas-platform-lacks https://legis1.com/news/logingov-technical-issues-gsas-platf... > GSA has closed most of the gaps GAO identified in 2024 and 2025, but the remaining recommendation has a direct operational consequence. GSA has developed a public roadmap and created a Partner Advisory Group, but GAO says those steps do not demonstrate that the specific technical challenges agencies identified have been resolved or that mutually agreed-upon time frames have been established. > GAO will continue monitoring GSA's progress. Until those time frames are established, the federal government's government-wide identity verification service retains an unresolved implementation gap as fraud and identity-theft threats continue to evolve. https://www.gao.gov/products/gao-26-109261 https://www.gao.gov/products/gao-26-109261
rcleveng 2mo ago
I was happy when they got rid of the virtual keyboard you had to type your password onto, such a pain since you also couldn't paste into the password field to autocomplete from a password manager. Had to constantly popup Chrome DevTools and "fix" the dom element to let paste work.
- pwg 2mo ago
  With Firefox you can set to false the about:config setting "dom.event.clipboardevents.enabled" and websites can no longer block paste.
- dlcarrier 2mo ago
  If they let you paste your password, you might use a long, randomly generated password stored in a password manager, instead of choosing a short, easy-to-type password and using the same one everywhere.
AnthonyMouse 2mo ago
> definitely an improvement over their bespoke customer identity and access management solution Is it though? With a service-specific system, if the system gets compromised, you lose your data on that system. With a centralized system that still happens, but then on top of that, there is also a centralized service to get compromised where you also lose your data on that system and every other system using it. The centralized system also ossifies with whatever flaws were present in the naive early implementation like the ancient credit card networks have, because once untold agencies and private entities are using it, anyone who wants to change anything about it is inundated with objections from thousands of entities who don't want to have to redo their integrations. Meanwhile your activity is then correlated between different accounts. You have retailers using id.me to "verify military, student, teacher, nurse, or first responder status" for discounts. Not only do they get your name via computer instead of a physical document you would object if they tried to copy, you're now using the same system you use for taxes and healthcare. Is ICE going to use this against people? Are foreign intelligence agencies going to silently compromise it and use it against the domestic population? That's inevitable once you allow a centralized system like that to exist. If you want to do this properly then you publish a reference implementation for an authentication system and let every organization run their own independent instance of it. That way a) none of the accounts are tied together and b) you can improve the system whenever you want and people can adopt the new version independently instead of needing to coordinate the entire world before you can change a single API parameter.

bramhaag 2mo ago

Why did the US gov decide to rely on a TLD controlled by Montenegro for this seemingly important and sensitive service?

isiahl 2mo ago
It’s not even a government service. It’s a private business they have entrusted with authentication for the government.
- varispeed 2mo ago
  textbook fascism (marriage of corporations and government).
  - rho138 2mo ago
    [flagged]
    - gjsman-1000 2mo ago
      No system has ever provably worked; otherwise we wouldn’t have had revolutions.
      - DANmode 2mo ago
        and?
      - forestrywat 2mo ago
        That's a different bar. Probably doesn't work is much easier to meet, and narrower. The person didn't ask for provably works. They are probably comfortable with "might work might not, but at least it's not provably wrong".
    - brookst 2mo ago
      Nah, I’m downvoting for the ludicrous claim that government paying a private company to provide a service is necessarily fascism.

waldrews 2mo ago

TreasuryDirect's login and account recovery experience has been notorious for years, both for user experience and for people easily getting locked out for weeks. It's good they're being careful with this rollout, as it serves both individual and institutional accounts where dollar amounts involved are epic even by bank standards, and rarely checked by hand, so even single account breaches are serious.

shevy-java 2mo ago

> To set up a new ID.me account, you’ll need two government-issued forms of identity ready. That will be rolled out before anyone can access the world wide web. And they will continue to claim it is for the protection of kids ...

Animats 2mo ago

The IRS backed off from using "ID.me" back in 2022.[1] But apparently it is back. Is Treasury requiring face recognition, like last time? And of course this will be used to track down illegal aliens. [1] https://www.biometricupdate.com/202202/downwind-of-irs-decision-to-back-off-biometric-authentication-more-change https://www.biometricupdate.com/202202/downwind-of-irs-decis...

chenxiaolong 2mo ago

In case anyone is interested in using TOTP two-factor authentication with their ID.md account, I made a script for setting that up: https://github.com/chenxiaolong/id-me-otpauth https://github.com/chenxiaolong/id-me-otpauth They used to support TOTP directly, but removed it in favor of their proprietary mobile apps. It's still TOTP under the hood though, just requires a couple API calls to "activate" it.

ButlerianJihad 2mo ago
Though they recommend their own app, id.me directly supports any standard compatible authenticator app. I use it with Google Authenticator TOTP. It's also SOTA for creating and accepting passkeys on ChromeOS as well as Android. Probably Apple, too! Other built-in available MFA methods include: security key; NFC mobile security key; Push Notifications (id.me app); text message or phone call; and passkeys.
- chenxiaolong 2mo ago
  I don't know if it's an A/B test, but they no longer allow adding new TOTP authenticators for my family member's account. Existing setups continue to work fine. That's why I had to do the hackery of having the script pretend to be the mobile app to set that up.

cebert 2mo ago

This makes me so angry.

Dusseldorf 2mo ago

Does anyone know if there are any reasonable alternatives here if I don't want to create an ID.me account and hand my PII over to them? Do I just need to liquidate my positions and close my account out, or can I manage it offline via correspondence somehow? Seems absurd to have so quick a turnaround on this with no alternative options.

sillystuff 2mo ago
Even if you liquidate your account, without an id.me account, you will not be able to access your 1099.
- ButlerianJihad 2mo ago
  That is a lie. The IRS provides offline/paper-based methods for requesting transcripts and information. There is a very obvious link, right next to the ID.me link, that offers you alternatives if you don't want to deal with them online. Here it is. https://www.irs.gov/payments/online-account-for-individuals#alternatives https://www.irs.gov/payments/online-account-for-individuals#...
  - sillystuff 2mo ago
    Are you suggesting that a person can request a copy of a 1099, for the current tax year, via the IRS? I don't know if this is possible. It is an interesting suggestion, if that is what you had in mind. This interpretation required steel-manning as your actual comment suggests that you may not realize that Treasury Direct and the IRS are two different things. I contacted Treasury Direct, after receiving the email notification about their plans to migrate to id.me, asking how to get a 1099 without an id.me account. But, I haven't received any response from Treasury Direct yet. Please tone down your aggression if you reply to this, "This is a lie." is both incorrect and highly aggressive. If, ultimately, a way is demonstrated to get access to a 1099, for a Treasury Direct account, without having to create an id.me account, that will be a good thing.
    - 1mo ago

dlcarrier 2mo ago

Last time I filed state taxes, I didn't qualify to use free electronic filing, because I was too poor, so I mailed in my taxes. I was a little concerned that postal employees present a security risk, but I'm not convinced it's more than the increased attack surface from whatever third parties handle electronic submission. The more third parties they throw into the mix, especially when it's just to increase security theater, the more convinced I am that I should be mailing in any financial government paperwork, even if I am eligible to do so electronically.

rgovostes 2mo ago

A young relative of mine is having a miserable time cashing Treasury bonds that were gifted to her through TreasuryDirect for her tuition. Treasury is requiring she get a medallion signature guarantee from a bank to access her funds but, like 40%+ of her generation, she uses online banking with no accessible branch. Treasury insists she can get this from any bank, but as the guarantor is liable for a loss, there's no way they will provide this to a non-client. They generally won't even make their ordinary notary public available. So she is now switching financial institutions simply to access a modest amount in her TreasuryDirect account. If you are thinking about gifting saving bonds to someone: do them a favor and don't.

greyface- 2mo ago
Brick-and-mortar banks often don't want to provide these to existing clients, either. I got the runaround from mine when I tried to open a TreasuryDirect account.
ghaff 2mo ago
I had a real PITA with medallion signature a while back. The local branch couldn't do it and, in spite of providing all my documents, the central location also couldn't do it for some reason. Ended up having to drive 45 minutes to my brokerage and they handled in about 5 minutes (was a stock transfer) but it was a real nuisance. It seemed like a bunch of things were suddenly much easier during COVID but they seem to have mostly reverted. I got some I bonds from Treasury Direct when interest rates were going crazy. It's not a lot in the scheme of things. I should clear them out and consolidate as I've done with other investments.

greenchair 2mo ago

good grief. Guess I'll redeem my i series now. btw AI says print the redemption confirmation details while logged in prior to the cutover because you'll need them for taxes in 2027.

foresto 2mo ago

https://www.id.me/biometric https://www.id.me/biometric

hkchad 2mo ago

Why on earth are they not using login.gov

jambalaya8 2mo ago
Many gov sites allow one or the other. Really neither is a good solution. Is it "safe" to have everyone in the country, citizen or not, in possession of a login on a .gov site?