4 ms·

Unfortunate it’s not login.gov but definitely an improvement over their bespoke customer identity and access management solution.

ghaff 3mo ago
And 1990s era website design (maybe). I'll have to retrieve my credentials from somewhere I guess. Not sure why they're not unifying it with other government websites.
- toomuchtodo 3mo ago
  The arc of progress is like the visibility curve over the horizon. We keep sailing.
qgin 3mo ago
Does anyone remember their crazy Ovaltine-decoder-ring two factor auth that they had for a while? They mailed you a physical card with custom grid of numbers and letters and the login challenge would be to submit the letters an numbers at various grid points.
- zbentley 3mo ago
  That type of system is actually still in use in a lot of industries—either as a primary factor or a fallback for folks who might need to log in without a working device. Think healthcare workers who forgot their phone but need to order a surgery, or outdoor safety workers updating the toughbook after a day of work that might damage phones.
- altairprime 3mo ago
  I still have mine! It was really excellent before camera phones.
- fallinghawks 3mo ago
  Yes, I had one of those cards. It made you feel like you were accessing government secrets. In 2007.
- britta 3mo ago
  I’ve compiled the entire sordid history of TreasuryDirect authentication in their Wikipedia article: https://en.wikipedia.org/wiki/TreasuryDirect https://en.wikipedia.org/wiki/TreasuryDirect
  - qgin 3mo ago
    This is amazing, thank you
- SoftTalker 3mo ago
  So like a one-time-pad? Except not, since it sounds like they re-use it for each login. If they had sent you a pad of codes, with instructions to tear off the top page each time, that would be closer.
  - Gormo 2mo ago
    A one time pad would have a finite number of uses available, which could lead to logistical complexity if it was being used as a primary auth mechanism. The card actually makes sense, as it amounts to a physical artifact that implements a unique encryption key. If there's enough entropy in generating the card, and the process of using it encodes enough bits of data, it's probably a reasonable solution.
dbalatero 3mo ago
Yeah, there's no mandate for government agencies to use login.gov AFAIK, so they can either go with login.gov or buy the private id.me solution. In general it's not a slamdunk to get agencies to cooperate and use their services, it seems.
- toomuchtodo 3mo ago
  Login.gov had/has some technical gaps for agency customer identity use cases, which is why you don’t see it used by some agencies yet (depending on their customer identity assurance requirements). The outstanding technical gaps will be closed eventually, at which point id.me can be phased out as a private for profit idp vendor. https://legis1.com/news/logingov-technical-issues-gsas-platform-lacks https://legis1.com/news/logingov-technical-issues-gsas-platf... > GSA has closed most of the gaps GAO identified in 2024 and 2025, but the remaining recommendation has a direct operational consequence. GSA has developed a public roadmap and created a Partner Advisory Group, but GAO says those steps do not demonstrate that the specific technical challenges agencies identified have been resolved or that mutually agreed-upon time frames have been established. > GAO will continue monitoring GSA's progress. Until those time frames are established, the federal government's government-wide identity verification service retains an unresolved implementation gap as fraud and identity-theft threats continue to evolve. https://www.gao.gov/products/gao-26-109261 https://www.gao.gov/products/gao-26-109261
rcleveng 3mo ago
I was happy when they got rid of the virtual keyboard you had to type your password onto, such a pain since you also couldn't paste into the password field to autocomplete from a password manager. Had to constantly popup Chrome DevTools and "fix" the dom element to let paste work.
- pwg 3mo ago
  With Firefox you can set to false the about:config setting "dom.event.clipboardevents.enabled" and websites can no longer block paste.
- dlcarrier 3mo ago
  If they let you paste your password, you might use a long, randomly generated password stored in a password manager, instead of choosing a short, easy-to-type password and using the same one everywhere.
AnthonyMouse 3mo ago
> definitely an improvement over their bespoke customer identity and access management solution Is it though? With a service-specific system, if the system gets compromised, you lose your data on that system. With a centralized system that still happens, but then on top of that, there is also a centralized service to get compromised where you also lose your data on that system and every other system using it. The centralized system also ossifies with whatever flaws were present in the naive early implementation like the ancient credit card networks have, because once untold agencies and private entities are using it, anyone who wants to change anything about it is inundated with objections from thousands of entities who don't want to have to redo their integrations. Meanwhile your activity is then correlated between different accounts. You have retailers using id.me to "verify military, student, teacher, nurse, or first responder status" for discounts. Not only do they get your name via computer instead of a physical document you would object if they tried to copy, you're now using the same system you use for taxes and healthcare. Is ICE going to use this against people? Are foreign intelligence agencies going to silently compromise it and use it against the domestic population? That's inevitable once you allow a centralized system like that to exist. If you want to do this properly then you publish a reference implementation for an authentication system and let every organization run their own independent instance of it. That way a) none of the accounts are tied together and b) you can improve the system whenever you want and people can adopt the new version independently instead of needing to coordinate the entire world before you can change a single API parameter.

ghaff 3mo ago

And 1990s era website design (maybe). I'll have to retrieve my credentials from somewhere I guess. Not sure why they're not unifying it with other government websites.

toomuchtodo 3mo ago
The arc of progress is like the visibility curve over the horizon. We keep sailing.

qgin 3mo ago

Does anyone remember their crazy Ovaltine-decoder-ring two factor auth that they had for a while? They mailed you a physical card with custom grid of numbers and letters and the login challenge would be to submit the letters an numbers at various grid points.

zbentley 3mo ago
That type of system is actually still in use in a lot of industries—either as a primary factor or a fallback for folks who might need to log in without a working device. Think healthcare workers who forgot their phone but need to order a surgery, or outdoor safety workers updating the toughbook after a day of work that might damage phones.
altairprime 3mo ago
I still have mine! It was really excellent before camera phones.
fallinghawks 3mo ago
Yes, I had one of those cards. It made you feel like you were accessing government secrets. In 2007.
britta 3mo ago
I’ve compiled the entire sordid history of TreasuryDirect authentication in their Wikipedia article: https://en.wikipedia.org/wiki/TreasuryDirect https://en.wikipedia.org/wiki/TreasuryDirect
- qgin 3mo ago
  This is amazing, thank you
SoftTalker 3mo ago
So like a one-time-pad? Except not, since it sounds like they re-use it for each login. If they had sent you a pad of codes, with instructions to tear off the top page each time, that would be closer.
- Gormo 2mo ago
  A one time pad would have a finite number of uses available, which could lead to logistical complexity if it was being used as a primary auth mechanism. The card actually makes sense, as it amounts to a physical artifact that implements a unique encryption key. If there's enough entropy in generating the card, and the process of using it encodes enough bits of data, it's probably a reasonable solution.

dbalatero 3mo ago

Yeah, there's no mandate for government agencies to use login.gov AFAIK, so they can either go with login.gov or buy the private id.me solution. In general it's not a slamdunk to get agencies to cooperate and use their services, it seems.

toomuchtodo 3mo ago
Login.gov had/has some technical gaps for agency customer identity use cases, which is why you don’t see it used by some agencies yet (depending on their customer identity assurance requirements). The outstanding technical gaps will be closed eventually, at which point id.me can be phased out as a private for profit idp vendor. https://legis1.com/news/logingov-technical-issues-gsas-platform-lacks https://legis1.com/news/logingov-technical-issues-gsas-platf... > GSA has closed most of the gaps GAO identified in 2024 and 2025, but the remaining recommendation has a direct operational consequence. GSA has developed a public roadmap and created a Partner Advisory Group, but GAO says those steps do not demonstrate that the specific technical challenges agencies identified have been resolved or that mutually agreed-upon time frames have been established. > GAO will continue monitoring GSA's progress. Until those time frames are established, the federal government's government-wide identity verification service retains an unresolved implementation gap as fraud and identity-theft threats continue to evolve. https://www.gao.gov/products/gao-26-109261 https://www.gao.gov/products/gao-26-109261

rcleveng 3mo ago

I was happy when they got rid of the virtual keyboard you had to type your password onto, such a pain since you also couldn't paste into the password field to autocomplete from a password manager. Had to constantly popup Chrome DevTools and "fix" the dom element to let paste work.

pwg 3mo ago
With Firefox you can set to false the about:config setting "dom.event.clipboardevents.enabled" and websites can no longer block paste.
dlcarrier 3mo ago
If they let you paste your password, you might use a long, randomly generated password stored in a password manager, instead of choosing a short, easy-to-type password and using the same one everywhere.

AnthonyMouse 3mo ago

> definitely an improvement over their bespoke customer identity and access management solution Is it though? With a service-specific system, if the system gets compromised, you lose your data on that system. With a centralized system that still happens, but then on top of that, there is also a centralized service to get compromised where you also lose your data on that system and every other system using it. The centralized system also ossifies with whatever flaws were present in the naive early implementation like the ancient credit card networks have, because once untold agencies and private entities are using it, anyone who wants to change anything about it is inundated with objections from thousands of entities who don't want to have to redo their integrations. Meanwhile your activity is then correlated between different accounts. You have retailers using id.me to "verify military, student, teacher, nurse, or first responder status" for discounts. Not only do they get your name via computer instead of a physical document you would object if they tried to copy, you're now using the same system you use for taxes and healthcare. Is ICE going to use this against people? Are foreign intelligence agencies going to silently compromise it and use it against the domestic population? That's inevitable once you allow a centralized system like that to exist. If you want to do this properly then you publish a reference implementation for an authentication system and let every organization run their own independent instance of it. That way a) none of the accounts are tied together and b) you can improve the system whenever you want and people can adopt the new version independently instead of needing to coordinate the entire world before you can change a single API parameter.