5 ms·

Why did the US gov decide to rely on a TLD controlled by Montenegro for this seemingly important and sensitive service?

by bramhaag 2mo ago

isiahl 2mo ago
It’s not even a government service. It’s a private business they have entrusted with authentication for the government.
- varispeed 2mo ago
  textbook fascism (marriage of corporations and government).
  - rho138 2mo ago
    [flagged]
    - gjsman-1000 2mo ago
      No system has ever provably worked; otherwise we wouldn’t have had revolutions.
      - DANmode 2mo ago
        and?
      - forestrywat 2mo ago
        That's a different bar. Probably doesn't work is much easier to meet, and narrower. The person didn't ask for provably works. They are probably comfortable with "might work might not, but at least it's not provably wrong".
    - brookst 2mo ago
      Nah, I’m downvoting for the ludicrous claim that government paying a private company to provide a service is necessarily fascism.
  - eesmith 2mo ago
    I believe you are referring to the misquote described by McKay as 'Benito Mussolini created the word "fascism." He defined it as "the merging of the state and the corporation."'? I'll now quote from https://www.snopes.com/fact-check/fascism-corporations-corporatism-dictionary/ https://www.snopes.com/fact-check/fascism-corporations-corpo... , which thoroughly rejects that interpretation: "In other words, corporatism in Mussolini's fascism was not a free-market capitalist system. Far from it. It did not allow for the kind of competition, innovation, market entry, and research and development characteristic of modern capitalism, and it was closely ruled in every way by the state with Mussolini at its head. Anything that draws a direct link between what are now referred to as corporations (large, powerful private companies operating in a modern free-market capitalist system) and Mussolini's corporatism, is founded on a misunderstanding — most likely caused by the similarity between the words."
    - ChrisMarshallNY 2mo ago
      Thanks for that. That quote was not something I ever lost sleep over, but it also never seemed correct.
    - varispeed 2mo ago
      > It did not allow for the kind of competition, innovation, market entry, and research and development characteristic of modern capitalism, and it was closely ruled in every way by the state with Mussolini at its head That is precisely what is happening with Western economies. Big multinational corporations dominate procurement and dictate regulation to limit competition, create barriers to enter the market and research and development out of reach for SMEs. As in marriage of corporations and the state.
      - eesmith 2mo ago
        But that is still not "corporatism" ("corporativismo" in Italian), as used in Mussolini's fascism. From the Snopes page: > In his Dictionary of Political Thought, Roger Scruton describes corporatism in this way: > The economy was divided into associations (called 'syndicates') of workers, employers and the professions; only one syndicate was allowed in each branch of industry, and all officials were either fascist politicians or else loyal to the fascist cause. According to law the syndicates were autonomous, but in fact they were run by the state. The 'corporations' united the syndicates in a given industry, but made no pretence at autonomy from the state. That is nothing at all like what is happening with Western economies, so it is not "corporatism", so it is not "textbook fascism". You can read the various definitions of fascism at https://en.wikipedia.org/wiki/Definitions_of_fascism https://en.wikipedia.org/wiki/Definitions_of_fascism and verify that none align with 'marriage of corporations and government'. FWIW, surely the Dutch East Indies company was a marriage of corporation and government, yes?
  - notnmeyer 2mo ago
    doesn’t id.me predate trump? i could totally be wrong about that, but it’s not new.
    - greyface- 2mo ago
      Trump didn't invent fascism.
      - notnmeyer 2mo ago
        i understand that, but i also didn’t feel facism taking hold before trump. probably a bad lumping of things, but my experience with id.me has been largely positive.
        KetoManx64 2mo ago
        Fascism only exists if you feel it yourself and not if other people get ground down by it?
  - snootypoot 2mo ago
    [dead]
noinsight 2mo ago
It’s funny… In Finland they went with hightrust.id (Indonesia) too.
- dlcarrier 2mo ago
  I'd also be concerned that the rest of the domain is in English.
deathanatos 2mo ago
And we even have login.gov, too! (… which I really hope replaces ID.montengro one of these days, but … I guess not, if the Treasury is adopting it now.)
- sandeepkd 2mo ago
  Personally I think its a poor choice to go with ID.me instead of login.gov when it comes to security. Primary reason is the completeness of the product and reliability. A security product does not needs all the bells and whistles and can be well defined for governments use case. Any security product with ongoing development is just an open door for possible vulnerabilities being introduced.
  - ncallaway 2mo ago
    Under the prior administration things were moving slowly toward login.gov for every federal service. I’m really sad to see that’s yet another thing the current administration is destroying
- saltcured 2mo ago
  In our NIH-related project, we were offered both. For IAL2 identity proofing, Login.gov is only for US persons, i.e. validating US-issued credentials. Meanwhile. ID.me has support to validate foreign passports. So, if TreasuryDirect supports foreign customers, it makes sense to offer ID.me, but it seems inappropriate not to offer Login.gov for customers who are US persons!
- foresto 2mo ago
  Does login.gov require photos, videos, fingerprints, smartphone apps, or similar nonsense as ID.me does? Or does it offer less invasive ways to confirm identity, like mailing a code sent to one's long-established postal address, or an in-person visit to a local social services office?
petcat 2mo ago
> US gov decide to rely on a TLD controlled by Montenegro Let's be honest, the US government can control basically any domain it wants. I doubt Montenegro is going to cause any problems for it.
- UltraSane 2mo ago
  I imagine hacking Montenegro is an interview test for NSA applicants.
deleted 2mo ago
[deleted]
toast0 2mo ago
Personally, I love that you go to irs.gov and the top tells you it's a us govenrment sit eand how to know (tld is .gov) ... But then you try to login and get hijacked by a site affiliated with a different country. Glad I don't actually need to login to my irs account lately.
- ncallaway 2mo ago
  > Glad I don't actually need to login to my irs account lately. I still pay my taxes by physical check, because they won’t let me pay digitally unless I sign in with ID.me.
  - hubbahubbahubba 2mo ago
    Social security site can be accessed via presenting credentials at a US Post Office without making a sacrifice to the id.me overlords.
    - ncallaway 2mo ago
      Will they do that for the IRS? I’d love that. Hopefully they can do it for Treasury Direxf too
ncallaway 2mo ago
They didn’t. The federal government has login.gov which things were slowly consolidating towards. ID.me is a private third party system, that I won’t ever use.
jambalaya8 2mo ago
It is not only the .me TLD we should think about. Before .me and even during, there was also the .me.gov back when domains and such things were more delineated. There is the peril of not only contending with Montenegro but also the outside chance of Maine. Let's face it, .me was never a safe choice as a top-level domain for any country (or locality). It seems like a vanity TLD to too many people and it competes for a name space it has no place in. What we probably need is a whole new TLD specifically and only for something like this. I am sure IANA is capable, though policing it would be a nightmare, unless it were handed off to something like the defense department. So many privacy concerns.
jambalaya8 2mo ago
Note it is also ridiculous that these sites are allowed to do facial captures.

Why did the US gov decide to rely on a TLD controlled by Montenegro for this seemingly important and sensitive service?

isiahl 2mo ago

It’s not even a government service. It’s a private business they have entrusted with authentication for the government.

varispeed 2mo ago
textbook fascism (marriage of corporations and government).
- rho138 2mo ago
  [flagged]
  - gjsman-1000 2mo ago
    No system has ever provably worked; otherwise we wouldn’t have had revolutions.
    - DANmode 2mo ago
      and?
    - forestrywat 2mo ago
      That's a different bar. Probably doesn't work is much easier to meet, and narrower. The person didn't ask for provably works. They are probably comfortable with "might work might not, but at least it's not provably wrong".
  - brookst 2mo ago
    Nah, I’m downvoting for the ludicrous claim that government paying a private company to provide a service is necessarily fascism.
- eesmith 2mo ago
  I believe you are referring to the misquote described by McKay as 'Benito Mussolini created the word "fascism." He defined it as "the merging of the state and the corporation."'? I'll now quote from https://www.snopes.com/fact-check/fascism-corporations-corporatism-dictionary/ https://www.snopes.com/fact-check/fascism-corporations-corpo... , which thoroughly rejects that interpretation: "In other words, corporatism in Mussolini's fascism was not a free-market capitalist system. Far from it. It did not allow for the kind of competition, innovation, market entry, and research and development characteristic of modern capitalism, and it was closely ruled in every way by the state with Mussolini at its head. Anything that draws a direct link between what are now referred to as corporations (large, powerful private companies operating in a modern free-market capitalist system) and Mussolini's corporatism, is founded on a misunderstanding — most likely caused by the similarity between the words."
  - ChrisMarshallNY 2mo ago
    Thanks for that. That quote was not something I ever lost sleep over, but it also never seemed correct.
  - varispeed 2mo ago
    > It did not allow for the kind of competition, innovation, market entry, and research and development characteristic of modern capitalism, and it was closely ruled in every way by the state with Mussolini at its head That is precisely what is happening with Western economies. Big multinational corporations dominate procurement and dictate regulation to limit competition, create barriers to enter the market and research and development out of reach for SMEs. As in marriage of corporations and the state.
    - eesmith 2mo ago
      But that is still not "corporatism" ("corporativismo" in Italian), as used in Mussolini's fascism. From the Snopes page: > In his Dictionary of Political Thought, Roger Scruton describes corporatism in this way: > The economy was divided into associations (called 'syndicates') of workers, employers and the professions; only one syndicate was allowed in each branch of industry, and all officials were either fascist politicians or else loyal to the fascist cause. According to law the syndicates were autonomous, but in fact they were run by the state. The 'corporations' united the syndicates in a given industry, but made no pretence at autonomy from the state. That is nothing at all like what is happening with Western economies, so it is not "corporatism", so it is not "textbook fascism". You can read the various definitions of fascism at https://en.wikipedia.org/wiki/Definitions_of_fascism https://en.wikipedia.org/wiki/Definitions_of_fascism and verify that none align with 'marriage of corporations and government'. FWIW, surely the Dutch East Indies company was a marriage of corporation and government, yes?
- notnmeyer 2mo ago
  doesn’t id.me predate trump? i could totally be wrong about that, but it’s not new.
  - greyface- 2mo ago
    Trump didn't invent fascism.
    - notnmeyer 2mo ago
      i understand that, but i also didn’t feel facism taking hold before trump. probably a bad lumping of things, but my experience with id.me has been largely positive.
      - KetoManx64 2mo ago
        Fascism only exists if you feel it yourself and not if other people get ground down by it?
- snootypoot 2mo ago
  [dead]

noinsight 2mo ago

It’s funny… In Finland they went with hightrust.id (Indonesia) too.

dlcarrier 2mo ago
I'd also be concerned that the rest of the domain is in English.

deathanatos 2mo ago

And we even have login.gov, too! (… which I really hope replaces ID.montengro one of these days, but … I guess not, if the Treasury is adopting it now.)

sandeepkd 2mo ago
Personally I think its a poor choice to go with ID.me instead of login.gov when it comes to security. Primary reason is the completeness of the product and reliability. A security product does not needs all the bells and whistles and can be well defined for governments use case. Any security product with ongoing development is just an open door for possible vulnerabilities being introduced.
- ncallaway 2mo ago
  Under the prior administration things were moving slowly toward login.gov for every federal service. I’m really sad to see that’s yet another thing the current administration is destroying
saltcured 2mo ago
In our NIH-related project, we were offered both. For IAL2 identity proofing, Login.gov is only for US persons, i.e. validating US-issued credentials. Meanwhile. ID.me has support to validate foreign passports. So, if TreasuryDirect supports foreign customers, it makes sense to offer ID.me, but it seems inappropriate not to offer Login.gov for customers who are US persons!
foresto 2mo ago
Does login.gov require photos, videos, fingerprints, smartphone apps, or similar nonsense as ID.me does? Or does it offer less invasive ways to confirm identity, like mailing a code sent to one's long-established postal address, or an in-person visit to a local social services office?

petcat 2mo ago

> US gov decide to rely on a TLD controlled by Montenegro Let's be honest, the US government can control basically any domain it wants. I doubt Montenegro is going to cause any problems for it.

UltraSane 2mo ago
I imagine hacking Montenegro is an interview test for NSA applicants.

deleted 2mo ago

[deleted]

toast0 2mo ago

Personally, I love that you go to irs.gov and the top tells you it's a us govenrment sit eand how to know (tld is .gov) ... But then you try to login and get hijacked by a site affiliated with a different country. Glad I don't actually need to login to my irs account lately.

ncallaway 2mo ago
> Glad I don't actually need to login to my irs account lately. I still pay my taxes by physical check, because they won’t let me pay digitally unless I sign in with ID.me.
- hubbahubbahubba 2mo ago
  Social security site can be accessed via presenting credentials at a US Post Office without making a sacrifice to the id.me overlords.
  - ncallaway 2mo ago
    Will they do that for the IRS? I’d love that. Hopefully they can do it for Treasury Direxf too

ncallaway 2mo ago

They didn’t. The federal government has login.gov which things were slowly consolidating towards. ID.me is a private third party system, that I won’t ever use.

jambalaya8 2mo ago

It is not only the .me TLD we should think about. Before .me and even during, there was also the .me.gov back when domains and such things were more delineated. There is the peril of not only contending with Montenegro but also the outside chance of Maine. Let's face it, .me was never a safe choice as a top-level domain for any country (or locality). It seems like a vanity TLD to too many people and it competes for a name space it has no place in. What we probably need is a whole new TLD specifically and only for something like this. I am sure IANA is capable, though policing it would be a nightmare, unless it were handed off to something like the defense department. So many privacy concerns.

jambalaya8 2mo ago

Note it is also ridiculous that these sites are allowed to do facial captures.