Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IRS to ditch biometric requirement for online access

krebsonsecurity.com

Post reply on HN
Print view View original

31–40 of 181 posts

Re: IRS to ditch biometric requirement for online access

#31

Post by thesimon »

Spooky23 wrote: post #18
jackson1442 wrote: post #13

Earlier quoted context omitted.

I was extremely confused when I was asked to create an ID.me account for IRS. I have implemented Login.gov for some projects and it's rather easy; I can't see why they'd choose something else.

Easy, the answer is right here: https://developers.login.gov/overview Login.gov is a fine authentication service, but cannot deliver the identity assurance level (IAL-2) required to identify people. (It may not be able to deliver AAL-2 authentication soon either as standard evolve.) Uploading a picture of your drivers license is not a meaningful validation of your identity. The reaction of the Senators here is the eq…

What about sending a letter to the registered address?

Re: IRS to ditch biometric requirement for online access

#32

Post by cproctor »

strangesongs wrote: post #6

“Login.gov is already used to access 200 websites run by 28 Federal agencies and over 40 million Americans have accounts,” Wyden wrote in a letter to the IRS today. “Unfortunately, login.gov has not yet reached its full potential, in part because many agencies have flouted the Congressional mandate that they use it, and because successive Administrations have failed to prioritize digital identity. The cost of this in…

If the IRS (or Sen. Wyden) is looking for a "core government service" which has been inappropriately commercialized, they might start with tax preparation.

Re: IRS to ditch biometric requirement for online access

#33

Post by dylan604 »

imglorp wrote: post #26
woodruffw wrote: post #19

Earlier quoted context omitted.

All things being equal, the US government is simultaneously (1) the single most legitimate non-medical third party that needs to access my personal data, and (2) the single best entity to hold my data in terms of personal recourse . That's not saying much, but it is better than the open scorn and disrespect for my privacy that corporations offer. The solution to government breaches is what it's always been: to make t…

Good point, gov has less reason to sell your data

Yeah, that federal deficit surely doesn't need any help getting paid down /s

However, this isn't to say that someone doesn't get the bright idea that they could fund some sort of slush fund with this.

Re: IRS to ditch biometric requirement for online access

#34

Post by toomuchtodo »

Spooky23 wrote: post #29
akersten wrote: post #22

Earlier quoted context omitted.

No third party/private solution is appropriate here. The government that oversees the issuing of these IDs and attests that they are sufficient for government use (Real ID) cannot themselves validate said ID? Corruption or incompetence are the only paths that lead to outsourcing federal identity verification.

The only IDs issued widely by the US government are military credentials, immigration credentials, and passports. Driver’s licenses are issued by states and other entities. They are also fraught with problems as millions of people do not have REAL IDs, yet need to interact with government. The problem is that any bartender who has scanned your drivers license has the information required to scam an online validation…

You continue to make some good points, but at the end of the day, this is a government function and responsibility, not that of a private company. Login.gov can use the same AWS services in GovCloud as ID.me uses (Rekognition, available since 2017 in GovCloud). With USDS and 18F, it cannot be argued GSA (which Login.gov falls under) doesn’t have the skills available to build this capability.

This is a call to enhance Login.gov’s identity abilities, and US government citizen identity management in general. Login.gov (and perhaps USPS for in person proofing) should be funded to do this, not ID.me. Higher level, this is about building strong public goods and defending them.

Re: IRS to ditch biometric requirement for online access

#35

Post by hn-sucks »

Spooky23 wrote: post #29
akersten wrote: post #22

Earlier quoted context omitted.

No third party/private solution is appropriate here. The government that oversees the issuing of these IDs and attests that they are sufficient for government use (Real ID) cannot themselves validate said ID? Corruption or incompetence are the only paths that lead to outsourcing federal identity verification.

The only IDs issued widely by the US government are military credentials, immigration credentials, and passports. Driver’s licenses are issued by states and other entities. They are also fraught with problems as millions of people do not have REAL IDs, yet need to interact with government. The problem is that any bartender who has scanned your drivers license has the information required to scam an online validation…

No post body was provided.

Re: IRS to ditch biometric requirement for online access

#36

Post by Rebelgecko »

strangesongs wrote: post #6

“Login.gov is already used to access 200 websites run by 28 Federal agencies and over 40 million Americans have accounts,” Wyden wrote in a letter to the IRS today. “Unfortunately, login.gov has not yet reached its full potential, in part because many agencies have flouted the Congressional mandate that they use it, and because successive Administrations have failed to prioritize digital identity. The cost of this in…

I recently had to sign up for login.gov (to renew my Global Entry, after they moved away from their own one-off CBP login system) and was pleasantly surprised with how good it was. Hopefully the TreasuryDirect.gov folks migrate some day

Re: IRS to ditch biometric requirement for online access

#37

Post by gruez »

woodruffw wrote: post #19
imglorp wrote: post #10

Earlier quoted context omitted.

Forget Equifax ... how about the Office of Personnel Management? People may well have lost their lives as a result. We may not know for decades. https://www.lawfareblog.com/why-opm-hack-far-worse-you-imagi... Oh, and the IRS has already been breached at least once. I'm not wild about waiting for the next one. Maybe government is not the best group to be holding your personal data. https://www.nytimes.com/2015/05/27/b…

All things being equal, the US government is simultaneously (1) the single most legitimate non-medical third party that needs to access my personal data, and (2) the single best entity to hold my data in terms of personal recourse . That's not saying much, but it is better than the open scorn and disrespect for my privacy that corporations offer. The solution to government breaches is what it's always been: to make t…

>the single best entity to hold my data in terms of personal recourse

what type of recourse are you talking about? Voting your representatives out?

Re: IRS to ditch biometric requirement for online access

#38

Post by jdmichal »

akersten wrote: post #22
Spooky23 wrote: post #18

Earlier quoted context omitted.

Easy, the answer is right here: https://developers.login.gov/overview Login.gov is a fine authentication service, but cannot deliver the identity assurance level (IAL-2) required to identify people. (It may not be able to deliver AAL-2 authentication soon either as standard evolve.) Uploading a picture of your drivers license is not a meaningful validation of your identity. The reaction of the Senators here is the eq…

No third party/private solution is appropriate here. The government that oversees the issuing of these IDs and attests that they are sufficient for government use (Real ID) cannot themselves validate said ID? Corruption or incompetence are the only paths that lead to outsourcing federal identity verification.

I generally agree with you. However:

Real ID validates that you are the person you are at the time of issuance, but does not guarantee that the possessor of the ID is that person. This stems from the fact that an ID is "something you have". Like any secure system, you should use multifactor authentication. The facial scan is "something you are", so the combination of ID and scan provides that. One might also use "something you know", such as your adjusted gross income (AGI) that the IRS used before.

Re: IRS to ditch biometric requirement for online access

#39

Post by xenophonf »

Spooky23 wrote: post #18
jackson1442 wrote: post #13

Earlier quoted context omitted.

I was extremely confused when I was asked to create an ID.me account for IRS. I have implemented Login.gov for some projects and it's rather easy; I can't see why they'd choose something else.

Easy, the answer is right here: https://developers.login.gov/overview Login.gov is a fine authentication service, but cannot deliver the identity assurance level (IAL-2) required to identify people. (It may not be able to deliver AAL-2 authentication soon either as standard evolve.) Uploading a picture of your drivers license is not a meaningful validation of your identity. The reaction of the Senators here is the eq…

login.gov meets IAL2 since it NIST SP 800-63-3 "allows for remote or in-person identity proofing" (800-63A page 8). Likewise, TOTP is explicitly mentioned as an allowed multi-factor OTP authenticator (800-63B pages 20-21). I'm not aware of changes in SP 800-63-4 that would affect login.gov's current implementation, but it's been a minute since I last read the -4 draft and could be wrong.

Re: IRS to ditch biometric requirement for online access

#40

Post by PaulDavisThe1st »

toomuchtodo wrote: post #34
Spooky23 wrote: post #29

Earlier quoted context omitted.

The only IDs issued widely by the US government are military credentials, immigration credentials, and passports. Driver’s licenses are issued by states and other entities. They are also fraught with problems as millions of people do not have REAL IDs, yet need to interact with government. The problem is that any bartender who has scanned your drivers license has the information required to scam an online validation…

You continue to make some good points, but at the end of the day, this is a government function and responsibility, not that of a private company. Login.gov can use the same AWS services in GovCloud as ID.me uses (Rekognition, available since 2017 in GovCloud). With USDS and 18F, it cannot be argued GSA (which Login.gov falls under) doesn’t have the skills available to build this capability. This is a call to enhance…

> You continue to make some good points, but at the end of the day, this is a government function and responsibility, not that of a private company.

I 100% agree. Problem is, the federal government (and the state governments and to a large extent big chunks of the citizenry) are fundamentally opposed to the issuance of a non-passport general citizen's ID and/or number. Those opposed to it don't have any good solution to "how to protect information the government keeps about you" either, so it's no good asking them.

Devising an actual public system for identity verification when you're being told the government cannot identify people is ... challenging.

Post reply on HN