Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IRS to ditch biometric requirement for online access

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 181 posts

Re: IRS to ditch biometric requirement for online access

#61

Post by vorpalhex »

alistairSH wrote: post #55
vorpalhex wrote: post #53

Earlier quoted context omitted.

We are still in the same universe where the OPM breach happened, right? Like no, I don't trust the government to protect the big bucket of PII on everyone in digital form. Not because of lizard people but because the government can barely keep it's own sites secure. Giving them more dangerous data in the form of bulk PII is the wrong move. Login.gov was the first thing, in a long time, that was well executed. I need…

The IRS already has almost all our PII. Not sure how adding a photo materially changes anything in that regard. I do agree ID.me is the wrong approach. And login.gov should be used in some form over a private enterprise. But, my concern is two-fold… it’s a private entity that I don’t really want to do business with. And the process described by Krebs was impossible - can we really expect everybody to have email, vali…

The IRS has our PII, but lots of it is not in a big bucket, it's quite diffuse. If PII is dynamite (and it is) then we want it divided up in silos, with firewalls, and limited access where nobody has universal access. Ideally a lot of it is protected by differential privacy - if I am getting audited, the auditor only see's my returns and not my identity, and someone else gets only my identity.

Re: IRS to ditch biometric requirement for online access

#62

Post by bladegash »

FireBeyond wrote: post #59
jackson1442 wrote: post #13

Earlier quoted context omitted.

I was extremely confused when I was asked to create an ID.me account for IRS. I have implemented Login.gov for some projects and it's rather easy; I can't see why they'd choose something else.

Not to mention, ID.me is horrible. Scanned my Driver's License at 200dpi. "Unable to find a face in the image you uploaded." Okay, 300dpi. "Unable to find a face in the image you uploaded." Huh. Scan at 72dpi. Success. Scan back of DL at 72dpi. "Unable to read barcode." Scan back of DL at 200dpi. "Unable to read barcode." Scan at 300dpi. Success. What a shitshow.

Really? Not that I particularly wanted to, but all I had to do was take a photo of the front and back using my iPhone and it went through without any problem.

Re: IRS to ditch biometric requirement for online access

#63

Post by operatingthetan »

I had a phone screen at ID.me and then some of the articles came out and I started looking more into them. They tried to have me start doing interviews but I declined. I watched a motivational video from their CEO and his energy was a bit of a turn off as well.

Re: IRS to ditch biometric requirement for online access

#65

Post by tomrod »

vorpalhex wrote: post #53
closeparen wrote: post #30

Earlier quoted context omitted.

The government cannot build a competent identity solution because a majority of voters believe that to do so presages something from genocide ("Papiere, bitte!") to the literal end of the world (“Mark of the Beast”).

We are still in the same universe where the OPM breach happened, right? Like no, I don't trust the government to protect the big bucket of PII on everyone in digital form. Not because of lizard people but because the government can barely keep it's own sites secure. Giving them more dangerous data in the form of bulk PII is the wrong move. Login.gov was the first thing, in a long time, that was well executed. I need…

Check out 18F / US Digital Services.

GSA has really upped the game over the past 10 years for digital services delivery. Such as Login.gov. Look for other places 18F/USDS are involved, and you'll see significant improvements.

https://playbook.cio.gov/

Re: IRS to ditch biometric requirement for online access

#66

Post by cheschire »

xeromal wrote: post #52
cproctor wrote: post #32

Earlier quoted context omitted.

If the IRS (or Sen. Wyden) is looking for a "core government service" which has been inappropriately commercialized, they might start with tax preparation.

lol, the arrogance to call out someone for something they actual are a champion in fighting.

perhaps it's just ignorance? not to be insulting to the gp, just saying perhaps they didn't know.

Re: IRS to ditch biometric requirement for online access

#67

Post by GCA10 »

FireBeyond wrote: post #59
jackson1442 wrote: post #13

Earlier quoted context omitted.

I was extremely confused when I was asked to create an ID.me account for IRS. I have implemented Login.gov for some projects and it's rather easy; I can't see why they'd choose something else.

Not to mention, ID.me is horrible. Scanned my Driver's License at 200dpi. "Unable to find a face in the image you uploaded." Okay, 300dpi. "Unable to find a face in the image you uploaded." Huh. Scan at 72dpi. Success. Scan back of DL at 72dpi. "Unable to read barcode." Scan back of DL at 200dpi. "Unable to read barcode." Scan at 300dpi. Success. What a shitshow.

Pixel phone user here. Very similar experience.

Re: IRS to ditch biometric requirement for online access

#68

Post by rootusrootus »

strangesongs wrote: post #6

“Login.gov is already used to access 200 websites run by 28 Federal agencies and over 40 million Americans have accounts,” Wyden wrote in a letter to the IRS today. “Unfortunately, login.gov has not yet reached its full potential, in part because many agencies have flouted the Congressional mandate that they use it, and because successive Administrations have failed to prioritize digital identity. The cost of this in…

I’m very happy Wyden is my senator. I made a point the last time I was in DC to stop by his office and express my support but his staffers were profoundly uninterested. Oh well, I voted for him, not them.

Re: IRS to ditch biometric requirement for online access

#69

Post by Rebelgecko »

monksy wrote: post #43
Rebelgecko wrote: post #36

Earlier quoted context omitted.

I recently had to sign up for login.gov (to renew my Global Entry, after they moved away from their own one-off CBP login system) and was pleasantly surprised with how good it was. Hopefully the TreasuryDirect.gov folks migrate some day

Are they still giving out those decoder cards?

You can use a CAC card as your second factor with the mandatory 2FA, but if you don't have one I think Yubikey-type devices are the only other hardware auth option

Re: IRS to ditch biometric requirement for online access

#70

Post by 3-cheese-sundae »

Unklejoe wrote: post #58

Well now I feel like an idiot for signing up. Is there any way to have ID.me delete all of my records? Or is that a lost cause?

To delete your account, follow this: https://help.id.me/hc/en-us/articles/203532014-How-do-I-clos...

And now for some contradictory information, straight from id.me, which may indicate it's a lost cause.

On that page it says:

"What happens to my deleted account? Your account information is purged. After seven days, you can create a new ID.me account with the same email address you used in the one that was deleted."

However, when following that exact process on the site, it states:

"If you decide to create a new ID.me account (at any point in the future), you will not be allowed to use the email address(es) lined to your previous account."

Both locations state:

"ID.me will retain a portion of your account's attributes on file to comply with applicable laws and help us prevent fraud."

Post reply on HN