Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IRS to adopt Login.gov as user authentication tool

fedscoop.com

Post reply on HN
Print view View original

131–140 of 193 posts

Re: IRS to adopt Login.gov as user authentication tool

#131

Post by puffoflogic »

m-ee wrote: post #63
wyc wrote: post #5

login.gov is open source! They also encrypt user data in a way that they can't access it without the user's password, precluding the formation of a national registry that could be used towards nefarious and anti-democratic purposes. As a result, account recovery looks a lot like re-registration, which I think is a great thing. https://github.com/18F/identity-idp It's built on Rails, and I'm really impressed at the en…

Their 2FA was broken in a way that required me to delete my account, which is a pain as now I have to redo my resume for applying to federal jobs. I had an old account which worked fine but when trying to access it again it always said my 2FA code was incorrect. Still I do prefer this to ID.me which I needed to use for CA unemployment.

Perhaps true user-friendliness is achieved not when the user can no longer have any bad experiences, but rather when the user's bad experiences are still superior to the alternative...?

Re: IRS to adopt Login.gov as user authentication tool

#132

Post by rank0 »

kkielhofner wrote: post #107
rank0 wrote: post #69

Earlier quoted context omitted.

I know you're just sharing your anecdote, but the vast majority (over 80%) of Americans live in urban areas. Many cities do in fact see violent crime. Although I don't own a firearm myself, I totally understand why someone else would want one in my neighborhood. Violent crime is not unusual where I live. Don't let your bubble from small town USA distort your view of the entire country.

My bubble extends well beyond "small town USA". Paradoxically, I don't have a single friend in Chicago, Denver, Miami, Los Angeles, etc that carries a gun. These cities run the spectrum of gun laws and all have higher crime rates than a small town yet fear of violent crime runs higher in communities where it's non-existent. This is anecdotal but statistics back it up. Most gun ownership is rural, personal protection…

> My bubble extends well beyond "small town USA". Paradoxically, I don't have a single friend in Chicago, Denver, Miami, Los Angeles, etc that carries a gun.

And yet, I know people in each of those cities that own firearms.

> This is anecdotal but statistics back it up. Most gun ownership is rural...

The study you cited doesn't support that claim. What the study says is "Among those who live in rural areas, 46% say they are gun owners, compared with 28% of those who live in the suburbs and 19% in urban areas."

You're failing to consider that https://www.census.gov/programs-surveys/geography/guidance/g...

This means Less than half of rural gun owners do so solely for protection. All in all, <4% of the US population owns a gun in a rural area solely for protection. That's a pretty far cry from your original claim that Americans live in a culture of fear.

Re: IRS to adopt Login.gov as user authentication tool

#133

Post by rinze »

throw0101a wrote: post #124
dgudkov wrote: post #122

Earlier quoted context omitted.

It's not a good choice. The Canadian government still doesn't understand the internet. There should be no obligatory private intermediaries between a citizen and the government no matter online or offline. It should provide an online identity service, just like it already provides offline government-issued IDs (e.g. passports) without involving banks or other private institutions.

> There should be no obligatory private intermediaries between a citizen and the government no matter online or offline. As I stated in my post: > You can also create a stand-alone account with the CRA if you wish. See Option 2: * https://www.canada.ca/en/revenue-agency/services/e-services/... The provinces of Alberta and BC also have identity providers (since they issue driver licenses and health cards) which the CR…

Quebec also has a login system (https://www.info.clicsequr.gouv.qc.ca/en/citoyens/), but it's only used for provincial services. Quite convenient, in any case.

Re: IRS to adopt Login.gov as user authentication tool

#134

Post by AndyMcConachie »

iostream24 wrote: post #105

Meanwhile, I’ve spent over a month trying to get verified as myself via ID.me and their broken process that can’t handle Americans living abroad, with foreign secondary documents. A typical round with customer service takes about a week, and then I was told that someone will be able to verify electric bills that aren’t in English, but then that turned out to be weeks ago and it’s yet to happen. This is all merely to…

I cannot upvote this comment enough!

I'm an American abroad and I spent roughly 8 hours spread across 5 days getting access to my irs.gov account. And yes, I actually recorded time spent on this chore.

The worst part was not the facial recognition. It was the fact that I had an address outside of the USA and they would not recognize a non-USA utility company for address verification. This was stupid for two reasons. The first being the obvious requirement that a non-resident have a contract with a utility company in the USA, and the second being that the IRS has been mailing me at my non-USA address for years. The IRS already had my address, but I had to verify it with ID.me.

The other worst part was they never told me WHY my various utility bills and bank statements were being rejected. At one point they told me I had to translate a bank statement, and that was the most feedback I ever got. But then I translated it and they rejected it for an unknown reason.

I eventually got my registration through them by getting a USA bank to recognize my foreign address. Luckily I also had an old W-2 laying around from years ago when I briefly worked in the states. Do they expect my current employer to give me a W-2?

Finally, on their stupid video call I was told I needed to have all of this documentation, which I dutifully prepared, and then all the person cared about was me holding my passport up to the camera.

Completely broken process for Americans abroad. To the point where they're likely breaking some US law by making it so difficult for non-residents to register for IRS access.

I hated it and I hope ID.me dies in a pit of bankruptcy.

Re: IRS to adopt Login.gov as user authentication tool

#135

Post by zie »

megaman821 wrote: post #87
imwillofficial wrote: post #74

Why did they ever go with ID.me when they have their own comparable solution? I’ve used both and both are solid, one is expensive and externally managed though..

I thought it was that login.gov does single-sign-on (SSO) and ID.me does SSO and identify verification at both the signup and sign-in level.

Login.gov absolutely cares about your identity. Case in point: login.gov will share your SSN to the provider(irs.gov in this case), if appropriate permissions are requested.

Re: IRS to adopt Login.gov as user authentication tool

#136

Post by rank0 »

TameAntelope wrote: post #72
rank0 wrote: post #69

Earlier quoted context omitted.

I know you're just sharing your anecdote, but the vast majority (over 80%) of Americans live in urban areas. Many cities do in fact see violent crime. Although I don't own a firearm myself, I totally understand why someone else would want one in my neighborhood. Violent crime is not unusual where I live. Don't let your bubble from small town USA distort your view of the entire country.

It's disingenuous as hell to clump "cities" together, as if going to Anacostia in DC is the same as going to Georgetown. If you live in a city and carry a gun, you're not protecting yourself, you're escalating the violence. Getting robbed is exceedingly rare anywhere in the US, and trying to stop a robbery with a gun is among the stupidest things a person can do. Further, robbing someone doesn't mean you should die,…

> It's disingenuous as hell to clump "cities" together, as if going to Anacostia in DC is the same as going to Georgetown.

I don't understand what you're arguing. Cities unequivocally see more crime than rural areas, even in nicer areas within a city (which may only be 1 mile from the "bad parts").

> Getting robbed is exceedingly rare anywhere in the US, and trying to stop a robbery with a gun is among the stupidest things a person can do.

> Further, robbing someone doesn't mean you should die, and killing someone over property is evil beyond comprehension. No society should support it, and very few do (nearly nowhere in the US, for example).

1. Not everywhere is the same. Just because you feel comfortable in your bubble doesn't mean that owning a firearm is a ridiculous proposition for all. In my past 10 years of living in Atlanta, I've witnessed or been a victim of enough crime to fully understand why some folks here choose to own a gun.

2. The second part is totally ridiculous. Nobody is arguing that all thieves should die.

Re: IRS to adopt Login.gov as user authentication tool

#137

Post by ethbr0 »

couchand wrote: post #130
chordalkeyboard wrote: post #125

Earlier quoted context omitted.

in theory they could but I doubt most patients want to have to remotely authorize their provider any time someone wants to access their record.

They could authorize an agent to authorize provider usage. The agent could apply provider-specific policies, and potentially monitor record requests to try to identify fraud, waste, or abuse, and so forth. The patient regularly reviews a report of actions taken by the agent to adjust configuration or revoke authorization. Could be an interesting approach!

All of the access audit information exists, afaik, albeit in non-standardized form. Because the law distinguishes between wilful and inadvertent releases, and assesses penalties on the basis of count and type, covered entities darn well better be able to produce an audit trail when asked.

Re: IRS to adopt Login.gov as user authentication tool

#138

Post by megaman821 »

zie wrote: post #135
megaman821 wrote: post #87

Earlier quoted context omitted.

I thought it was that login.gov does single-sign-on (SSO) and ID.me does SSO and identify verification at both the signup and sign-in level.

Login.gov absolutely cares about your identity. Case in point: login.gov will share your SSN to the provider(irs.gov in this case), if appropriate permissions are requested.

Last time I tried to do something at the IRS website, I had to turn on my camera and have my face compared to the face they have on file to proceed. I don't think login.gov has that level of verification. Whether the IRS needs that level of verification is another question.

Re: IRS to adopt Login.gov as user authentication tool

#139

Post by tombert »

warmwaffles wrote: post #128
tombert wrote: post #73

Earlier quoted context omitted.

They're nominally "not ok" with it, unless it's couched in some piece of legislation like the PATRIOT Act or snuck into a Defense Authorization Act, particularly after a national tragedy happens. Then a lot (a majority?) of Americans will suddenly be ok with the "if you got nothing to hide you got nothing to fear" mantra. I'm actually not a huge fan when people act like Americans are a a bunch of flag-waving morons,…

> "if you got nothing to hide you got nothing to fear" mantra. I know people like this and it's not a good mantra to follow. I have to remind them that all that needs to happen is to have political winds go the other direction and soon something they do regularly becomes illegal or suspicious. So dumb to give up privacy for safety.

That's always been my perspective. I'm going to take the radical position that not everyone in the government can be trusted, so we have to assume that there are bad actors who are going to abuse their power and use the questionably-obtained information to their advantage.

I'm not a fan of that, and the only way I can think of to avoid this being an issue is for them not to have the information in the first place.

Re: IRS to adopt Login.gov as user authentication tool

#140

Post by dzhiurgis »

hanniabu wrote: post #22
wyc wrote: post #5

login.gov is open source! They also encrypt user data in a way that they can't access it without the user's password, precluding the formation of a national registry that could be used towards nefarious and anti-democratic purposes. As a result, account recovery looks a lot like re-registration, which I think is a great thing. https://github.com/18F/identity-idp It's built on Rails, and I'm really impressed at the en…

> They also encrypt user data in a way that they can't access it without the user's password I love how low our standards for government sites have gotten where this is seen as a plus and not something that's expected

My country lets me use Google's SSO (arguably should probably also support Apple and have better 2FA options) - why wouldn't yours?

If someone wants to use facial recognition - why not? If someone wants to use insecure username/password and risk a compromise - let them do it.

FWIW big tech has probably 99.99% of people's faces, I'd guess at least 90% is tied to an identity.

Post reply on HN