Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IRS to adopt Login.gov as user authentication tool

fedscoop.com

Post reply on HN
Print view View original

161–170 of 193 posts

Re: IRS to adopt Login.gov as user authentication tool

#161

Post by ezfe »

iostream24 wrote: post #105

Meanwhile, I’ve spent over a month trying to get verified as myself via ID.me and their broken process that can’t handle Americans living abroad, with foreign secondary documents. A typical round with customer service takes about a week, and then I was told that someone will be able to verify electric bills that aren’t in English, but then that turned out to be weeks ago and it’s yet to happen. This is all merely to…

I set up ID.me for somebody and at one step it asked me to confirm the proper spelling of their name.

Both options were incorrectly spelled. There was no way to proceed and spell the name correctly.

Their support desk basically told us it wasn't their fault and to go away.

Re: IRS to adopt Login.gov as user authentication tool

#162

Post by ewoodrich »

Someone1234 wrote: post #19
spelunker wrote: post #3

Is this the same authentication platform that TreasuryDirect uses? edit - looks like no. On the one hand a single sign on to both would have been nice, OTOH TreasuryDirect's authentication system is a PITA.

TreasuryDirect, the site that has case-insensitive passwords, disallows password managers, disallows the use of your actual keyboard to enter your password, and has this dumb on-screen keyboard with tiny keys that ultimately accomplishes nothing? Super trash. It still amuses me how few people, even those who claim security expertise, don't understand that commercial malware is able to hook the driver stack (and or br…

On top of everything you mentioned, TreasuryDirect also has an insanely aggravating issue where if you click a navigation button twice (e.g clicking next again reflexively before the next page has fully loaded), it displays an error about invalid navigation and forces you to login again and start from the beginning.

Even something as simple as disabling navigation links/buttons after being clicked before the next page load would mostly solve this and save hours of frustration having to re-login through their god awful signin flow every time.

Re: IRS to adopt Login.gov as user authentication tool

#163

Post by YeBanKo »

wyc wrote: post #5

login.gov is open source! They also encrypt user data in a way that they can't access it without the user's password, precluding the formation of a national registry that could be used towards nefarious and anti-democratic purposes. As a result, account recovery looks a lot like re-registration, which I think is a great thing. https://github.com/18F/identity-idp It's built on Rails, and I'm really impressed at the en…

It looks great, though afaik they still encrypt on the server side, which means they handle unencrypted data, so it seems to protect more against data leaks, rather than surveillance. To be honest, this is federal government and they already have most of the data anyway.

Re: IRS to adopt Login.gov as user authentication tool

#165

Post by rrdharan »

jrockway wrote: post #111
techsupporter wrote: post #25

Earlier quoted context omitted.

I just wonder what kind of extra hoops we'll have to go through to use an existing login.gov account with the IRS. I read in some article somewhere that the IRS didn't use login.gov because it isn't "as verified" or some kind of thing as the IRS needs. Yet the reason I have a login.gov account is for my NEXUS enrollment which means I've been fingerprinted, background checked, had my passport number linked, and been i…

I think the IRS must already have a pretty good relationship with CBP. A few years ago, the IRS sent me a letter claiming I owed them a large quantity of money. It was a mistake, because my idiot broker messed up the paperwork. (Schwab equity awards. What a disaster.) At about the same time, I applied to renew Global Entry. Nothing happened on the Global Entry application for months, as I worked with a tax expert to…

There’s zero evidence in your anecdote to suggest anything other than a coincidence. You’re basically just arbitrarily choosing to believe it wasn’t.

Re: IRS to adopt Login.gov as user authentication tool

#166

Post by uoaei »

puffoflogic wrote: post #131
m-ee wrote: post #63

Earlier quoted context omitted.

Their 2FA was broken in a way that required me to delete my account, which is a pain as now I have to redo my resume for applying to federal jobs. I had an old account which worked fine but when trying to access it again it always said my 2FA code was incorrect. Still I do prefer this to ID.me which I needed to use for CA unemployment.

Perhaps true user-friendliness is achieved not when the user can no longer have any bad experiences, but rather when the user's bad experiences are still superior to the alternative...?

That's an easy way to start a race to the bottom :)

Re: IRS to adopt Login.gov as user authentication tool

#168

Post by alexose »

wslack wrote: post #110
alexose wrote: post #94

Earlier quoted context omitted.

I spent a couple of years with the USDS ( https://usds.gov/ ). USDS, along with 18F, are largely responsible for login.gov, as well as a lot of other really great projects. Overall fantastic experience if you're open to an adventure! I could probably spend a week telling war stories, but the main takeaway is that you can't look at government as just another sector waiting to be brought up to speed. Government is an e…

Not that different! Hi Alex. :)

Hey wslack! Hope you're well. Glad to hear you're still fighting the good fight.

Re: IRS to adopt Login.gov as user authentication tool

#169

Post by jesterpm »

dzhiurgis wrote: post #140
hanniabu wrote: post #22

Earlier quoted context omitted.

> They also encrypt user data in a way that they can't access it without the user's password I love how low our standards for government sites have gotten where this is seen as a plus and not something that's expected

My country lets me use Google's SSO (arguably should probably also support Apple and have better 2FA options) - why wouldn't yours? If someone wants to use facial recognition - why not? If someone wants to use insecure username/password and risk a compromise - let them do it. FWIW big tech has probably 99.99% of people's faces, I'd guess at least 90% is tied to an identity.

I'd say the bigger issue isn't being allowed to use a third-party SSO, the issue is having the option to not use the third-party's SSO. We see enough horror stories about the impact of being locked out of a Google account.

Re: IRS to adopt Login.gov as user authentication tool

#170

Post by [deleted] »

throw0101a wrote: post #46

In Canada, the Canada Revenue Agency (CRA) allows you you to leverage existing relationships with banks and credit unions, "Sign-in Partners": * https://www.canada.ca/en/revenue-agency/services/e-services/... * https://www.canada.ca/en/revenue-agency/services/e-services/... * https://verified.me/government-sign-in-by-verified-me/ You can also create a stand-alone account with the CRA if you wish. Other federal agenci…

[deleted]
Post reply on HN