IRS Security
schneier.com
schneier.com
In his opening paragraph he says that he's not there to answer the questions of "What's our money being spent on? Do we have a government worth paying for?" And then draws a conclusion that can only be rationally argued for in the context of those very answers: "We all need to urge Congress to give it the money to [improve security]."
Let's be clear information security related to tax information is a basic need and of paramount importance. But the suggestion that the answer to better security is simply to throw money at it is deeply flawed and naive if you don't know how existing funds are being used. This is true even if budgets are cut or workloads increased. Without first answering why current funds are insufficient (i.e what the money is being spent on and is it worth it) you cannot answer the question of there being insufficient budget.
In fact, this line of argument is the old trick politicians to fool voters into approving ever more tax increases. During the budget year you fritter away your funds on frivolous projects and ignore inefficiencies (bonus points if you benefit friends & family along the way) while at the same time underfunding infrastructure, police, fire, etc. Then, during the election cycle, you encourage talk about how desperately underfunded these basic services are and how they are in dire need of increased funds. This talk never results in a discussion of where the money currently goes... after all, our police/fire aren't getting the money they need and you want to debate the budget!? So you go to the voters for more money for these essentials using a purely emotional appeal... and you get to eat your cake too.
Sorry. Scheier is wrong until he answers those questions that he dismisses. Those spending discussions need to happen even if it's to justify additional money for something as important as security.
http://www.cnn.com/2016/04/13/opinions/is-data-you-send-to-i...
They support widely popular resolutions (tax cuts? Nobody is against tax cuts. The only debate is which section of the population gets bulk of the money, hint: it's not the poor).
They shift money around and remove it from sound programs like social security so it goes bankrupt.
They intentionally privatize and mismanage government programs so they fail.
Then when there isn't enough money to go around come budget balancing time, whoops looks like we have to slash health care budgets. Education budgets? You only really NEED 50% of that, right? Why is the state paying to help kids go to college? These programs are horribly mismanaged and inefficient [because we have made them so], the market will do a MUCH better job if we just insert a corporate middleman between the people who need services and the people who provide them. It would be nice to let public employees exercise their rights and bargain collectively, but you know it's just too darn expensive. Those contracts we signed to give people pensions? Well it's not our fault we can't pay them now, it's just the economic reality. We all have to make sacrifices [except the rich]. Look at the adult conservatives being responsible, making the hard choices to cut things that need to be cut.
Rinse, repeat, slash and burn.
Let me make your The only debate is which section of the population gets bulk of the money, hint: it's not the poor statement more accurate: The only debate is which section of the population gets to keep it's money that was slated for confiscation, hint: it's not the poor since they don't pay taxes to begin with.
What was the last program that the "right" actually rolled back that wasn't actually replaced with something more grand? Sure, in new programs they maybe didn't grow things as much as today's radical, er, mainstream left would like. But our compassionate conservatives have expanded government at every turn; they'll talk about reform, but the majority never mention terminating these things... even good ol' Trump makes no such claims. Ted Cruz, maybe, but most rank and file Republicans don't like him, remember?
I'm sorry. But most of your arguments sound like propaganda and are disconnected from reality. I grant you so-called conservatives like to have their private/public partnerships, which are as wrong as the programs that they target. But few actually try to dismantle the programs... they simply try to structure the gravy train.
http://i.imgur.com/fkWNDF3.png
(exactly 8 characters, >1 number, >1 letter, no symbols, case insensitive).
https://www.washingtonpost.com/business/economy/youd-have-to...
I'm not planning on leaving or have assets in the range. It seems like kind of a ripoff though.
But if they move to another form of unique identifier, that'll just shift the fraud to that new identifier. The problem with SSN's isn't the IRS using them, it's everyone else using them as a de facto national ID number.
I know that a lot of folks don't want a national ID card. I don't either. But that's easy enough with a smart PKI: the federal government and its agencies can trust the state governments' issuing agencies. Each state could issue CAC-like cards to its citizens, and then those folks could sign their taxes and conduct other official business.
It'd probably end up relied upon by other vendors, just like Social Security numbers, but at least a) it'd be more secure b) it'd be breakable only by the government, rather than by the government and anyone else.
Not to make the perfect the enemy of the good, but realistically I doubt we'd get anything actually secure.
Did you read the linked article? CACs are in use by the DOD and have been for years.
both sides need to recognize that if absolute indemnification is required for tax purposes it is as well for voting rights because it protects both equally. the challenge is how to keep confirm the card is really held by the person holding it. pin numbers don't cut it
Or, better yet, eliminate payroll deductions entirely and ensure everyone has a liability come April. Pretty hard to defraud a liability.
Much easier to not pay a liability -- especially if it's a double-digit percentage of your annual income, and not just a small rounding error like it typically is today.
This is good from a rational point of view, but there's a large number of people who enjoy having large tax refunds because they perceive it as free money. I'm not defending that mindset, but it would be hard to get people to get over it.
> Or, better yet, eliminate payroll deductions entirely and ensure everyone has a liability come April.
Part of the reason we have payroll deductions in the first place is that the government understandably doesn't trust people to save up money to pay their income taxes every year; it's much easier to deduct roughly how much someone owes and then settle the difference every April and much more likely to end with the government getting somewhat close to how much it's owed.
I can't imagine how many people would have unpaid taxes each year, but it would be an insanely high number. I'm sure the tax relief assistance industry would love it, though.
If it treated SSNs as a username and required everyone to generate some unique passwords...it would work.
Since 2008 the IRS has required a security PIN code to e-file. It's not the most secure system in the world, but everyone needs to understand you can't just e-file someone's taxes by knowing their SSN.
That isn't a password and its basically available based on public information, just like a SSN.
The IRS created a system that is literally another username and called it a PIN.
The same information many people hand out as part of loan applications when they are asked for their tax returns as well as the IRS and other places. Hell, I had to do it in March and my AGI for 2014 is in god knows how many people's hands.
Once again, that is a username and not a password.
1) Passwords are secret credentials possessed by one trusted party, yourself.
2) The hashed representation of which is stored by the opposing party for verification.
You keep listing publicly available authentication factors which are effectively usernames, just like a SSN.
If you need me to clarify further, I can. I'm just genuinely horrified people treat these things as confidential because they are not.
I feel this is alot like my conversation here:
https://news.ycombinator.com/item?id=11447435
People, even IT professionals, seem genuinely ignorant of the fact this data is essentially public knowledge and it simply requires a small amount of [potentially illegal] effort to acquire. They then go and build authentication schemes based on this information on the assumption literally no one on the planet is a criminal.
That isn't "security" for anything that involving real money.
The impediment to that is corrupt rich/powerful elites who make a lot of money fudging their taxes, and the industries that serve them - (see Panama Papers).
Anyone in the middle class and lower should be pro-open-tax-data. This would lead to less regressive taxes, since we'd see what shady tricks the rich employ, and close those loopholes with legislation. It's a great step to help us iterate on and improve the tax code.