Until the IRS stops using social security numbers to file, it's insecure.
But if they move to another form of unique identifier, that'll just shift the fraud to that new identifier. The problem with SSN's isn't the IRS using them, it's everyone else using them as a de facto national ID number.
I know that a lot of folks don't want a national ID card. I don't either. But that's easy enough with a smart PKI: the federal government and its agencies can trust the state governments' issuing agencies. Each state could issue CAC-like cards to its citizens, and then those folks could sign their taxes and conduct other official business.
It'd probably end up relied upon by other vendors, just like Social Security numbers, but at least a) it'd be more secure b) it'd be breakable only by the government, rather than by the government and anyone else.
Not to make the perfect the enemy of the good, but realistically I doubt we'd get anything actually secure.
Did you read the linked article? CACs are in use by the DOD and have been for years.
both sides need to recognize that if absolute indemnification is required for tax purposes it is as well for voting rights because it protects both equally. the challenge is how to keep confirm the card is really held by the person holding it. pin numbers don't cut it
Or, better yet, eliminate payroll deductions entirely and ensure everyone has a liability come April. Pretty hard to defraud a liability.
Much easier to not pay a liability -- especially if it's a double-digit percentage of your annual income, and not just a small rounding error like it typically is today.
This is good from a rational point of view, but there's a large number of people who enjoy having large tax refunds because they perceive it as free money. I'm not defending that mindset, but it would be hard to get people to get over it.
> Or, better yet, eliminate payroll deductions entirely and ensure everyone has a liability come April.
Part of the reason we have payroll deductions in the first place is that the government understandably doesn't trust people to save up money to pay their income taxes every year; it's much easier to deduct roughly how much someone owes and then settle the difference every April and much more likely to end with the government getting somewhat close to how much it's owed.
I can't imagine how many people would have unpaid taxes each year, but it would be an insanely high number. I'm sure the tax relief assistance industry would love it, though.
If it treated SSNs as a username and required everyone to generate some unique passwords...it would work.
Since 2008 the IRS has required a security PIN code to e-file. It's not the most secure system in the world, but everyone needs to understand you can't just e-file someone's taxes by knowing their SSN.
That isn't a password and its basically available based on public information, just like a SSN.
The IRS created a system that is literally another username and called it a PIN.
The same information many people hand out as part of loan applications when they are asked for their tax returns as well as the IRS and other places. Hell, I had to do it in March and my AGI for 2014 is in god knows how many people's hands.
Once again, that is a username and not a password.
1) Passwords are secret credentials possessed by one trusted party, yourself.
2) The hashed representation of which is stored by the opposing party for verification.
You keep listing publicly available authentication factors which are effectively usernames, just like a SSN.
If you need me to clarify further, I can. I'm just genuinely horrified people treat these things as confidential because they are not.
I feel this is alot like my conversation here:
https://news.ycombinator.com/item?id=11447435
People, even IT professionals, seem genuinely ignorant of the fact this data is essentially public knowledge and it simply requires a small amount of [potentially illegal] effort to acquire. They then go and build authentication schemes based on this information on the assumption literally no one on the planet is a criminal.
That isn't "security" for anything that involving real money.