Tell HN: IRS Forcing ID.me Logins | Hacker News Reader

Tell HN: IRS Forcing ID.me Logins

35 pointsarkadiyt9 comments

A year or so ago the IRS was starting to force people to use ID.me logins, a 3rd party service which collected your biometrics, instead of the existing login.gov login. The internet revolted and they relented for a while, but it seems like they made the switch afterall - you can now only login using ID.me.

View on HN

I do not know why the IRS is still using ID.me, but Login.gov does now have identity verification [1], so the IRS cannot claim anymore that a lack of identify verification with Login.gov is the reason why they only allow ID.me. I did the Login.gov identity verification process in March and it was quick and streamlined. It only took about 15 minutes and required photos of my driver's license and some additional information. Afterwards, when you log in to Login.gov, at the top of the page is a green checkmark with the label "Verified Account" confirming that your identity has been verified by Login.gov.

I should also note that some news media [2] have reported that the IRS is almost ready to start using Login.gov. This article is from March, and obviously the IRS did not start using Login.gov in the time frame described in the article. Again, I do not know why the IRS is still using ID.me, but the justification keeps getting weaker and weaker in my opinion.

[1] https://www.login.gov/help/verify-your-identity/overview/

[2] https://www.nextgov.com/it-modernization/2023/03/plans-appro...

This was the sticking point and why IRS adopting Login.gov was delayed. In short, ID.me's face scanning is what Login.gov was missing to provide strong identity assurance for IRS. I am not aware of how Login.gov intends to replicate this assurance.

> In particular, that report found that the General Services Administration had continued to bill agencies for Identity Assurance Level 2-complaint services, even though Login.gov did not meet IAL2 standards.

> Login.gov does not meet IAL2, which is an identity proofing requirement set by the National Institute of Standards and Technology as part of its SP 800-63 guidance series that provides crucial technical requirements and guidance for identity proofing by government IT systems on open networks.

https://fedscoop.com/internal-revenue-service-to-expand-use-...

NIST SP 800-63 IAL2 Remote Identity Proofing

https://pages.nist.gov/800-63-3-Implementation-Resources/63A...

Interesting, I was unaware of these standards. It seems that different agencies want different things, since the existing identity verification by Login.gov was good enough for one federal agency but not good enough for the IRS. The federal government is not monolithic.

ID.me didn't meet any face scanning requirement either. It was a pure scam the time I had to try to use it. Rejected me and my perfectly scanned passport and I had to wait in a digital queue for a real person to look at my face through the webcam.

https://www.id.me/business/identity-verification

> ID.me uses liveness detection and advanced machine learning technologies to determine match between applicant’s image on their government identity document and the applicant’s image on their selfie.

They can say that they do, just like Theranos said they can tell if you have cancer from one drop of blood. It's all smoke and mirrors and depends on actual people to do the verification not some imaginary AI. At least that was my experience from the 2 hours I spent trying to verify myself with them.

Yikes... login.gov is such a well-made piece of software in my experience, it's a shame the IRS is using something from the private sector. The GSA makes some surprisingly good tech for being a part of the federal government.

I believe login.gov was made by 18F, a highly specialized group of hackers. Yes they technically are out of GSA but their individual backgrounds are no joke. Check out their GitHub https://github.com/18F

Well, I will no longer be using their web site, I guess. I’m simply not going to hand over my information to ID.me.

Reply on news.ycombinator.com