Hacker News Reader

Comment by dangus | Hacker News Reader

It also seems weird since the US government runs login.gov

Apparently login.gov doesn't have the right security process in place to meet the right CISA standard (paraphrasing).

So instead of funding it, we continue issuing 95% of maintenance funding each boxing round between showboating legislators issuing continuing resolutions.

Login.gov does not provide a sufficient level of identity assurance (IAL2 [1]) to serve as the IDP for this pilot and IRS functions in general (ID.me liveness check and facial recognition). IRS is working with Login.gov to upgrade Login.gov to deprecate ID.me for this purpose [2] [3].

Would it make sense to not proceed with this pilot until this was ready? Certainly not; Login.gov will catch up and meet IRS in the future as Direct File expands next filing season. Very similar to when Social Security Administration (ssa.gov) transitioned from ID.me and their internal IDP to Login.gov on September 18, 2021 [4].

(Login.gov partners with USPS to perform in person identity proofing for those who cannot perform remote proofing via a mobile device; a bar code is generated, which you print out or display on a mobile device for presentation to a USPS clerk with a government credential)

[1] https://pages.nist.gov/800-63-3-Implementation-Resources/63A...

[2] https://news.ycombinator.com/item?id=30430851

[3] https://fedscoop.com/irs-to-adopt-login-gov-as-user-authenti...

[4] https://faq.ssa.gov/en-US/Topic/article/KA-03217

Thank you, thank you, thank you for the info update! My understanding was clearly incomplete.

>Would it make sense to not proceed with this pilot until this was ready? Certainly not

Absolutely, yes.

Why? Iteration is something to be embraced rather than stigmatized in moving towards a more responsive set of government services. Login.gov is the future of government identity in the United States, but IAL2 is a higher bar than most government services need; waiting for IAL2 implementation is a tradeoff in favor of understandable-but-abstract risks against addressing a concrete harm that exists now.

You have an opt-out (use the existing methods of filing, including mail), and you're not harmed or even treated less preferentially by the existence of the ID.me option.

Because a US government service should not be outsourcing to a .me domain. I don't really care whether their internal service has IAL2, but it should be on .gov.

It’s just a domain name? It resolves to US based nameservers, the company is US based, with offices in the US, the founders are US citizens.

Would idme.com make you happy?

As much as I dislike Id.me, the domain name isn’t something to get upset at, it’s just branding…

I think parent comment assumes the DNS mapping is owned by the `.me` TLD owner, setting up an external contact that may or may not be hostile to owners of `.gov` TLD owner (the US), setting up a potential for nefarious activity.

"just a domain name" but MITM DNS attacks exist.

The government is putting citizens at risk by allowing a bad solution (ID.me) and wasting time supporting it that could be spent working on login.gov.

ID.me is already plugged in to IRS' platform, and is used today for all IRS account services to prevent fraud (return fraud being previously very prevalent [1], but there are other threat actor concerns with regards to IRS and identity). Throwing more people at Login.gov will not cause a solution to be arrived at tomorrow [2] [3]. It's suboptimal, but the world runs on duct tape, and a fix is underway. There is always risk, it is about managing that risk effectively.

Personally, I believe saving tens of billions of dollars in potential fraud costs every tax filing season buys a lot of tolerance to people complaining about the interim solution. The complaints are valid, but so are the attempts at fraud. And so, we balance the risk of the implementation.

[1] https://www.justice.gov/tax/stolen-identity-refund-fraud ("The IRS estimated that during the 2013 filing season alone, over 5 million tax returns were filed using stolen identities, claiming approximately $30 billion in refunds. The IRS was able to stop or recover over $24 billion of that total, or approximately 81% of the fraudulent claims.")

[2] https://en.wikipedia.org/wiki/The_Mythical_Man-Month

[3] https://en.wikipedia.org/wiki/Brooks%27s_law

(interviewed with a team that worked on fraud prevention at IRS as part of a US Digital Service interview)

Are they though (that much plugged in)? I have done quite a few iterations of IRS contacts, checking on returns, paying fees online, paying taxes online, etc over the past few years. Without yet having to deal with ID.me. Enough that at this point I would definitely do some work before giving in. So are they that prevalent really? Certainly NOT used for all account services.

ID.me is currently the only login/identity mechanism that can be used for handling business with the IRS online, although it is possible to file a return without an ID.me account. Paper filings, of course, require no online account.

https://cyberscoop.com/irs-facial-recognition-identity-priva...

https://www.cbsnews.com/news/irs-id-me-tax-file-2022/

https://www.irs.gov/newsroom/new-identity-verification-proce...

Oh I had heard of it, of course. And heard that it was being replaced / phased out - quite a while back. For a few years now. And still haven't had to deal with it once (for contacts, for filings other than tax returns, for fee and tax payments.) So I was only questioning "that much plugged in".

Federal workers are not project-fungible in such a way as to make what you suggest possible. And it's not just the federal government, either; ask any large corporation. There is no path to "well the IRS's developers should just go make Login.gov happen faster", even if you get a hall pass from the mythical man-month.

So, now that we've acknowledged reality--what now? Do nothing, while the active harm continues, because of fear of a hypothetical future (but with a limited time horizon) one?

Because if this works, the process of moving to login.gov might stall or be canceled altogether; there's nothing as permanent as a temporary solution.

I think the IRS should use login.gov, but there is a legitimate argument for them not doing so (not that I consider their choice responsible).

The argument is that for the tax system to work, collection should live in a silo: drug dealers should pay tax without fear of prosecution (except for tax evasion), etc. This is the same reason TSA (if its mission were to keep people safe) should not look for anything but threats: we don’t want drug smugglers to invest in concealment technology when they fly.

The downside of the IRS using login.gov is that it theoretically could make interagency data sharing easier. In practice, though, it would probably makes things more secure.

So how many drug dealers actually pay tax in the US?

This is essentially the purpose of money laundering, so a lot.

No, money laundering exists largely because we don't have that. They're talking about just declaring the income from selling drugs on tax filings.

Non-IRS authorities (e.g. FINCEN) can also track the flow so in the US money laundering is more to thwart them, though lower taxes is a bonus.

jwie has the argument slightly wrong. Taxes are a side benefit of money laundering, which makes it unnecessary to report drug income directly for taxes. Money laundering's purpose is to fabricate proof of legal income, to divert suspicion from the observable existence of wealth that has no legal explanation.

Sales tax, gas tax, etc. Just not income tax.

The entire US tax system is broken. I'm sure we'll get a VAT or something worse.

So much is broken I doubt we'll see a fix in our lifetime.

> In practice, though, it would probably makes things more secure.

Given the third-party doctrine, a third party commercial entity provides no additional checks or balances under current legal frameworks or theoretical future ones.

The IRS being accused of being criminal all the time doesn't gain any confidence running it's own user authentication through a foreign country instead of login.gov.

> The IRS being accused of being criminal all the time

What?? I read the news a lot and don’t see this.

I doubt login.me has any connection to Montenegro except for which registrars manage the domain name itself. This is not a defense of their choice of vendor.

Just one example:

https://www.msn.com/en-us/news/us/irs-committed-alarming-civ...

Ah yes, the “subcommittee on weaponizing government”, a credible, neutral group.

I do believe this was an issue (in fact suborned by FBI practices) in the 1960s against civil rights targets, but I haven’t seen any credible accusations since the Nixon era.

I can forgive you for not reading the article on the MSN spam site. Here's the original: https://www.nationalreview.com/news/irs-committed-alarming-c...

It's literally an investigation into the government weopanizing the IRS.

The IRS published documents you can view yourself to see their misdeeds. The IRS has since apologized and updated policy to curtail (but not eliminate) the authoritarian behavior.

You don't give yourself credibility by making up names.

> You don't give yourself credibility by making up names.

"Subcommittee on the Weaponization of the Federal Government", according to the article at your link, is literally the source. I made no name up.

My guess is they are incorporated there as a preemptive move against an "Experian hack" level event. Then all you have to sue is an offshore PO box.

> My guess is they are incorporated there

I don't think the correlation between domain-choice and legal-incorporation is strong enough to support that guess, much like how bit.ly probably isn't incorporated in Libya.

AFAICT ID.me is incorporated in the US state of Delaware, a popular choice due to its local laws.

That's a problem of Republicans making things up, though. Criminal accusations are apparently free speech.

The Biden admin literally sent an IRS agent to the house of a journalist at the same time he was testifying on capitol hill about government censorship online. The IRS has guns and police power. It wasn't a coincidence. They use it to intimidate people they don't like.

https://www.msn.com/en-us/news/us/irs-committed-alarming-civ...

Original publisher of article, not MSN cloakspam site:

https://www.nationalreview.com/news/irs-committed-alarming-c...

The Taibbi visit is certainly fishy. But knocking on his door to intimidate him when he's not there is weird tactic to be intentional.

That's not a problem of one party making things up. It's the fallacy of defective induction, aka. faulty generalization.

Are there cases where state institutions infringe on peoples' rights? Yes. Do they do it all the time? No.

Is Donald Trump a selfish liar? Yes. Are all Republicans selfish liars? No.

It's making me sad to see it here on HN so often.

Reply on news.ycombinator.com