undefined | Better HN

0 pointstomrod2y ago0 comments

Apparently login.gov doesn't have the right security process in place to meet the right CISA standard (paraphrasing).

So instead of funding it, we continue issuing 95% of maintenance funding each boxing round between showboating legislators issuing continuing resolutions.

0 comments

4 comments · 1 top-level

toomuchtodo2y ago· 3 in thread

Login.gov does not provide a sufficient level of identity assurance (IAL2 [1]) to serve as the IDP for this pilot and IRS functions in general (ID.me liveness check and facial recognition). IRS is working with Login.gov to upgrade Login.gov to deprecate ID.me for this purpose [2] [3].

Would it make sense to not proceed with this pilot until this was ready? Certainly not; Login.gov will catch up and meet IRS in the future as Direct File expands next filing season. Very similar to when Social Security Administration (ssa.gov) transitioned from ID.me and their internal IDP to Login.gov on September 18, 2021 [4].

(Login.gov partners with USPS to perform in person identity proofing for those who cannot perform remote proofing via a mobile device; a bar code is generated, which you print out or display on a mobile device for presentation to a USPS clerk with a government credential)

[1] https://pages.nist.gov/800-63-3-Implementation-Resources/63A...

[2] https://news.ycombinator.com/item?id=30430851

[3] https://fedscoop.com/irs-to-adopt-login-gov-as-user-authenti...

[4] https://faq.ssa.gov/en-US/Topic/article/KA-03217

thfuran2y ago

>Would it make sense to not proceed with this pilot until this was ready? Certainly not

Absolutely, yes.

eropple2y ago

Why? Iteration is something to be embraced rather than stigmatized in moving towards a more responsive set of government services. Login.gov is the future of government identity in the United States, but IAL2 is a higher bar than most government services need; waiting for IAL2 implementation is a tradeoff in favor of understandable-but-abstract risks against addressing a concrete harm that exists now.

You have an opt-out (use the existing methods of filing, including mail), and you're not harmed or even treated less preferentially by the existence of the ID.me option.

3 more replies

tomrodOP2y ago

Thank you, thank you, thank you for the info update! My understanding was clearly incomplete.

j / k navigate · click thread line to collapse