IRS to ditch biometric requirement for online access
krebsonsecurity.com
krebsonsecurity.com
Treasury reconsiders IRS’s use of ID.me face recognition for web - https://news.ycombinator.com/item?id=30126118 - Jan 2022 (121 comments)
IRS Will Require Facial Recognition Scans to Access Your Taxes - https://news.ycombinator.com/item?id=30011145 - Jan 2022 (20 comments)
IRS Will Soon Require Selfies for Online Access - https://news.ycombinator.com/item?id=29996614 - Jan 2022 (428 comments)
not great!
Login.gov is a fine authentication service, but cannot deliver the identity assurance level (IAL-2) required to identify people. (It may not be able to deliver AAL-2 authentication soon either as standard evolve.) Uploading a picture of your drivers license is not a meaningful validation of your identity.
The reaction of the Senators here is the equivalent of “I’m shocked to hear there is gambling happening here”. Typical pandering. Literally every drivers license and ID in the country is running through a biometric identity provider run by a contractor to identity duplicate licenses. Many DMVs outsource credential production to a third party.
I don’t think ID.me is the best solution, but it is better than providing a trivially stolen number “what was your AGI last year” that facilitates billions of dollars of fraud annually.
The government that oversees the issuing of these IDs and attests that they are sufficient for government use (Real ID) cannot themselves validate said ID?
Corruption or incompetence are the only paths that lead to outsourcing federal identity verification.
The problem is that any bartender who has scanned your drivers license has the information required to scam an online validation without some other validation.
If you want good online validation for the public, you need a third party right now. In the future, in some states, you’ll be able to use a mobile drivers license, provided you own a smartphone. Also problematic, as the government has to support everyone. Foreign nationals pay tax. People in nursing homes who cannot appear before a DMV need to pay taxes.
You can yak about corruption and incompetence, but that honestly attests to ignorance on the topic.
This is a call to enhance Login.gov’s identity abilities, and US government citizen identity management in general. Login.gov (and perhaps USPS for in person proofing) should be funded to do this, not ID.me. Higher level, this is about building strong public goods and defending them.
I 100% agree. Problem is, the federal government (and the state governments and to a large extent big chunks of the citizenry) are fundamentally opposed to the issuance of a non-passport general citizen's ID and/or number. Those opposed to it don't have any good solution to "how to protect information the government keeps about you" either, so it's no good asking them.
Devising an actual public system for identity verification when you're being told the government cannot identify people is ... challenging.
I wonder if this mightn't change with states increasingly requiring voter ID.
After all, it'd be pretty dumb to on one hand mandate that every voter have government-issued ID, and on the other to oppose it.
It's not dumb, it's just evil.
As another poster mentioned, the problem is that both progressive and conservative constituencies are strongly against meaningful national identity for different reasons, some of which are insane.
It’s a policy problem that won’t be solved in our lifetime. Our best bet long term is for states to issue mobile credentials, but even that is problematic because it will disenfranchise people.
Private companies have been part of the government discharging its responsibilities since first days of the Republic. You'd probably be shocked when you learn who does credit monitoring after government servers get hacked, by the way.
By your logic the government couldn't use cloud computing (run by a private company), couldn't use computer hardware even if they wanted to run a private cloud (hardware is built by private companies).
In all reality, this is fine. I have no particular problem with using facial recognition, but I want it regulated and I want recourse.
Fine, outsource it to ID.me. But the terms of service better be a page, maximum, and include the ability for me to appeal a decision that says I am not who I say I am and to use other forms of validation that may be slower or more procedural (such as presenting myself to a Post Office). I want no binding arbitration clause in the agreement, and if that means the Federal government has to indemnify ID.me, then so be it. I want it in the TOS that the data ID.me uses for this will be segregated and kept for a very limited time and that I have the right to review and correct it.
Use the third party for what they are good for but enforce suitable rights for the rest. This is doable, it just wasn't fully done here.
I should not under any circumstances need to enter into a direct agreement with a private entity like id.me in order to access public services. The government might reasonably subcontract out some of the work, but public services need public accountability. The government service itself needs to be the direct counterparty to the public.
Just wanted to point out that there are lots and lots of federal IDs that are not military, immigration, or passports.
Like no, I don't trust the government to protect the big bucket of PII on everyone in digital form. Not because of lizard people but because the government can barely keep it's own sites secure. Giving them more dangerous data in the form of bulk PII is the wrong move.
Login.gov was the first thing, in a long time, that was well executed. I need to see more things like that to restore my faith. ID.me is the wrong direction.
I do agree ID.me is the wrong approach. And login.gov should be used in some form over a private enterprise. But, my concern is two-fold… it’s a private entity that I don’t really want to do business with. And the process described by Krebs was impossible - can we really expect everybody to have email, valid phone (what if they aren’t the account owner for the phone), photo ID, and whatever else was required?
On a similar note, I don't have a lot of documents tied to my name, so I had nothing that they wanted when my photo verification didn't work for whatever reason. Pretty sure I just never solved that one and left the last couple weeks I would have gotten unemployment on the table.
GSA has really upped the game over the past 10 years for digital services delivery. Such as Login.gov. Look for other places 18F/USDS are involved, and you'll see significant improvements.
"Here is a list of every Jewish person in this zipcode with their home address..."
If that is going to happen in the US it is probably going to be a red/blue culture war thing. Shall we eliminate campaign finance transparency?
When the Ashley Madison hack happened a whole mess of blackmail was the result.
I have had someone target me in an attempt of blackmail due to a forum breach (why they thought an anime forum was good blackmail beats me...)
Your browsing habits, which is a step removed from PII, even reveals your sexuality and pregnancy status.
And, we had an attack on Jewish people in the last month. We have not had anyone Democrat/Republican hunting.
Real ID validates that you are the person you are at the time of issuance, but does not guarantee that the possessor of the ID is that person. This stems from the fact that an ID is "something you have". Like any secure system, you should use multifactor authentication. The facial scan is "something you are", so the combination of ID and scan provides that. One might also use "something you know", such as your adjusted gross income (AGI) that the IRS used before.
I would also propose finding ways to drastically reduce the cost of issuing smart passport cards, and slowly transforming that into a national ID over time as the electorate composition changes. Your passport number eventually becomes your national ID number.
The IRS can't do identity proofing (hence the need for ID.me, which is implementing "remote or in-person identity proofing"), and login.gov doesn't do it for the agency. Login.gov can only record whether the identity was created at IAL-1 or IAL-2.
Use of login.gov is orthogonal to the question of ID.me.
We've also had problems getting login.gov to proof new users with national but not state IDs. For example, we have someone with a passport but no driver's license. They should be able to use just the passport for identity proofing since the passport itself requires two or more forms of SUPERIOR/STRONG evidence (per NIST SP 800-63-3), but login.gov must not authenticate the passport with the State Department, meaning it fails 800-63A 4.4.1.2 (evidence collection requirements) rule 1 and must implement rule 2, instead (collect two pieces of STRONG evidence, i.e., national _and_ state IDs both). It's really frustrating because I cannot demand my users go out and get (pay for) state IDs they don't otherwise want or need.
All that said, even though login.gov isn't perfect, I do like it and am very impressed with 18F/TTS's work. They've done a very thorough job with their SAML implementation compared to the ADFSes/Oktas/Pings/etc. of the world.
Scanned my Driver's License at 200dpi.
"Unable to find a face in the image you uploaded."
Okay, 300dpi.
"Unable to find a face in the image you uploaded."
Huh.
Scan at 72dpi.
Success.
Scan back of DL at 72dpi.
"Unable to read barcode."
Scan back of DL at 200dpi.
"Unable to read barcode."
Scan at 300dpi.
Success.
What a shitshow.
1. https://www.propublica.org/article/inside-turbotax-20-year-f... 2. https://www.nytimes.com/2021/07/19/opinion/intuit-turbotax-f...
Anyhow, the better alternative is to return to lower the rates and remove deductions (aside from the standard deduction). Even simpler yet would be to go to a flat tax with an extremely high standard deduction (e.g. ~$50k with ~10% after that).
I can't think of many good reasons to continue complicating the IRS code aside from political targeting and giving Congress more kickbacks.
Ongoing software projects require periodic refactoring to reduce complexity and increase comprehension - why would the law be any different?
Having citizens exposed directly to the mechanics of it during the filing process is a policy choice and the way to fix that is to change the policy, not try to reinvent the tax code from first principles.
This is a complex set of laws yes but it is also detailed multi-generational documentation of all the shit people have tried to pull. You don't just throw that out because it has grown complex. Like all necessary complexity, you isolate and manage it, not spray it all over the end user.
The IRS has no way to know which of your expenditures are tax-deductible.
A whole lot of preparing a tax return is plugging in numbers from forms that are sent to you and the IRS. It would be simpler (but perhaps less timely) if the IRS sent the taxpayer the return and if you disagreed, you could send in an ammended form with any documentation, or just pay the bill/cash the check.
Pretending the IRS "knows exactly what you owe and could just tell you" is just as disingenuous. In both cases, it's more complicated than that.
This is true often, but not always. Examples just off the top of my head:
* Had large medical bills compared to your AGI? How does the IRS know that?
* Paid for college tuition? How does the IRS know that?
* Deducting state sales taxes? How does the IRS know what those were for you?
* Paid for daycare? How does the IRS know how much?
I'm sure I could find more examples if I went and looked at the actual tax forms right now. And while these are all things that don't affect everyone every year, they do affect a large fraction of people at some point in their lives. They certainly affect everyone who pays for college or has kids.
Note that this is not getting into anything too esoteric here, and completely ignoring anything involving self-employment or consulting, or running a small business or whatever. I _think_ those are rarer than having kids anyway.
Now could we have a more streamlined filing process that did the easy bits when possible and asked more directed questions to find out whether people might be in edge cases that might need more handholding or professional help? Absolutely. Could we get rid of the edge cases I listed above with a simpler tax code? Perhaps.
That said, neither daycare nor college tuition are itemized deductions. You can take the standard deduction and get credits/deductions for those at the same time.
Or the EITC: That one depends on who lived with you during the year, which the IRS also does not know. But it could ask that one question and then compute it for you...
Handling of stock transactions is the _easy_ case here, assuming the brokerages correctly track basis, because they already report all the relevant info to the IRS.
> I’m willing to wager that for the vast majority of U. S. residents for the vast majority of their lives, their deductions will not exceed the standard deduction.
That is a very sure bet, but not that relevant to whether the IRS can compute one's taxes because our tax code as currently structured has a bunch of credits and deductions that are not part of Schedule A that matter to quite a number of people.
To put numbers to this, per https://www.eitc.irs.gov/eitc-central/statistics-for-tax-ret... in 2020 25 million tax returns had EITC. Per https://www.irs.gov/statistics/returns-filed-taxes-collected... in that same year there were about 150 million total "individual, estate, and trust" tax returns. So at least 1/6 of individual tax returns (more to the extent that trusts exist) could not have been correctly done with the information the IRS has.
And as I said, the vast majority of people who paid for child care would need to correct whatever number the IRS came up with for that.
Now I agree there are lots of people (healthy retirees, young college grads with no kids) who probably _could_ have their taxes done by the IRS entirely. And I'm all in favor of that happening, as long as we're clear that this is not going to reach everyone, and will generally benefit the people who are in the best position to navigate the current system already....
Which brings us back to reducing the underlying complexity, so the IRS could handle more cases itself.
I must admit I've always sort of blindly believed the same thing, but here I am year after year accumulating and submitting my own absurd set of turbo-tax button smashes.
Honestly I have trouble figuring out how much I owe myself. I would believe that they have some core set of data linked to my SSN, and every time I submit they run some sort of markov-chain statistical model that says - "meh, looks pretty close. No need for further review. Please pay the refund to the latest identity scam." or "red flag for actual review".
100% chance the IRS is understaffed, running legacy spaghetti, managed by folks just trying not to be the next scape-goat so they can go home to their family and watch the next episode of what everyone at work is talking about.
Who says that complexity is necessary?
Most of that complexity just grew out of other complexity.
If you have a simpler tax code to begin with, you don't need to patch all the work-arounds people found.
Of course, that's much easier said that politically done. Simpler taxes are popular as an idea, but rarely when you get into the specifics.
I've never heard this claimed before; I'm interested to see your evidence, because it's also not obviously true.
> Glossing over this, and instead trumpeting some canard like number of pages, or number or words, is simply a rhetorical device to mask different objective.
There's no "glossing over" - it's pretty clear that even though there are "a lot" of special cases, that there are reasonable (and unreasonable) amounts of complexity of the tax code relative to the distribution of circumstances. It sure sounds like you have another objective that you're masking yourself.
Do I care about the ins and outs of alimony and child support? Nope! I am not divorced.
Do I care about the ins and outs of how to deprecate the cost of my car as a business expense? Nope! I’m not self-employed.
How about foreign investment income? Nope!
How about income from farms? Oil wells on government land? Military income while serving overseas? Nope! Nope! Nope!
Do I care about the Earned Income Tax Credit? Yup! Do I understand it? Nope! Has the IRS sent me a letter after I filed saying that I qualified for the EIC, and they amended my 1040 to claim it? Yup!
The point is, if the special cases aren’t applicable, it’s the same as if they don’t exist.
Why do you care about inapplicable parts of the tax code?
Let’s be honest here. Most people have a W2, and that’s pretty much it. If they have a mortgage, their lender has already submitted a 1090 on their behalf. That’s it. You spend your day literally just copying numbers from forms and then subtracting. There’s no point to a person doing this.
Isn't this the fantasy of clean sheet software? 'We'll get rid of all this cruft and make it clean and simple.' But it turns out that the cruft is needed to deal with reality, which is messy rather than the abstract clean-room requirements of our imaginations.
I can't see how the tax code can be short, having to deal with such a wide range of situations. Has anyone every successfully used a tax code like the short, simple ones that people fantasize about?
The fantasy is that the software can be made completely clean and simple because there are no edge cases. The reality is that it can be made less terrible by reworking complex parts of the design that were slowly hacked into place over time, and by eliminating technical debt. The fact that the ideal is unobtainable is irrelevant to the fact that there are still concrete, worthwhile, and necessary improvements to be made.
If your perspective on taxes were applied to software engineering, then most large projects would have collapsed by now.
> I can't see how the tax code can be short, having to deal with such a wide range of situations.
Not "short", but short-er than the 74,000 pages that it currently is. And, it's already dealing with a wide range of situations by simply compressing the feature-space down a lot, so one way of making it simpler is to compress it down even more. For instance, you could eliminate a bunch of individual rules that reduce effective taxes for low-income earners, and then just reduce the tax rate at that bracket.
> If it was priority for the Dems, they'd have done it.
Easily said, but as we know, not easily done.
https://www.opensecrets.org/political-action-committees-pacs...
Seems like the donations are pretty evenly split for the companies that would be the largest lobbies over the past several years. This seems like the case of the uniparty being apparent, where there's no real drive to simplify the tax code because it's something both can blame each other on when nothing is done. Of course, this was the entire point of the TEA Party (which later became manifested as MAGA), which was mainly a conservative movement, so it manifested inside the GOP, but the GOP RINOs in Congress did nothing.
He also did that before the Dems took back the House, so he had the GOP sign on to it.
Tax codes are a tool of policy makers. They allow wealth and income distribution. They allow compensation. And they allow policy makers to promote or penalize specific behaviors or activities.
Look at the legal system as a code base (in French, 'law' translates to 'code'). And imagine having 538 product owners, each asking for 'just one feature' that is both 'critical and urgent'. Is it any wonder that we are in this situation?
Perhaps we should implement more sunset provisions? I don't know. But 'we need a simpler system' is sort of like 'we have too many LoC'. It's true, but not easily actionable.
Therein the problem lies.
>They allow wealth and income distribution. They allow compensation. And they allow policy makers to promote or penalize specific behaviors or activities.
Robbing Peter to pay Paul is not a good reason to tax. Taxation should be decided by the whims of a crab bucket.
>Look at the legal system as a code base (in French, 'law' translates to 'code'). And imagine having 538 product owners, each asking for 'just one feature' that is both 'critical and urgent'. Is it any wonder that we are in this situation?
We're in this situation because most of congressmen believe they have the right to impose their morals on and the expense of thst individual men and women by way of legislative fiat.
>Perhaps we should implement more sunset provisions? I don't know. But 'we need a simpler system' is sort of like 'we have too many LoC'. It's true, but not easily actionable.
It is actionable. Politicians, however, are usually ignorant of tax law until there comes a point where the "wrong" people "win" too much. That is the issue in what should mostly be an administrative affair, if it should at all occur. The people who complicate the tax do not code lack the wherewithal to simplify it. Their feigned weakness and indifference is a choice.
The IRS collects tax information from most businesses with employees, banks and investment firms, so it's is comically easy to pre-load that information in a tax return. Ask a few simple questions (did you buy a house, did you start a business, do you have a new dependent). Pre-fill what you can. Generate a report which you can directly file or share with your tax expert. Many developed countries do this.
While this (correctly) tanks an entire industry of tax preparation software, it actually makes it easier for politicians to do their thing. Right now a tax break for X is buried under form 92921X2 which you learn about after reading the instructions for line 48 on schedule 8812 which you are filling in after being told to in the supplementary instructions for line 21 on your 1099. If you elected to use the alternative streamlined maximum option, of course, if you chose for the default minimum compensation model, well, those are different forms.
With a properly made simple official tax filing process, you just see you got an extra $400 back this year because of the tax break for X.
That's not a flat tax. That is a progressive tax with two brackets.
Once you have accepted that progressive taxes are acceptable, it is hard to see why two brackets is better than three, or 4, or even dozens. One might argue that two brackets is simpler than say 10 brackets, but that is a very weak argument since it is just a table lookup, and nobody can argue with a straight face that a 10 line table is too complicated.
An interesting exercise is to consider what it would be like if instead of a single tax to cover everything funded by income tax we did a two bracket progressive tax for each budget item separately, with the taxes applied serially. By applied serially I mean that the taxable income for tax N+1 is what is left after you have paid tax N.
You then end up with a progressive tax with N+1 brackets where N are the number of budget items (and then you would have a table big enough that it would arguable be complicated!). If you keep the same total budget but divide the budget items into smaller subitems, your tax curve approaches a continuous curve which represents a progressive tax with an infinite number of infinitely small brackets.
I remember working out the equation for that curve once, and finding the result mathematically satisfying, but I've totally forgotten what it was.
First, I don't think anyone should pay taxes on their labor. And just because my labor makes more shouldn't mean I pay a higher percentage; so, no, I don't agree with the concept of progressive taxation on labor. Regardless, that's what we have.
Anyway, 10% after $50,000 is dead simple. e.g. make $120,000 as a family, take away $100,000, left with $20,000, I pay $2,000. Real tax rate is only 1.6%, so maybe that's too nice for the American family? You can change it to 15% after $25,000 and it's still simpler. $120k-$50k=$70k x .15=$10.5k or 8.75% real tax rate, all without worrying about IRAs, 401ks, HSAs, etc.
With a 6-12 tax brackets with crazy amount of deductions, I need to:
1) calculate taxable income. This is some func of deductions. i.e. standard deduction ($25k) + max 401k ($20k) brings taxable income to $75,000. There's other deductions such as IRAs, HSAs, 529, etc; all with their own maxes based on various criterias and income, which has it's own list of gotchas that screw over people. Hopefully you didn't forget a deduction on top of all that.
2) Now determine tax rate. 22%. Feels bad, but whatever -nearly a quarter of your income (nominally, at least) to finance the debt to keep inflation going. The graph says ~$4,800+22% of anything over ~$42,000. Alright. So $4,800+(22% x $33,000)=$12,060 are taxes owed.
3) Now determine your credits, if any. Such as a child credit. I hope you know your credits, because you might've forgot about a tax credit for something you bought. Let's assume you know you get $3600 for a toddler, and put that in. Now your $12,000 is $8,400.
4) Ensure your paid taxes is correct. You paid throughout the year, adds up to ~$8000. So taxes due are now $400.
5) Now you go to pay $400. Welp. Now you need to pay $50 because you decided you wanted to buy a stock that gave you $10 in dividends in a brokerage account, and now you can no longer free file. But you don't want to be audited, so you report the $10 and pay the $50.
Yeah, that's very simple and straight forward. But good news is the actual tax rate is actually only 7%, even though you felt like you just paid nearly 22%, wasted hours of your life, and were insulted with an additional fee just to pay your taxes.
None of your steps are made more complicated by more brackets or less complicated by fewer brackets. You determine your taxable income (the complicated part), then lookup that taxable income in the tax tables (simple).
If the taxable income is low enough, there is a table with a large number of entries that each cover a small enough range that you don't even have to do any computation. You just find the line that covers your taxable income and the table tells you the tax.
If your income is too high for that table you have to use a smaller table with entries that cover larger ranges. That table currently has 4 entries. You find the row whose range includes your taxable income, and calculating your tax involves a multiplication and a subtraction--which is just as much work as calculating your tax under your proposed two bracket system for people whose income is high enough to be in the second bracket.
This is the part where I start yawning
AOC introduced a resolution (text here: https://www.congress.gov/bill/116th-congress/house-resolutio...) which if passed, would have basically just affirmed (in a non-binding way) the interest of the house to create a "Green New Deal". The actual legislation itself would, if the house agreed to do so, need to then be created, debated, and voted on before being passed.
"House resolutions are not binding law, but rather express the collective sentiment of the House on a particular issue, person, or event."
The actual resolution itself is pretty short, and I find most of the statements and goals in it pretty tame and agreeable. But again, it is not as if this resolution being passed means that all of those things necessarily must end up in the actual Green New Deal to be passed or even that it gets created at all.
Could you elaborate on how this would destroy the middle class? I might have missed something but there was never even any policy proposed, because the Green New Deal was never created to be voted on. I don't understand how you can make an evaluation like that without examining the actual policies to go into effect.
The “New Deal” saved the middle class. A “green” new deal could do it again.
We have an incredible need and opportunity to (re)build infrastructure in this country. That’s where the middle class can thrive.
The green new deal was an olive branch as much as anything. An opportunity for everyone to make a needed contribution and be compensated for it.
- assume my "filters" are wrong. A difference of opinions doesn't mean my filters are wrong. It simply means I made different conclusions. If you want to support AOC and her policies, go for it. I won't partake.
- believe I'm in a bubble. Right. That's why I'm on HN; because I'm in a bubble and you think exactly as I do?
- Now I believe in a flat earth. That's just a wasted comment.
- Pointing to the "New Deal" that "saved the middle class". It's highly debatable if the New Deal prolonged the Great Depression or not. While it helped many Americans keep food on the table, no doubt, it didn't stop the Great Depression. Regardless, I can turn around and say, I want the "____ New Deal", and it must be good because that's what I called it? That's a laughable concept.
By your measure, healthcare actually became more affordable after the Affordable Healthcare Act became law - because that's the title of the law?
Regardless, I agree that the infrastructure can be improved. My state is already doing it. They've rebuilt an interchange in record time because a bridge wall collapsed. What is your state doing?
Stating that everyone should have access to "high-quality health care" or "economic security" isn't an olive branch. Obviously no one disagrees with that. The discussion is "how", and that's the only important discussion to have.
But, if you want to stick with mudslinging and belittling those who disagree with you, go for it.
But you’re right, there are a few left that seem to be fighting for the people. Some are effective and others are naive but well meaning.
But they are clearly the minority. They’re fighting bombastic partisan media coverage on both sides, they’re often fighting people within their parties, they’re often struggling just to earn their place.
At first, you get excited at the prospect of holding police accountable when Rand Paul introduces laws against knockless warrants, or you hope for the prospect of a real, sustainable income plan from Yang or Gabbard.
And then you watch as they get maligned and lied about on Fox News and CNN alike. You think, “this plan they’re advocating for will surely attract support from the rest of their party” and then you watch in awe as both sides warp, twist, or outright attack their plans.
You watch with weary eyes as someone like AOC who appears to come from the outside with a background similar to your own gets taken in by people like Pelosi, and you hope against the odds that she will remain true to her ideals, but you know that so many before her did not. After all, at one point Pelosi herself was fighting for the freedom of the internet, yet look at her now.
At some point, you get tired of putting hope into the good ones. You get frustrated every time they seem to make progress only to be struck down. You get sick of seeing them naively fall for the notion that their colleagues are as genuine as they are.
At some point, you just find it easier, both for the sake of conversation but also your own peace of mind, to wrap it all up into the same package of “they’re all bad” and just stop wasting your emotional energy on it.
Or maybe that’s just me.
Literally, what I do for Norwegian taxes:
1. Get a letter stating that they've calculated last years' taxes. 2. Look at the tax authority's website and as long as things are correct, I don't have to do anything else, though I can click a conform button. (I usually do) 3. Wait for refund - IIRC, they pay out in summertime. Or alternatively, pay tax if you owe.
You get the choice of doing it yourself and filing differently and stuff, but I don't see the point.
If they made the data available to you, an open source program could take it and spit out your tax forms. The existence of commercial alternatives wouldn't hurt this workflow one bit.
Of course, the problem seems to be that those commercial alternatives come with considerable lobbying to make access hard. And from what I've heard, US taxes are so complicated, that it's hard to do them right.
1. It doesn't make it obvious on how to add additional u2f keys (you have to go to login.gov explicitly to do that)
2. I still can't find a way to remove u2f keys
But then when I used id.me with CA DMV I'm also impressed by it (granted CA DMV does not require any crazy biometric stuff there like IRS planned to do).
When I go to login.gov and click on "Your authentication methods", each of my security keys is listed with a "Remove key" link next to it...
Here in France, some people from the anti-nazi resistance from the 40s later got into heated arguments about the national ID card, which had been made mandatory by the collaborationist regime. The idea is that if there were reliable/secure unique identifiers during WWII, the resistance movement could not have existed at all, and could not have saved countless lives.
To this day, France is one of the rare countries where it's perfectly legal to walk anywhere without any identifying document with you. This doesn't mean that you won't be harassed by fascist cops though, depending on what you look like.
I'm pretty much against fraud in the common sense of the word. But the biggest frauds are done by the rich and don't require to make up new identities. They're hidden in plain sight with lawyers and contracts with offshore corporations. I personally couldn't care that social services fraud costs the government some millions every year, when tax evasion and corrupt-government contracts (remember the Pentagon audit?) account for literally trillions going missing and nobody in government wants to do anything about that.
Onward to yeeting ID.me from state and local government next [2].
[1] “The IRS will also continue to work with its cross-government partners to develop authentication methods that protect taxpayer data and ensure broad access to online tools.” (From IRS’ press release on the topic in a sibling comment)
[2] https://www.gsa.gov/blog/2021/02/18/logingov-to-provide-auth...
https://www.lawfareblog.com/why-opm-hack-far-worse-you-imagi...
Oh, and the IRS has already been breached at least once. I'm not wild about waiting for the next one. Maybe government is not the best group to be holding your personal data.
https://www.nytimes.com/2015/05/27/business/breach-exposes-i...
The solution to government breaches is what it's always been: to make the breached data less valuable. Hacking the IRS would be significantly less appealing if we criminalized corporate use of SSNs as credentials.
However, this isn't to say that someone doesn't get the bright idea that they could fund some sort of slush fund with this.
what type of recourse are you talking about? Voting your representatives out?
The pattern I see is:
1. Company collects and stores private consumer info.
2. Company gets hacked.
3. Company share price unaffected.
4. Company sued in class-action lawsuit.
5. Company settles by offering discounted/free products to victims of the hack. ("A $50 value!") Lawyers make a few million.
Result: company gets more users' info as they sign up to claim the discounted products.
Sounds like a good deal if the company is too big to fail.
I don't know why Equifax is too big to fail. But then again, I don't know why Goldman Sachs was too big to fail either.
But, yes, they provide a service. And? There are two other major players who didn't fuck up who supply the same service.
If you got hired for any job worth doing at any point in the last decade, chances are high that among the various background checks, your employer also ran a credit check on you.
> a bail bondsman thing
Why wouldn't a bail bondsman care about your credit history?
Hopefully id.me will get booted from other government agencies as well.
It's the most difficult login process I've ever encountered and I've lived on the internet since 1996.
The fact that it's the only vendor you can use should be illegal.
This barrier has been put between Oregonians and the unemployment benefits they're entitled to. <- This is a bigger story IMHO.
The killer? This morning I woke up to spam emails from ID.me offering me a discount on my first blue apron meal order.
Where I am in the Netherlands there is a government-issued digital ID (DigID), that was very straightforward to sign up for and easy to use.
Great news for everyone here. I still don't know how this provider was actually selected, but at least this change came relatively quickly.
And now for some contradictory information, straight from id.me, which may indicate it's a lost cause.
On that page it says:
"What happens to my deleted account? Your account information is purged. After seven days, you can create a new ID.me account with the same email address you used in the one that was deleted."
However, when following that exact process on the site, it states:
"If you decide to create a new ID.me account (at any point in the future), you will not be allowed to use the email address(es) lined to your previous account."
Both locations state:
"ID.me will retain a portion of your account's attributes on file to comply with applicable laws and help us prevent fraud."
Here's my two cents.
I'm the founder of a biometric users identity check solution, called Typing AI Biometrics ( https://typing.ai ). We identify users by the way they type. Typing biometrics can be used as a two factor (2FA) or multi factor (MFA) authentication method.
Instead of combining the usual username + password with an OTP code that you recive on your smartphone or email, you can combine the basic username + password with a typing pattern check, it's much more secure and efficient. The typing signature translated into a 300+ encrypted characters hash, which is (up until now) impossible to break.
You can even remove the username + password and combine the typing biometrics check (known as keystroke dynamics) with an OTP verification. Biometrics are the future of authentication and authorization, because they are unique to each person, but only with the promise of not keeping and sharing the users data.
You can AMA on this Show HN thread: https://news.ycombinator.com/item?id=30130447
If I set up an account while I'm still waking up, and then try to use it after lunch and coffee, wouldn't I get locked out due to inputting faster than expected?
Or what if I'm on the phone with someone, and trying to type with one hand? That would probably lock me out, right?
Your "one-hand" typing is totally different than writing with two hands but we also got this covered. The authenticity detection rate won't be over 90%, but it will still be over 80%.
In case of using the Typing AI as a two factor auth method, you can just skip to using a different factor, such as fingerprint/face recognition or OTP.
You have just described the case where your typing pattern is changed. In this case you'll have to just login to your account and update the signature or remove it and create a new one.
In the case of having an accident, you will be able to login into Typing AI and update your signature.
"Or what if I'm on the phone with someone, and trying to type with one hand? That would probably lock me out, right? " - good question. Your "one-hand" typing is totally different than writing with two hands but we also got this covered. The authenticity detection rate won't be over 90%, but it will still be over 80%.
It isn't much of a stretch for me to think of 4 scenarios: 1. Laptop keyboard, 2 hands 2. Laptop, 1 hand 3. External keyboard (let's pretend I'm using only one out of my collection) 4. External with one hand
We are adding new cases to our algorithm almost weekly, the typing detection keeps getting better.
the core of the thought is -- if the government interaction is flawed such that it is not actually doing only what it says it is doing, to the detriment of most ordinary people, and is subject to insider gaming with rewards to do so THEN additional and perhaps draconian requirements on the ordinary individual, do not solve the flaws, burden and antagonize an ordinary person, and the implementation becomes a new attention target WITH new penalties attached, for the ordinary person. hth
--
American here
"perhaps better known as the online identity verification service that many states now use to help staunch the loss of billions of dollars in unemployment insurance and pandemic assistance stolen each year by identity thieves"
In the great State of California, billions in unemployment benefits were sent to the wrong people.. because their internal systems were designed to delay, deny and deprive, I say. Actual people with real jobs were repeatedly refused, while insiders who knew how to fill out paperwork, and apparently knew where the blind spots were, filed hundreds of claims in the early pandemic days. A newly appointed Director (young, tech savvy woman) soon stopped making public statements, and the situation nearly two years later, is not resolved. This is at a time when California has record income to the State.
Now, some people may jump on this and say "well, you see how photo ID would have helped that" and, with incomplete knowledge and personal opinion, I say no, it would not solve it. You see, people with real jobs, with every real paper filed, were denied benefits, while insiders were pulling checks with both hands, using certain kinds of identities that would slip through. How would ever more restriction, requirement and verification, have helped here?
I am deeply against the collective government making ever more demands on citizens for "papers, please" enrollment to massive money social services (edit e.g. govt unemployment benefits). It is not going to have the desired effect, despite superficial evidence otherwise. Additionally this represents a slippery slope where the ability to interact as an individual will be eroded, and opportunity for insider graft will increase
Damn those anti-chippers!
https://www.propublica.org/article/filing-taxes-could-be-fre...
Taxes for Expats or Expatfile. The first has more options for having a CPA. The second is self-serve.
If you don't mind me asking: how does managing your financial accounts work where you are? Do you still maintain USA bank/investment/retirements accounts (via mail forwarding?) or do you have them open in your country? What types of hurdles do you run into?
* Checks are considered an arcane and insecure technology from the stone age here.
It also looks like many states use id.me for various purposes (example https://www.reuters.com/business/states-using-idme-rival-ide...). I would also want those decisions revisited and investigated.
Let us also find out why a non governmental entity is handling security screenings:
Ex-gov here. It is baked into gov thinking that the most desirable solution to difficult problems is to give it to the commercial sector. To a degree, it recognizes that a core responsibility of US gov is to support US commerce. One may argue how that philosophy encourages certain forms of corruption (swinging door, price abominations etc) but it's an accepted cost of doing business. What's good for GM is still, in those corridors, felt to be good for America.
I'm not arguing that this is a good thing. But it's how US gov thinks. That is why these problems are farmed out to the commercial sector. And as ex-gov, I can tell you that the government is a cash cow. And that's how they like it. And business. They like that too.
Tax Refund theft. The IRS pays out billions every year in returns filed by scammers.