You might sometimes see people say that a SSN is both a username and a password. What they mean is that it’s used both for unique identification as well as authentication; imagine if your email address was also necessarily the password for your email. There’s nothing wrong with having the identifier. What’s wrong is treating the identifier as though only the person it identifies knows it, which is patently false because that would make it useless as an identifier.

As for what I’d do instead: create an application that is fully managed by the IRS and let me login with some combination of a client certificate, password, U2F device, TOTP, et. al. Have the IRS securely implement something like OAuth (I hear “securely” doesn’t quite fit with “OAuth” but they could implement something custom-built if they want to) so I can get the IRS to tell whoever I need them to tell that I am me.

Ideally, replace IRS with a purposeful identification organization for these purposes and let the IRS use what this new organization gives them.