News for hackers. Stuff that matters.
Re:IRS to ditch biometric requirement for online access by Spooky23 on Monday February 07, 2022 @05:15PM (#30252129)
The only IDs issued widely by the US government are military credentials, immigration credentials, and passports. Driver’s licenses are issued by states and other entities. They are also fraught with problems as millions of people do not have REAL IDs, yet need to interact with government.

The problem is that any bartender who has scanned your drivers license has the information required to scam an online validation without some other validation.

If you want good online validation for the public, you need a third party right now. In the future, in some states, you’ll be able to use a mobile drivers license, provided you own a smartphone. Also problematic, as the government has to support everyone. Foreign nationals pay tax. People in nursing homes who cannot appear before a DMV need to pay taxes.

You can yak about corruption and incompetence, but that honestly attests to ignorance on the topic.

Re:IRS to ditch biometric requirement for online access by toomuchtodo on Monday February 07, 2022 @05:38PM (#30252393)
You continue to make some good points, but at the end of the day, this is a government function and responsibility, not that of a private company. Login.gov can use the same AWS services in GovCloud as ID.me uses (Rekognition, available since 2017 in GovCloud). With USDS and 18F, it cannot be argued GSA (which Login.gov falls under) doesn’t have the skills available to build this capability.

This is a call to enhance Login.gov’s identity abilities, and US government citizen identity management in general. Login.gov (and perhaps USPS for in person proofing) should be funded to do this, not ID.me. Higher level, this is about building strong public goods and defending them.

Re:IRS to ditch biometric requirement for online access by Spooky23 on Monday February 07, 2022 @05:49PM (#30252532)
USPS is already the agent for a national id program in all but name — passports and passport cards, which are much better than DMV issues credentials in many ways.

As another poster mentioned, the problem is that both progressive and conservative constituencies are strongly against meaningful national identity for different reasons, some of which are insane.

It’s a policy problem that won’t be solved in our lifetime. Our best bet long term is for states to issue mobile credentials, but even that is problematic because it will disenfranchise people.

Re:IRS to ditch biometric requirement for online access by PaulDavisThe1st on Monday February 07, 2022 @05:49PM (#30252526)
> You continue to make some good points, but at the end of the day, this is a government function and responsibility, not that of a private company.

I 100% agree. Problem is, the federal government (and the state governments and to a large extent big chunks of the citizenry) are fundamentally opposed to the issuance of a non-passport general citizen's ID and/or number. Those opposed to it don't have any good solution to "how to protect information the government keeps about you" either, so it's no good asking them.

Devising an actual public system for identity verification when you're being told the government cannot identify people is ... challenging.

Re:IRS to ditch biometric requirement for online access by michaelt on Monday February 07, 2022 @09:33PM (#30254288)
> Problem is, the federal government (and the state governments and to a large extent big chunks of the citizenry) are fundamentally opposed to the issuance of a non-passport general citizen's ID and/or number.

I wonder if this mightn't change with states increasingly requiring voter ID.

After all, it'd be pretty dumb to on one hand mandate that every voter have government-issued ID, and on the other to oppose it.

Re:IRS to ditch biometric requirement for online access by PaulDavisThe1st on Monday February 07, 2022 @09:37PM (#30254322)
The bulk of those who are pushing for more voter ID are from the most political alliance most vocal about both (a) insisting the voting is a state matter (b) federal government issuing ID is not OK.
Re:IRS to ditch biometric requirement for online access by vkou on Monday February 07, 2022 @11:53PM (#30255011)
You forgot (c) doing their best to limit the access to and eligibility of the kind of ID that people who don't vote for them can get.

It's not dumb, it's just evil.

Re:IRS to ditch biometric requirement for online access by mpyne on Monday February 07, 2022 @05:58PM (#30252662)
> You continue to make some good points, but at the end of the day, this is a government function and responsibility, not that of a private company.

Private companies have been part of the government discharging its responsibilities since first days of the Republic. You'd probably be shocked when you learn who does credit monitoring after government servers get hacked, by the way.

By your logic the government couldn't use cloud computing (run by a private company), couldn't use computer hardware even if they wanted to run a private cloud (hardware is built by private companies).

Re:IRS to ditch biometric requirement for online access by techsupporter on Monday February 07, 2022 @05:58PM (#30252657)
> If you want good online validation for the public, you need a third party right now.

In all reality, this is fine. I have no particular problem with using facial recognition, but I want it regulated and I want recourse.

Fine, outsource it to ID.me. But the terms of service better be a page, maximum, and include the ability for me to appeal a decision that says I am not who I say I am and to use other forms of validation that may be slower or more procedural (such as presenting myself to a Post Office). I want no binding arbitration clause in the agreement, and if that means the Federal government has to indemnify ID.me, then so be it. I want it in the TOS that the data ID.me uses for this will be segregated and kept for a very limited time and that I have the right to review and correct it.

Use the third party for what they are good for but enforce suitable rights for the rest. This is doable, it just wasn't fully done here.

Re:IRS to ditch biometric requirement for online access by strong2024 on Tuesday February 08, 2022 @09:23AM (#30258684)
ID.me does have the ability to appeal the decision by hopping on a video call to complete the registration. They also do have the ability to close your account and through that delete all your data.
Re:IRS to ditch biometric requirement for online access by scotuswroteus on Tuesday February 08, 2022 @10:23AM (#30259447)
You didn't respond to the rest of the comment, especially about arbitration
Re:IRS to ditch biometric requirement for online access by throwhauser on Monday February 07, 2022 @07:19PM (#30253425)
> If you want good online validation for the public, you need a third party right now.

I should not under any circumstances need to enter into a direct agreement with a private entity like id.me in order to access public services. The government might reasonably subcontract out some of the work, but public services need public accountability. The government service itself needs to be the direct counterparty to the public.

Re:IRS to ditch biometric requirement for online access by nataz on Monday February 07, 2022 @09:43PM (#30254359)
The government issues HSPD-12's, of which CAC/military PIV cards qualify as. In theory both federal staff and contractors need an HSPD-12 compliant ID/"smart credential" to access facilities and networks.

Just wanted to point out that there are lots and lots of federal IDs that are not military, immigration, or passports.