News for hackers. Stuff that matters.
Re:IRS to ditch biometric requirement for online access by closeparen on Monday February 07, 2022 @05:24PM (#30252220)
The government cannot build a competent identity solution because a majority of voters believe that to do so presages something from genocide ("Papiere, bitte!") to the literal end of the world (“Mark of the Beast”).
Re:IRS to ditch biometric requirement for online access by vorpalhex on Monday February 07, 2022 @07:02PM (#30253312)
We are still in the same universe where the OPM breach happened, right?

Like no, I don't trust the government to protect the big bucket of PII on everyone in digital form. Not because of lizard people but because the government can barely keep it's own sites secure. Giving them more dangerous data in the form of bulk PII is the wrong move.

Login.gov was the first thing, in a long time, that was well executed. I need to see more things like that to restore my faith. ID.me is the wrong direction.

Re:IRS to ditch biometric requirement for online access by alistairSH on Monday February 07, 2022 @07:17PM (#30253414)
The IRS already has almost all our PII. Not sure how adding a photo materially changes anything in that regard.

I do agree ID.me is the wrong approach. And login.gov should be used in some form over a private enterprise. But, my concern is two-fold… it’s a private entity that I don’t really want to do business with. And the process described by Krebs was impossible - can we really expect everybody to have email, valid phone (what if they aren’t the account owner for the phone), photo ID, and whatever else was required?

Re:IRS to ditch biometric requirement for online access by Talanes on Monday February 07, 2022 @11:06PM (#30254802)
My father doesn't have any sort of web-connected camera, which caused a whole set of problems with his unemployment that I can't remember how they got fixed.

On a similar note, I don't have a lot of documents tied to my name, so I had nothing that they wanted when my photo verification didn't work for whatever reason. Pretty sure I just never solved that one and left the last couple weeks I would have gotten unemployment on the table.

Re:IRS to ditch biometric requirement for online access by vorpalhex on Monday February 07, 2022 @07:37PM (#30253566)
The IRS has our PII, but lots of it is not in a big bucket, it's quite diffuse. If PII is dynamite (and it is) then we want it divided up in silos, with firewalls, and limited access where nobody has universal access. Ideally a lot of it is protected by differential privacy - if I am getting audited, the auditor only see's my returns and not my identity, and someone else gets only my identity.
Re:IRS to ditch biometric requirement for online access by tomrod on Monday February 07, 2022 @08:02PM (#30253742)
Check out 18F / US Digital Services.

GSA has really upped the game over the past 10 years for digital services delivery. Such as Login.gov. Look for other places 18F/USDS are involved, and you'll see significant improvements.

https://playbook.cio.gov/

Re:IRS to ditch biometric requirement for online access by closeparen on Monday February 07, 2022 @09:30PM (#30254270)
With a remotely sane identity system, knowing someone’s identifiers and basic biographical facts would not help you to impersonate them. PII has the sensitivity that it does in today’s world only because we abuse knowledge of PII as a poor man’s authentication mechanism.
Re:IRS to ditch biometric requirement for online access by vorpalhex on Tuesday February 08, 2022 @10:58AM (#30259961)
The danger of PII goes well beyond impersonation.

"Here is a list of every Jewish person in this zipcode with their home address..."

Re:IRS to ditch biometric requirement for online access by closeparen on Tuesday February 08, 2022 @12:52PM (#30261788)
Every characteristic needs to be secret just in case someone decides to murder everyone with that characteristic.

If that is going to happen in the US it is probably going to be a red/blue culture war thing. Shall we eliminate campaign finance transparency?

Re:IRS to ditch biometric requirement for online access by vorpalhex on Tuesday February 08, 2022 @01:04PM (#30261989)
Knowing where your Jewish friend lives is fine. Having a list of every Jewish person in your zipcode (or every X) is like holding a handgrenade.

When the Ashley Madison hack happened a whole mess of blackmail was the result.

I have had someone target me in an attempt of blackmail due to a forum breach (why they thought an anime forum was good blackmail beats me...)

Your browsing habits, which is a step removed from PII, even reveals your sexuality and pregnancy status.

And, we had an attack on Jewish people in the last month. We have not had anyone Democrat/Republican hunting.