> with the most security-sensitive application possible.

I certainly don't see my tax returns that way.. is that a commonly held view?

Doesn’t it have your social security number?

I run a small business and I need to collect W-9's from basically everyone I ever pay, which means I have an absurd amount of SSN's in PDFs sitting in a folder on my computer. It feels very wrong, but apparently that's how taxes work. Kind of makes SSN's feel less secure/protection-worthy than I used to believe shrug

First job out of college I was given, with no oversight or training, access to thousands of peoples SSNs, names, phone numbers and addresses. I also had a private investigator locate someone from my childhood once and got not only their phone number, address, and SSN but their entire family and neighbors and anyone who had a name similar to theirs. It's outrageous how insecure everything is.

Between the Equifax breech and others, hasn't the average American had their SSN compromised several times over by now?

I've found addresses of people in USA based on: their entire name; their first name and the state they live in, and confirmed by a single friend's name; their name, city and that they lived near a golf course

Then you can see where they've ever lived, and who with. All for free

> It feels very wrong, but apparently that's how taxes work. Kind of makes SSN's feel less secure/protection-worthy than I used to believe shrug

It is very right, because social security numbers are not meant to be a secret.

What is wrong is being liable for a debt (or whatever) because a creditor failed to properly verify the identity of a borrower.

Those whole situation can be easily fixed by removing the ability of lenders and governments to claim they verified identity by simply asking for SSN/date if birth.

We have pocket computers with video cameras that can record and transmit spoken agreements within seconds, and we have a nationwide network of USPS offices that already do in person identity verification for issuing passports. Executing the solution is basically done, all that is left is political.

> What is wrong is being liable for a debt (or whatever) because a creditor failed to properly verify the identity of a borrower

You're never liable for a debt you didn't sign for. If someone else used your information, don't pay it. The court will always side with you.

Having to spend time and money to deal with the courts is a liability.

Also, credit and credit reporting is utility/infrastructure with how life is lived, including access to a place to live. So much that the federal government obligated credit reporting agencies to provide people an annual report. Having to spend time and money to fix it is also a liability, in my opinion.

No need to deal with courts. Just ignore it.

Conventionally, yes.. but there's no reason the IRS has to use this alone to identify me. Conceivably, it would be very easy to check a box on my W-9 and have a unique yearly "Tax ID" generated and placed on my W-2. Then I can file using that unique number and the imputed need of the highest security ever can just evaporate.

I'm not talking about "tax returns", I'm talking about "SSO used by citizens/residents/customers for the federal government", which is what login.gov is.

> Or maybe the quote is wrong that it "hasn't been widely rolled out"?

I think it's wrong in some senses: Login.gov has been rolled out to the SSA, OSHA, Treasury, RRB, VA, DHS, and quite a few other orgs and agencies. There's no one good metric for these things, but if you measure it by org/agency size and/or budget, Login.gov looks very good.

I agree that $187 million is an eye-popping number, and I wish we had the ability to put it into context: it's entirely possible that $187 million spent means that each agency is saving $X million in separate/legacy maintenance each year.

Edit: Another framing is that, if the GSA's user predictions are correct[1], Login.gov will end up costing a little under $2 USD per user.

[1]: https://federalnewsnetwork.com/it-modernization/2022/06/gsa-...

For me, it's not a question of whether the cost is "worth it", but that the cost seems very very high for what seems to have been produced.

Agree with jrochkind1 that it doesn't matter whether it's worth it or not. I suppose chairs and desks for all US Government employees pay for their cost 1000x over, but I would hope people would still not let their costs balloon to more than, say, 2x what they "should" cost by some common-sense metric.

Sure, but what's the common-sense metric here?

As posted elsewhere in the thread: this is ~$40m/year for an IdP/login scheme for the entire USG (and, increasingly, state and local governments). That's significantly less than the engineering talent at companies like Okta and Authy probably cost each year, even before factoring in overhead and non-engineering roles.

All things considered, this looks like a very efficient use of taxpayer money to me. Particularly since it seems to have been primarily paid for on GS pay grades, not with private contractors.

Part of that big price tag is likely because of requirements for any kind of government contracted software, some of which are reasonable, some of which are not. Often companies charge a lot more for complying with those requirements. The Fedramp version of most SaaS offerings is significantly more expensive than the non-fedramp version. And part of that is just to cover paying the higher prices for their dependencies to be fedramp compliant.

$187M = $37M per year

At average FAANG salaries with overhead (benefits, space, equipment both desk and datacenter/cloud, internal workplace support functions like Recruiting, IT, HR, ER, DEI...) that's 60 people.

That's not many when dealing with multiple massive counterparties. You'll see ratios of non-dev to dev easily 10:1 to 30:1.

Yes, they could genuinely spend $187M so far on a project accomplishing only 2 devs x 5 years worth of work and rework.

That's actually good perspective,thanks!

Also consider the cost per taxpayer. At $187 million that's roughly $1 per person. For someone making the average income, it costs them maybe $0.15 in taxes for ID.me.

The IRS estimated that the average taxpayer spends $240 and 13 hours of time on their taxes. Multiply by 157 million taxpayers and that's $37 billion and 2 billion hours of labor. Although likely skewed by a small % who hire professionals, plenty of people spend $100+ on services like TurboTax.

The IRS spending a couple billion to make the tax process a little bit easier is really not a big deal. $187 million is nothing, and if that's all it costs to streamline their ID verification process, then it means the government is much more efficient with our tax dollars than people give it credit for.

Simple to use != simple to make is so often a hard fact to keep in mind when looking at these numbers