←back to thread

I read the federal government’s Zero-Trust Memo so you don’t have to

(www.bastionzero.com)
656 points EthanHeilman | 5 comments | 27 Jan 22 15:06 UTC | HN request time: 0.03s | source
Show context
tims33 ◴[27 Jan 22 18:06 UTC] No.30103856[source]▶
Really pleasantly surprised at how progressive this memo is. It will be interesting to see the timelines put in place to make the transition.

Btw - I'd love to see the people who put this memo together re-evaluate the ID.me system they're implementing for citizens given how poor the identity verification is.

replies(1): >>30107550 #
YeBanKo ◴[27 Jan 22 22:08 UTC] No.30107550[source]▶
I have an issue with using ID.me for government websites, because it is a privately owned company. Online authentication at this point seems as important as USPS service and warrants being owned and developed by the government itself.
replies(1): >>30109257 #
dmd ◴[28 Jan 22 00:44 UTC] No.30109257[source]▶
They even HAVE this already, at https://login.gov/ !
replies(1): >>30109531 #
1. tialaramex ◴[28 Jan 22 01:17 UTC] No.30109531[source]▶
I have a login.gov account. Needless to say I'm not a US citizen, and the IRS should not cut me a refund check.

ID.me supports WebAuthn (or maybe U2F? In this context it doesn't matter) but importantly it does identity verification so it can determine whether I am a US citizen, whether I'm a tax payer, and if so which one.

Now, perhaps the US Federal Government should own the capability to do that instead of a private company. But, so far as I can tell, they do not and login.gov is not such a thing.

replies(3): >>30110333 #>>30110473 #>>30110719 #
2. parkerhiggins ◴[28 Jan 22 03:15 UTC] No.30110333[source]▶
A private company shouldn’t own this capability. Especially as ID.me CEO lied about maintaining a database of every face “1-to-many” that uses their verification system. They’re right up there with Clearview AI.

https://www.theverge.com/2022/1/26/22903437/id-me-facial-rec...

3. konklone ◴[28 Jan 22 03:38 UTC] No.30110473[source]▶
Login.gov does support identity verification. Not all uses of Login.gov require it, so many accounts are just used for email with MFA.
replies(1): >>30111053 #
4. toomuchtodo ◴[28 Jan 22 04:29 UTC] No.30110719[source]▶
Login.gov supports identity proofing. It’s part of the flow when signing up for a Social Security account using Login.gov at ssa.gov (Login.gov recently became their primary identity provider a few months back).

Login.gov also supports WebAuthn.

5. rio517 ◴[28 Jan 22 05:45 UTC] No.30111053[source]▶
I thought I'd find you in here! Wishing you well friend.

-Mario