Security of Login.gov problematic

[Lee B]

According to the attached TIGTA report dated 9/27/23 Login.gov is not as secure as it should be.

https://www.tigta.gov/sites/default/files/reports/2023-10/20232S070fr.pdf

In fact the use of both Login.gov and ID.me will be temporary until they can be replaced.

"In July, the IRS approved a road map for a future credential service provider outlining the need for two or more CSPs, including a government and non-government option, to provide taxpayers with a choice."

[jklcpa]

1 hour ago, Lee B said:

temporary until they can be replaced.

This annoys me.

It has been the same thing for my rare uses of e-services. Each time I'd try to access it, it was starting over with a new process. This last time I finally gave up. I got in and could never get to what I needed and kept getting a message that I wasn't authorized to access the report for that-whatever-it-was that I needed. Useless.

[mcb39]

I have never been able to access what I want from e-services.  After much frustration, I just gave up and have not tried it for a few years now.

[Catherine]

On 10/24/2023 at 1:46 PM, Lee B said:

not as secure as it should be

Tell us something we shouldn't have been able to guess. It was only a matter of time!

[Lee B]

Interesting, just set up my Login.gov account. All the setup does is confirm your email address and confirm your phone number.

I think Dennis is right, it just gives them a way to track who is accessing an EFTPS account which I have done for years for some of my very long term clients.

 

[Medlin Software, Dennis]

2 hours ago, Lee B said:

Interesting, just set up my Login.gov account. All the setup does is confirm your email address and confirm your phone number.

I think Dennis is right, it just gives them a way to track who is accessing an EFTPS account which I have done for years for some of my very long term clients.

 

If my guess is correct, they are just adding to the collection toolbox.  Remember, anyone who has access to the funds is liable, and has to defend if there is a shortage. Tough to defend if one has access to the funds and the login ability...

[Lee B]

56 minutes ago, Medlin Software, Dennis said:

If my guess is correct, they are just adding to the collection toolbox.  Remember, anyone who has access to the funds is liable, and has to defend if there is a shortage. Tough to defend if one has access to the funds and the login ability...

I don't see any difference between this and knowing any clients checking account number and routing number in order to print payroll checks, accounts payable checks,

reconcile a clients bank account or set up a tax refund direct deposit. A dishonest accountant can use any of this information for fraudulent purposes.

In over 30 years I recall screwing up a tax deposit amount once and a tax due date another time.

I reimbursed my client for the penalties and interest both times.

 

[Medlin Software, Dennis]

“Responsible persons”.  IIRC, signature authority is a big factor. Using eftps for the employer likely triggers. The current interp is broad. As long as you are sure you see and call all liabilities, make all deposits, and have good insurance, likely not a huge worry.