Why did the US gov decide to rely on a TLD controlled by Montenegro for this seemingly important and sensitive service?
isiahl 1 hours ago [-]
It’s not even a government service. It’s a private business they have entrusted with authentication for the government.
varispeed 1 hours ago [-]
textbook fascism (marriage of corporations and government).
rho138 1 hours ago [-]
Queue the flag/downvote storm for callimg out the system that provably doesn’t work.
gjsman-1000 23 minutes ago [-]
No system has ever provably worked; otherwise we wouldn’t have had revolutions.
DANmode 14 minutes ago [-]
and?
deathanatos 55 minutes ago [-]
And we even have login.gov, too! (… which I really hope replaces ID.montengro one of these days, but … I guess not, if the Treasury is adopting it now.)
petcat 25 minutes ago [-]
> US gov decide to rely on a TLD controlled by Montenegro
Let's be honest, the US government can control basically any domain it wants. I doubt Montenegro is going to cause any problems for it.
noinsight 1 hours ago [-]
It’s funny… In Finland they went with hightrust.id (Indonesia) too.
18 minutes ago [-]
waldrews 1 hours ago [-]
TreasuryDirect's login and account recovery experience has been notorious for years, both for user experience and for people easily getting locked out for weeks. It's good they're being careful with this rollout, as it serves both individual and institutional accounts where dollar amounts involved are epic even by bank standards, and rarely checked by hand, so even single account breaches are serious.
They used to support TOTP directly, but removed it in favor of their proprietary mobile apps. It's still TOTP under the hood though, just requires a couple API calls to "activate" it.
toomuchtodo 2 hours ago [-]
Unfortunate it’s not login.gov but definitely an improvement over their bespoke customer identity and access management solution.
rcleveng 55 minutes ago [-]
I was happy when they got rid of the virtual keyboard you had to type your password onto, such a pain since you also couldn't paste into the password field to autocomplete from a password manager.
Had to constantly popup Chrome DevTools and "fix" the dom element to let paste work.
qgin 2 hours ago [-]
Does anyone remember their crazy Ovaltine-decoder-ring two factor auth that they had for a while? They mailed you a physical card with custom grid of numbers and letters and the login challenge would be to submit the letters an numbers at various grid points.
Yes, I had one of those cards. It made you feel like you were accessing government secrets. In 2007.
zbentley 52 minutes ago [-]
That type of system is actually still in use in a lot of industries—either as a primary factor or a fallback for folks who might need to log in without a working device. Think healthcare workers who forgot their phone but need to order a surgery, or outdoor safety workers updating the toughbook after a day of work that might damage phones.
altairprime 41 minutes ago [-]
I still have mine! It was really excellent before camera phones.
dbalatero 1 hours ago [-]
Yeah, there's no mandate for government agencies to use login.gov AFAIK, so they can either go with login.gov or buy the private id.me solution. In general it's not a slamdunk to get agencies to cooperate and use their services, it seems.
toomuchtodo 1 hours ago [-]
Login.gov had/has some technical gaps for agency customer identity use cases, which is why you don’t see it used by some agencies yet (depending on their customer identity assurance requirements). The outstanding technical gaps will be closed eventually, at which point id.me can be phased out as a private for profit idp vendor.
> GSA has closed most of the gaps GAO identified in 2024 and 2025, but the remaining recommendation has a direct operational consequence. GSA has developed a public roadmap and created a Partner Advisory Group, but GAO says those steps do not demonstrate that the specific technical challenges agencies identified have been resolved or that mutually agreed-upon time frames have been established.
> GAO will continue monitoring GSA's progress. Until those time frames are established, the federal government's government-wide identity verification service retains an unresolved implementation gap as fraud and identity-theft threats continue to evolve.
And 1990s era website design (maybe). I'll have to retrieve my credentials from somewhere I guess. Not sure why they're not unifying it with other government websites.
toomuchtodo 2 hours ago [-]
The arc of progress is like the visibility curve over the horizon. We keep sailing.
cebert 28 minutes ago [-]
This makes me so angry.
shevy-java 1 hours ago [-]
> To set up a new ID.me account, you’ll need two government-issued forms of identity ready.
That will be rolled out before anyone can access the world wide web. And they will continue to claim it is for the protection of kids ...
And of course this will be used to track down illegal aliens.
[1] https://www.biometricupdate.com/202202/downwind-of-irs-decis...
Let's be honest, the US government can control basically any domain it wants. I doubt Montenegro is going to cause any problems for it.
They used to support TOTP directly, but removed it in favor of their proprietary mobile apps. It's still TOTP under the hood though, just requires a couple API calls to "activate" it.
Had to constantly popup Chrome DevTools and "fix" the dom element to let paste work.
https://legis1.com/news/logingov-technical-issues-gsas-platf...
> GSA has closed most of the gaps GAO identified in 2024 and 2025, but the remaining recommendation has a direct operational consequence. GSA has developed a public roadmap and created a Partner Advisory Group, but GAO says those steps do not demonstrate that the specific technical challenges agencies identified have been resolved or that mutually agreed-upon time frames have been established.
> GAO will continue monitoring GSA's progress. Until those time frames are established, the federal government's government-wide identity verification service retains an unresolved implementation gap as fraud and identity-theft threats continue to evolve.
https://www.gao.gov/products/gao-26-109261
That will be rolled out before anyone can access the world wide web. And they will continue to claim it is for the protection of kids ...