Best Results Organizing

Are you over it? Do you feel like you’re all prepared, password-wise?

Two weeks ago, in Not Your Mama’s Passwords: Passphrases, Passkeys, and the Future of Logging In, we did a deep dive, examining:

• how the characteristics of a good password have changed over the years
• what it means to have strong passwords nowadays
• all the elements to consider when picking your login credentials (Did I at least convince you that having capital I and lowercase L (I vs. l), and zeros and O’s (0 vs. O vs. o) might be confuse your eyeballs as you age?)
• the advantages of a passphrase over a traditional password
• how to fix weak, compromised, and re-used passwords
• the advent of passkeys and the many reasons why they’re advantageous (and getting more popular)
• what the difference is between 2-Factor Authentication (2FA) and Multi-Factor Authentication (MFA) and how you can use those methods to the advantage of your digital security.

Then last week, in Paper Doll’s Guide to Managing Passwords for the 21st Century, we had a bit of a reality check as to how we can no longer hope to remember our passwords and why keeping them on sticky notes isn’t (and was never) a good idea. We looked at:

• the advantages and disadvantages of analog password management and whom they are likely to serve best
• the advantages and disadvantages of digital password managers (the solution that’s best for most of us)
• the most built-in digital password managers you may already have
• the most popular third-party digital password managers (plus their features and costs)
• essential features of digital password managers, and some bonus features you might want to check out
• resources for learning more about digital password management.

So, I’d get it if you think you know everything there is to know about organizing your passwords for a more orderly digital life. 

Except…maybe not quite yet?

Having access to your login credentials and using your fingerprint or FaceID to prove to a website that you have the right to access your digital stuff should be enough. <sigh> But as we go along, for some sites, that’s still not enough.

The question for this point in the 21st-century is: How do you prove that you are really you?

  

WHAT IS DIGITAL IDENTITY VERIFICATION?

If you’ve tried to log in to Social Security, EFTPS, the Veterans Administration or any of a number of government websites in the last few years, you may already know that having a password isn’t enough. Because of this, in recent years, new kinds of digital identity verification platforms have been developed. 

In the simplest of terms, digital identity verification is the process by which you can prove that your identity is real — that you are really you — without necessarily having to interact in person. Instead of a company making you come in for in-person identification — like how you have to go to an airport to interview for TSA Pre-Check — government agencies, organizations, and businesses can now outsource the collection of that biographical and biometric data digitally, remotely, and match it against trusted, verifiable sources.

These outsourced sites require you to jump through some reasonable hoops to sign up and prove your identity so that when you go to log in to your actual destination (like the Social Security Administration), it’s like there’s a drawbridge with a guard asking you to prove that you are who you say you are before you can go any further.

You just have to have the right answers.

 

The two best-known sites for digital identity verification, particularly for use federal and state agencies, are ID.me and Login.gov.

ID.me

ID.me was started in 2010 by two U.S. Army Ranger veterans. It’s a secure digital identity verification service that has been described as acting “like a driver’s license for the internet.”

Once you prove who you are to ID.me, it won’t help you buy alcohol or get you on an airplane, but it will unlock access to your accounts with government agencies and programs, healthcare portals, and online store discounts that are dependent on you having a particular kind of status.

How to Get Validated By ID.me

To get validated by ID.me, there’s a one-time set-up where you create a single, unique set of login credentials and confirm the sign-up via email, then choose a multi-factor authentication method. (You also get to create a VERY complex recovery code you can use in case you ever lose your device and/or phone number.)

And, of course, you have to verify your identity.

On the plus side, you won’t have to answer those pesky security questions like you used to have to do to get your credit score. (This is a boon to anyone who no longer recalls their address when they were twelve or the lending company for their first car loan.) But you will need the following basic identifying information:

1. your email address — Select one that you check frequently and that you can access during the sign-up process. (So, don’t use your work email if you can’t access it from home, or vice versa.)
2. your Social Security number — Alternatively, if you do not have an SSN but do have an Individual Taxpayer Identification Number (ITIN), use that.
3. your valid state or federal ID, like a driver’s license, passport book or passport card
4. a reliable multi-factor authentication (MFA) method — This may be the ability to receive a security code via text message, an authentication app (like Google Authenticator), a security key, or backup code.
5. your phone, tablet, or computer with a camera — You will be asked to take photos of your ID and of your face to verify your identity. You may not want to do this at 2 a.m. after you’ve rubbed off half your eye makeup or mussed your hair to the point that you’re no longer recognizable, so consider this before starting the process. 

Once you have everything in hand and provide your identifying information, you will be prompted to either take a brand-new selfie or join a brief video call in order to prove that the photo on  your driver’s license matches the photo of your face. I hope, for your sake, your driver’s license photo doesn’t look like Nick Nolte’s famous mug shot.

Be ready to create your ID.me password. Yes, you need a password for the site that let’s you log in to other sites with passwords you already have. And yes, I recognize how ridiculous that sounds. 

And, of course, you’ll have to abide by wisdom we’ve previously discussed regarding letters, numbers, special characters, randomization, length, etc.

The process is only slightly laborious, fairly painless, and free, and you will only ever have to do it once.

 

Where Can You Use ID.me?

More than 21 federal agencies and at least 45 state government agencies in the United States use ID.me as a trusted credential service provider to allow you to safely access information, manage your benefits, and help stop fraud. Government agencies using ID.me include:

• Internal Revenue Service (IRS) 
• Social Security Administration (SSA) 
• U.S. Department of Veterans Affairs (VA) 
• Centers for Medicare & Medicaid Services (CMS) 
• U.S. Department of the Treasury
• U.S. Department of Commerce
• U.S. Department of Health and Human Services (HHS)
• Patent and Trademark Office

Various individual states use ID.me for their Departments of Labor or Unemployment, Departments of Revenue/Taxation, and Health & Human Services programs, like state Medicaid and SNAP. You can access a list of all federal and state agencies using ID.me at https://www.id.me/government.

But it’s not just the government that wants to verify your identity. Various businesses offer discounts based on status, and that status is built into your provable identity with ID.me. For example, if you go to ID.me and select Shop instead of Government at the top of the screen, you can use your ID.me Wallet to prove your status as a:

• current member of the military
• veteran
• nurse (or other medical professional)
• first responder
• teacher
• student
• government employee

and access a variety of discounts on product categories including clothing and accessories, health and beauty, sports and outdoor equipment, travel and entertainment, lifestyle items ranging from publications to meal delivery to toys, technology and office equipment, home and auto supplies, pet supplies, and delivery services. 

Two Ways to Log On Using ID.me

In order to log in using ID.me, there are two main methods. The first represents my own experience, because I like to jump through hoops.

I pay quarterly estimated taxes for my business through the Electronic Federal Tax Payment System (EFTPS). When I first signed up, more than a decade ago, I had to submit an application and then wait for the government to send me a PIN and an enrollment number in the mail. Only once I received it could I create a password, after which, every time I logged into EFTPS to pay my taxes, I would have to provide my email address and password, as well as that PIN.

Then, several years ago, I was prompted to sign up for either Login.gov, ID.me, or a third verification platform that no longer exists. At the time, ID.me seemed the easiest, so that’s what I picked. Now, when I go to EFTPS and start to log in, I’m immediately sent to ID.me, where I log in, and it then takes me back to EFTPS, to use my agency-specific login credentials.

It’s a lot, but it protects me from someone else logging in and paying my taxes for me. (Wait. Tell me again why that would be bad?)

There’s a second method. Because ID.me is considered single sign-on (SSO), an identification method allowing users to log into multiple independent apps and websites using a single set of credentials, you can get to all of the various government agencies (and the aforementioned shops) directly from the ID.me website.

Once logged in there, your ID.me wallet can take you to any federal or state government agency or shop that’s part of the program. 

How ID.me Ensures Safety and Privacy

ID.me follows strict federal security rules for consumer authentication set by U.S. Department of Commerce and is approved by the National Institute of Standards and Technology (NIST) as a NIST 800-63-3 IAL2 / AAL2 credential service provider per the Kantara Initiative. (If you think that sounds like something out of Star Trek, well, we’re on the same page.)

ID.me is a private company, not operated by the government. So how does it make money?

ID.me states it does not sell your personal data to advertisers. Rather, ID.me stays afloat by:

• Charging software subscription and verification fees to government agencies and businesses — Government agencies pay ID.me for Identity as a Service (IDaaS) while enterprise-level companies pay ongoing subscription fees or per-verification fees to securely verify their users and prevent fraud.
• Charging individual retailers transaction fees to verify customer groups (like military members, or teachers) so they can securely offer discounts to identity/status-linked audiences.  
• Receiving affiliate commissions on anything users purchase through the ID.me Shop.

However, because people have now experienced signing up with ID.me, leading to trust in the name, you can be sure bad guys are pretending to be ID.me.

As always, watch out for fake emails and text messages purporting to be ID.me in order to purloin your data. Every time you use ID.me, check the URL and security padlock icon (the one that Paper Mommy thinks it looks like a purse), and make sure you’re on the real website before typing any personal information.

LOGIN.GOV

Login.gov is a secure, single sign-on service managed by the U.S. General Services Administration, an independent federal agency.

Login.gov allows you to use one username, password, and multi-factor authentication (MFA) method to access participating federal and state government websites. Unlike ID.me, Login.gov is only for accessing government sites, not retail shops or other types of sites.

How to Create Your Login.gov Account

In addition to all the same bulleted items (above) that you would need to set up an ID.me account, Login.gov also requires that you have a US-based telephone number on a plan that’s in your name.

So, if you’re on a family account that doesn’t list your name or your cell phone is owned by your employer, that can be a sticking point, which is why some people prefer ID.me.

Signing up for Login.gov works much the same way as ID.me, although in addition to using the same standard personal information and matching your ID to a photo or doing video check, Login.gov also matches your identity to your credit history and checks government databases.

There’s one more twist. If any part of the verification process for matching your selfie to your face via Login.gov is problematic, you can go to a United States Post Office location in person, smile that 1000-watt smile of yours, and prove your identity to a human being in order to complete the process.

 

Your Login.gov credentials will allow you to access many of the same government websites as ID.me, including the IRS, the U.S. Department of the Treasury, and the VA, as well as various sites in the Trusted Traveler Programs (like TSA PreCheck application management, Global Entry, NEXUS, SENTRI, and FAST).

SO, WHAT’S ARE THE DIFFERENCES BETWEEN ID.me AND LOGIN.GOV

Login.gov and ID.me are both official secure single sign-on services used by the United States government to access official websites. So, you may be wondering, what are the differences between Login.gov and ID.me?

The main differences are that Login.gov was built and is managed by the federal government to access only government sites, while ID.me is run by a private company that also contracts with private businesses.

Both meet strict federal security rules, but they handle setup and verification differently. 

As mentioned, ID.me requires uploading photos of your ID, like a driver’s license or passport, and uses biometric checks like a selfie scan via your device’s webcam or a live video chat with a support agent.

Login.gov is similar in that it uses the same personal information, and biometric scans, but also digs into what the government already knows about you (whatever is in those sneaky government databases and credit bureaus) to check you out. And again, you’ve got an out if your selfie skills are abysmal — just head to the post office.

So, which should you choose?

The answer may be you-specific, or situation-specific.

ID.me is the more flexible choice if you are currently living outside of the United States, don’t have a Social Security number, don’t have a phone plan in your own name, or need specialized verification via video call.

Additionally, ID.me is often required for specific tasks, like if you want to use the IRS tool to get an Identity Protection PIN. 

And if you fit one of those special identity/status categories as a current member of the military or veteran nurse (or other medical professional), first responder, teacher, student, government employee, you may want to use ID.me’s Shop to get discounts. (That said, always shop around to make sure that the price of what you’re buying can’t be found for less elsewhere.)

However, there are times when Login.gov might be better. If you’d prefer to avoid facial recognition software or biometric uploads and would rather visit your local post office, Login.gov might be your cup of tea.

 

But guess what? You might not have to choose. Assuming you live in the U.S., have a Social Security number and U.S.-based phone in your own name, there’s no reason (aside from annoyance at having to use either one at all), that you can’t sign up for both.

But in all likelihood, you will eventually have to sign up for at least one, as an increasing number of government agencies are requiring one of these two forms of identity validation. 

SEE ID.ME AND LOGIN.GOV AT WORK

So, let’s say you want to create your brand-spanking-new online Social Security account.

Before 2026, you’d go to SSA.gov and answer a long list of questions about your childhood addresses, cars you used to own, and financial information in your name, just to prove your identity. 

Now, when you click to log in, the site will prompt you to either sign in or create an account with either ID.me or Login.gov. You select which you plan to use and then follow the prompts for whichever you choose. For example, ID.me: 

or Login.gov:

 
Once your account is set up, on future visits, you’ll be able to log in by choosing either “Sign in with ID.me” or “Sign in with Login.gov” from the Social Security website and authenticating your identity with your selected MFA method.

It works the same way with any other site (governmental or otherwise) that prompts you to use one of these verification systems.

HOW ABOUT CANADALOGIN, EH?

Are you reading Paper Doll from above the 49th parallel? Welcome, Canadian readers! Did you know that you will soon have your own, nifty single sign-on and identify verification program similar to ID.me and Login.gov?

CanadaLogin provides a simple, reliable, and secure way for Canadians (and those residing in Canada or needing to avail themselves of Canadian governmental agency services) to sign in to the websites for various programs and services of the Canadian government.

It’s designed to “prioritize security, convenience, and usability.” As such, it’s not just a matter of being able to verify identity, but make it easier for people to access the 270+ online services offered by the government of Canada. (And remember, Canada is bilingual! Everything has to be available in English and French!) Apparently, there are more than 60 different access points for these services. So, Canada is moving toward streamlining everything!

Eventually, all Government of Canada online services will connect to a single entry point through CanadaLogin. This will eliminate the need to remember (or even have) a bazillion sets of login credentials. (Paper Doll apologizes for not knowing if there is a metric conversion for bazillion.)

So far, users can only start setting up CanadaLogin credentials with two-step verification through one of three MFA methods:

• a one time code sent as a text message or by voice call,
• a passkey, or
• a security key

Soon, though, CanadaLogin will start adding more kinds of 2FA/MFA methods and other ways to log in and recover login credentials, including through Interac sign-in partners. For readers unfamiliar with Interac, here’s a cheatsheet:

 

And eventually, Canadians will be getting the same kinds of secure, online identity confirmation options as Login.gov and ID.me, but likely with a charming, polite, Canadian approach.

Currently, Canadians do have access to a mix of identity verification options, including eID-Me, an encrypted digital ID on one’s cell phone. It offers a secure digital wallet, almost-instantaneous identity verification, password-free logins, and high security and privacy. To register for eID-Me, you need a valid Canadian or U.S. passport as well as a Canadian driver’s license or photo ID card.

Canadian residents can also get verified to access identity/status-based (first responders, teachers, etc.) Canadian Shop ID.me discounts. 

THE FUTURE OF IDENTITY VERIFICATION

The first post in this series looked at the question, “How do I prove something (an account) is mine?” and found solutions in developing passwords, passphrases, passkeys, etc.

The second post examined, “How do I manage it all security to keep organized and productive?” 

And today, we’re answering, “How do I prove that I am who I say I am?” so that, again, we can productively access our online stuff.

It’s not going to stop here. 

Just last week, I was asked by the brokerage company for my IRA to set up a digital voice print identifier so that when I call in, there will be an additional level of security. 

On the one hand, the process was easy and interesting. I was asked to stand in the middle of a room and turn 360° as I described various things I could see in a long and rambling discourse. (Paper Doll is very good at delivering a long and rambling discourse.)

On the other hand, given what I’ve learned about AI and the ability to spoof our voices and our faces for scams, I can’t say I’m comforted. Of course, when fingerprint identification for phones came out, I have to admit I was a little queasy, imagining thieves stealing iPhones and cutting off people’s fingers, and as far as I know, that never came to pass.

The only thing we know for sure about the future of login credentials, identity verification, management of all of it is that it will continue to evolve, which means we will have to keep monitoring the changes to protect our identities and access credentials with more and more care. Our ability to stay productive online will depend on embracing these methods, even while familiarizing ourselves with the methods will initially slow us down. ‘Twas ever thus.

Do you already have accounts with ID.met or Login.gov? Do you have a preference?