Slashdot Mirror
IRS Gets Hacked Again, Forced To Scrap Their Entire PIN System (engadget.com)
The IRS has abandoned a system of PIN numbers used when filing tax returns online after they detected "automated attacks taking place at an increasing frequency," adding that only "a small number" of taxpayers were affected. An anonymous reader quotes the highlights from Engadget:
The IRS chose not to kill the tool back in February, since most commercial tax software products use it... If you'll recall, identity thieves used malware to steal taxpayers' info from other websites, which was then used to generate 100,000 PINs, back in February... This time, the IRS detected "automated attacks taking place at an increasing frequency" thanks to the additional defenses it added after that initial hack... the agency determined that it would be safer to give up on a verification method that's scheduled for the chopping block anyway.
Nice to see the IRS doing something smart, contrary to all stereotypes and expectations.
I don't care who they are, they need to be held accountable for their terrible security posture and crap decision making (PINs are being generated by attackers? It's cool, it's only a small percentage of taxpayers.)
Some neck beard has to make a comment about PIN numbers!
I'm still LOLing at the Europeans even today, most of whom are mourning the first of many nations to leave the EU. It's a matter of time before the rest of the EU fails, too. I'm so thankful for being a Canadian, because we are smarter and better than the Europeans and Americans. Unlike the United States and most of Europe, Canada is not a failed state. Look for Canada to become the dominant power as China sinks deeper into recession, the United States spirals downward in decay, and the EU breaks apart at the seams. Also, in Canada, we have a properly functioning taxation system, thank you very much. And we're also not in a massive amount of debt.
Wouldn't filing dozens/hundreds of fraudulent returns with the wrong PIN be pretty easy to spot? While attackers may be able to mask their location/identity through various means they can't mask which account they're trying to penetrate, just lock down an account if too many wrong PINS are used with a decent amount of other information that is correct (SSN, name, etc). This should prevent fraudulent access while limiting the ability of attackers to try to lock-down the entire system by spamming it.
when no one listens anymore?
You will be hacked and cracked and fiddled about. Hide, or sit back and relax and accept it.
All this crap just because tax preparation companies throw lobbying money to keep the current system. Most Americans would not need to actually file for taxes, the IRS already has all the data it needs, but noooo we have to keep an obsolete industry going no matter the cost...
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
It also seems you are very proficient in duplicate troll-posting. Kudos.
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
The checks have to delivered somewhere.
I'm still LOLing at the Europeans even today, most of whom are mourning the first of many nations to leave the EU. It's a matter of time before the rest of the EU fails, too. I'm so thankful for being a Canadian, because we are smarter and better than the Europeans and Americans. Unlike the United States and most of Europe, Canada is not a failed state. Look for Canada to become the dominant power as China sinks deeper into recession, the United States spirals downward in decay, and the EU breaks apart at the seams.
You'd better hope the US doesn't decay too much or too far. One of the hallmarks of failed republics is to become an aggressor-state to prop up the failing system, and Canada would be a tempting and convenient target for US annexation and subsequent plundering of it's wealth and resources.
The US has the very real potential to become the greatest threat to the world since Nazi Germany if it goes full-fascist/socialist-oligarchy, which is a distinct possibility if/when the US economy and currency collapses, particularly if there's a 'cult of personality' populist-demagogue type of leader like Trump in charge at the time.
Strat
Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
"Get's hacked"
right, because brute forcing pins is hacking. yes, those accounts got compromised but the system itself didn't. slashdot is just spewing bullshit at this point. a correct title would have been "IRS shuts down their PIN system due to weak PINs being bruteforced"
will he release them?
> Just lock down an account if too many wrong PINS are used
The bad guys don't care which account they access. Suppose you limit it to four tries at a PIN. The bad guys try 250 accounts with four PINs each, not one account with a thousand PINs.
Locking out the account rather than the attacker is just DOSing yourself. I like to call this the Broken MS Windows fallacy, because Windows does it.
This time, the IRS detected "automated attacks taking place at an increasing frequency" thanks to the additional defenses it added after that initial hack...
The IRS is not alone in this. After entities get hacked, they implement tighter detecting tools and sigh with the false comfort that they "are on top of things."
Look ...
If your storage building is being ransacked and you put up security cameras that show people breaking in, you have not actually SOLVED anything if the thefts continue.
It's not hard, folks: Get a goddam lock.
It little behooves the best of us to comment on the rest of us.
Why can't I just submit the public key from one of my PIV tokens(say with a copy of my passport or some other ID and maybe a notarization) and use that to sign stuff I want to submit to the IRS? That seems like a simple solution.
https://www.fsf.org/associate/support_freedom
Is this a number you use to call and talk to pins? Can you also talk to needles?
Because if by "PIN" they mean "personal identification number," then a PIN number is a personal identification number number. Which is something you might use with an ATM machine, (an automated teller machine machine) probably for withdrawing out cash-money dollars.
Now to you, did something about that seem redundant to you?
Did they fire everyone who knows how to write or edit?!?
"is just DOSing yourself"
That's why I noted the other criteria (SSN, Name, etc). While an individual fraudster might have detailed information on a few dozen/hundred accounts they probably don't have it for thousands plus accounts (or at least hopefully). If the attempt is missing confidential information that would cause it to fail authentication anyways the PIN attempt wouldn't count towards the account lockout. For those returns that have been compromised to that degree they should probably necessitate more severe security precautions anyways. Maybe a yearly alphanumeric token mailed to their home. Unfortunately you'll never stop fraudsters by locking out connections, bot-nets, proxies, etc all make it impossible to do. It should probably be a first line of defense (a few hundred filings from a single residential IP should definitely result in a short ban of that IP) but its a pretty easy precaution to bypass.
Hey Nanook! Go buy yourself a sunlamp, and put it under the truck so you can start it up in the morning.
There's more ice in your brain than there is in the Article Ocean.
On the contrary, make them actually serve. They should fill out our tax forms. They have all the W-2s.
“He’s not deformed, he’s just drunk!”
A nice simple flat tax with no writeoffs.
Or better yet a nice simple consumption tax like the Fair Tax.
Problem solved.
But of course this takes power away from the elites. It takes away elite's favors to each other. And it takes the power these elites have over the ignorant.
So obviously all Democrats and Half of the Republicans will be against these solutions.
All this crap just because tax preparation companies throw lobbying money to keep the current system. Most Americans would not need to actually file for taxes, the IRS already has all the data it needs, but noooo we have to keep an obsolete industry going no matter the cost...
Donald Trump's position on tax reform eliminates much of the paperwork. If you're single and earn less than $25,000 or jointly earn less than $50,000 you pay no tax. Send in a single-page form and you're done.
There's not a lot of federal income to be had from low wage earners, so it makes perfect sense to eliminate the extra work on both sides. Also, poor people don't have to spend money on tax filing services (H&R Block, et al).
Poor people get to keep more of their money, the IRS has a lot less work to do (estimated 75 million households), and the federal government gets just as much revenue.
Hillary Clinton doesn't have a unified plan to reform tax reporting (posted on her website).
If you think this issue is important, elect Hillary and nothing will change.
That's why I noted the other criteria (SSN, Name, etc).
In most companies, anyone who works in HR has access to name/SSN for all employees. Employees at hospitals and clinics have access to name/SSN of all patients. When I was in the military, my name/SSN was printed on hundreds of routine forms, often in triplicate. SSNs are not private information, and we shouldn't pretend that they are.
You'd better hope the US doesn't decay too much or too far. One of the hallmarks of failed republics is to become an aggressor-state to prop up the failing system, and Canada would be a tempting and convenient target for US annexation and subsequent plundering of it's wealth and resources.
Hmm...No, I think we already have plenty of maple syrup.
The US has the very real potential to become the greatest threat to the world since Nazi Germany if it goes full-fascist/socialist-oligarchy, which is a distinct possibility if/when the US economy and currency collapses, particularly if there's a 'cult of personality' populist-demagogue type of leader like Trump in charge at the time.
That's quite an if. Europe is much closer to that than the US is. Hell, in the bugger EU nations some 25% of their voters vote for actual self proclaimed fascists. And for all of the things you can say about Trump, fascist just doesn't fit at all. Sure, he's a loudmouth blowhard, and some people think that makes him dangerous, but it really doesn't.
The IRS won't accept liability for its wrong actions on your behalf. If it calculates your taxes wrong, you're liable for the error and penalties related - even though they did the work (and yes, you can ask them to do your taxes for you).
Browsing at +1 - no ACs, I ignore their posts. So refreshing!
in most cases you could send your annual declaration by net.
However, validating your ID or setting bank account for returns require some contact (visit) at the tax or local office.
You keep using that word...
Canada population 35 mil and no military. Right...
Everybody hates the IRS. Boo, hiss. People cheer whenever the IRS gets defunded in any amount, it makes them happy, because they don't have a fucking clue how things work (how quintessentially American.)
The IRS has had to make do without proper support, and shit like this is the result.
This shit happened on Obama's watch by the way. YEAH it's his fucking failure to own. Let's not pretend he isn't the head nigga in charge of the country. Just add it to the list.
https://www.yubico.com/
The solution is easy and cheap. Heck Chrome already supports it, and Mozilla has a plug-in.
W-2s are the easy part, and if you take the standard deduction they are probably enough for the IRS to do your taxes for you. But, there are lots of other things that come into play:
- State income taxes are deductible.
- Capital gains are taxed at different rates depending on how long the asset was held, and only on the gain in value, with losses offsetting gains
- Mortgage interest is deductible.
- Property taxes are deductible
Plus a whole host of more complicated situations. If you have only wage income and take the standard deduction, it is simple. But that is also where 1040EZ comes in to play, which is already a single page form.
Canada population 35 mil and no military. Right...
Canada gets invaded by forest fires, not countries. What's wrong with not having to spend money on a military? We send $2000 per capita to the Pentagon. I could buy an AR-15 every six months with that kind of money.
Now if Trump wins, he might tell Canada "we're tired of wasting money defending you" etc. In that case their military expenditures might go up. Even so, if that happens I'm going to find some Canadian to marry and so is my wife.
Right, all those statements are also reported to the IRS, they have everything they need. If they have questions, they can call the banks, brokers, or those other government offices. They can leave us alone, expect when it's time to send the refund.
“He’s not deformed, he’s just drunk!”
We don't spend money defending Canada. The US does maintain radar installations to pick up Russian missiles streaking over the pole, but that's not for Canada's benefit. Canada doesn't spend much on its military because there isn't any need - they maintain friendly relations with the US and everybody else is too far away.
I would add it is a decision which could be revisited should conditions warrant. At the end of WW II Canada had the third most powerful navy in the world, behind the US and the UK.
There have been so many major database leaks at this point that I feel it's a given that your name, address, SSN, etc are probably in the hands of nefarious people.
Remember when Slashdot reported multiple databases holding detailed information on millions of U.S. voters were publicly available online?
One had 154 million voters with names, addresses, social networking accounts, etc.
If you google database leaks you'll see leaks involving hundreds of thousands of records that include social security numbers.
Just wait for that Operation Greenland, or Northern Expansion. The game publishers have yet to address those scenarios. Call of Duty, where have you gone?
Secrecy via public knowledge. This might be the biggest reason for the large number of data breaches in the USA. Another being that corporations store the details of their international customers in the USA.
No, what makes Trump dangerous is that nobody knows what his actual agenda is for his presidency, because nobody sane can believe the constant stream of lies he's spewing. That suggests to me that his agenda is something that would not get him elected if people actually knew anything about it.
Captcha: Damning
No, what makes Trump dangerous is that nobody knows what his actual agenda is for his presidency, because nobody sane can believe the constant stream of lies he's spewing. That suggests to me that his agenda is something that would not get him elected if people actually knew anything about it.
Captcha: Damning
It really doesn't matter what kind of "agenda" he has. This isn't a communist country; the president doesn't have unlimited power.