IRS Gets Hacked Again, Forced To Scrap Their Entire PIN System (engadget.com) 104
The IRS has abandoned a system of PIN numbers used when filing tax returns online after they detected "automated attacks taking place at an increasing frequency," adding that only "a small number" of taxpayers were affected. An anonymous reader quotes the highlights from Engadget:
The IRS chose not to kill the tool back in February, since most commercial tax software products use it... If you'll recall, identity thieves used malware to steal taxpayers' info from other websites, which was then used to generate 100,000 PINs, back in February... This time, the IRS detected "automated attacks taking place at an increasing frequency" thanks to the additional defenses it added after that initial hack... the agency determined that it would be safer to give up on a verification method that's scheduled for the chopping block anyway.
Wise move (Score:2)
Nice to see the IRS doing something smart, contrary to all stereotypes and expectations.
Re: (Score:2)
Government agency spends more money than they have to. People complain.
Government agency saves money. People complain.
This is called a lose-lose situation.
Re:Wise move (Score:4, Interesting)
That's because whenever a government agency decides to "save money" they do so in the dumbest possible way, which almost always costs them more later. Not that corporations never do this, but with government bureaucracies they seem to be a special kind of stupid.
Re: (Score:1)
One way out: have less government.
Then people will bitch about the Wal-Mart or FedEx store or whatever.
Re: (Score:2, Interesting)
Some neck beard has to make a comment about PIN numbers!
I've always been curious about the epithet. People have beards just on their necks? That's odd, but why should we care?
It's like "mouth breather"-- we care about whether people breathe through their nose or their mouth or both? Why?
Re: (Score:2)
Re: (Score:2)
This should clear things up: http://www.neckbeard-news.com/ [neckbeard-news.com]
Re:in before (Score:4, Informative)
Some neck beard has to make a comment about PIN numbers!
No beard here, but I an a crypto/security type person.
The PIN codes are very low entropy. They don't give the option for a nice high-entropy long password that you can keep in you password manager. So it's no surprise that there are automated attacks.
It also seems (Score:2)
It also seems you are very proficient in duplicate troll-posting. Kudos.
Re: (Score:2)
Canada population 35 mil and no military. Right...
Re: (Score:2)
Canada population 35 mil and no military. Right...
Canada gets invaded by forest fires, not countries. What's wrong with not having to spend money on a military? We send $2000 per capita to the Pentagon. I could buy an AR-15 every six months with that kind of money.
Now if Trump wins, he might tell Canada "we're tired of wasting money defending you" etc. In that case their military expenditures might go up. Even so, if that happens I'm going to find some Canadian to marry and so is my wife.
Re: (Score:3)
We don't spend money defending Canada. The US does maintain radar installations to pick up Russian missiles streaking over the pole, but that's not for Canada's benefit. Canada doesn't spend much on its military because there isn't any need - they maintain friendly relations with the US and everybody else is too far away.
I would add it is a decision which could be revisited should conditions warrant. At the end of WW II Canada had the third most powerful navy in the world, behind the US and the UK.
Crazy question (Score:1)
Wouldn't filing dozens/hundreds of fraudulent returns with the wrong PIN be pretty easy to spot? While attackers may be able to mask their location/identity through various means they can't mask which account they're trying to penetrate, just lock down an account if too many wrong PINS are used with a decent amount of other information that is correct (SSN, name, etc). This should prevent fraudulent access while limiting the ability of attackers to try to lock-down the entire system by spamming it.
The Broken MS Windows fallacy. Try 250 accounts. (Score:5, Insightful)
> Just lock down an account if too many wrong PINS are used
The bad guys don't care which account they access. Suppose you limit it to four tries at a PIN. The bad guys try 250 accounts with four PINs each, not one account with a thousand PINs.
Locking out the account rather than the attacker is just DOSing yourself. I like to call this the Broken MS Windows fallacy, because Windows does it.
Re:The Broken MS Windows fallacy. Try 250 accounts (Score:5, Informative)
That's why I noted the other criteria (SSN, Name, etc).
In most companies, anyone who works in HR has access to name/SSN for all employees. Employees at hospitals and clinics have access to name/SSN of all patients. When I was in the military, my name/SSN was printed on hundreds of routine forms, often in triplicate. SSNs are not private information, and we shouldn't pretend that they are.
Re: (Score:2)
There have been so many major database leaks at this point that I feel it's a given that your name, address, SSN, etc are probably in the hands of nefarious people.
Remember when Slashdot reported multiple databases holding detailed information on millions of U.S. voters were publicly available online?
One had 154 million voters with names, addresses, social networking accounts, etc.
If you google database leaks you'll see leaks involving hundreds of thousands of records that include social security numbers.
Re: (Score:3)
You have a quarter billion (more if you include business) tax returns, most PIN being the birth year of the individual (common practice amongst accountants) or something equally stupid (1234, 0000). Since it is only used once a year, most people don't use a custom PIN like a bank card.
Re: (Score:2)
most PIN being the birth year of the individual ... or something equally stupid (1234, 0000)
I was not given an option to select a PIN. It was randomly generated by the IRS. And it was five digits, not four.
Obvious solution: Since the numbers are random, people are going to record them anyway, so just add extra digits. Make it 10 digits instead of 5, and the problem is basically solved.
Re: (Score:2)
I was not given an option to select a PIN. It was randomly generated by the IRS.
Interesting. When I've filed electronically the last five years or so, I've been instructed to self-select a PIN. For most of those years I was using TaxAct.com - but even this year, when I used freefillableforms.com, I also selected my own PIN.
Re: (Score:2)
I used TurboTax. So maybe the PIN was from Intuit, rather than the IRS.
All this crap... (Score:5, Insightful)
All this crap just because tax preparation companies throw lobbying money to keep the current system. Most Americans would not need to actually file for taxes, the IRS already has all the data it needs, but noooo we have to keep an obsolete industry going no matter the cost...
Re: (Score:1)
Just shut the fuck up with this libertarian caveman bullshit or whatever you think this is.
The 16th Amendment was passed explicitly to allow this central taxation: "The Congress shall have power to lay and collect taxes on incomes, from whatever source derived, without apportionment among the several States, and without regard to any census or enumeration."
https://en.wikipedia.org/wiki/Sixteenth_Amendment_to_the_United_States_Constitution [wikipedia.org]
Re: (Score:1)
Well, to be fair, the amendment should be repealed. The federal government should only collect taxes from and regulate the states, not individuals. But if we are going to delegate authority, we should demand some service. The IRS has all the paperwork at their fingertips. Let's make them fill it out.
Re:All this crap... (Score:5, Insightful)
Posting AC for obvious reasons...
I have a Hong Kong company that I own. Before I started it, I read the ENTIRE Hong Kong tax law. It was 187 pages - and each page was half English, half Cantonese. So about 95 US pages. It works, it's simple, it's direct, and it's 100% understandable.
The US code is so confusing and so long and SO self-contradictory that the IRS doesn't even guarantee it's own calculations! If you ask them to do your taxes for you (which is entirely legal, they offer that service), and they do it wrong - you're still at fault for their error. One tax return, sent to 6 different preparers, will most likely end up with 6 different numbers owed - which may be different than what the IRS believes in the first place.
The US IRS tax system is set up to make us ALL guilty of tax fraud so that, if nothing else, we could be arrested and jailed for that violation. We're vassals and servants, not citizens.
It also explains why there are tens of thousands of armed IRS agents, equipped with REAL assault rifles (fully automatic, short barrel carbines) and other real military-grade equipment.
Re: (Score:2)
The US IRS tax system is set up to make us ALL guilty of tax fraud
No, it isn't. It's just the result of a hundred or so years of feature creep and kludges meant to encourage/discourage certain behaviors in the population (like mortgage interest deductions to encourage home ownership) and to favor certain businesses as a result of lobbying and cronyism. It sucks, and it should be simplified drastically, but the tax preparation lobby is now very powerful and strongly resists efforts to make taxes easier.
It also explains why there are tens of thousands of armed IRS agents, equipped with REAL assault rifles (fully automatic, short barrel carbines) and other real military-grade equipment.
This is just untrue. The IRS' enforcement division has a payroll of
Re: (Score:2)
I think you misunderstand what the OP was talking about. What he's saying is that the IRS has enough information that they can calculate taxes for most people and it wouldn't require them to file. This is done in other countries. Reference #2 in the following link:
http://www.vox.com/2016/4/8/11... [vox.com]
Trump's tax plan (Score:4, Insightful)
All this crap just because tax preparation companies throw lobbying money to keep the current system. Most Americans would not need to actually file for taxes, the IRS already has all the data it needs, but noooo we have to keep an obsolete industry going no matter the cost...
Donald Trump's position on tax reform [donaldjtrump.com] eliminates much of the paperwork. If you're single and earn less than $25,000 or jointly earn less than $50,000 you pay no tax. Send in a single-page form and you're done.
There's not a lot of federal income to be had from low wage earners, so it makes perfect sense to eliminate the extra work on both sides. Also, poor people don't have to spend money on tax filing services (H&R Block, et al).
Poor people get to keep more of their money, the IRS has a lot less work to do (estimated 75 million households), and the federal government gets just as much revenue.
Hillary Clinton doesn't have a unified plan to reform tax reporting (posted on her website).
If you think this issue is important, elect Hillary and nothing will change.
Re: (Score:2)
Yes, because Americans wouldn't think twice about hiding their income to get under the $50,000. The already skip out on about $450 Billion a year they should be paying, Bam-Bam and his pseudo-policy isn't going to change that.
Re:Trump's tax plan (Score:5, Insightful)
Re: (Score:2)
Donald Trump's position on tax reform [donaldjtrump.com] eliminates much of the paperwork. If you're single and earn less than $25,000 or jointly earn less than $50,000 you pay no tax. Send in a single-page form and you're done.
So they pretty much still have to file, basically ("send in a single-page form").
Plus you neglect to mention that he's getting rid of the Earned Income Tax Credit - that'll save the government a bunch of money as well, at the expense of the poorest of the poor.
Re: (Score:3, Insightful)
You are blaming the wrong party, Einstein. Congress created the Swiss cheese that is the U.S. tax code. And the latest estimate is the sainted American people are skipping out on about $450 Billion in taxes they should be paying. That's enough to cover the yearly deficit.
By the way, the IRS does not have all the data they need and they don't even have enough compute power to process what they do get. Congress has seen fit to starve them for the same idiot reasons you think they are to be held to account. If
Re:All this crap... (Score:4, Informative)
You are blaming the wrong party, Einstein. Congress created the Swiss cheese that is the U.S. tax code. And the latest estimate is the sainted American people are skipping out on about $450 Billion in taxes they should be paying. That's enough to cover the yearly deficit.
Not quite. The US Debt as of 10/1/2015 (start of FY2016) was $18.15 trillion. It's now $19.26 trillion [treasurydirect.gov]. So that's about $1.1 trillion added in 9 months, or about $1.46 trillion annually. About 4 times your estimate of uncollected taxes. That $450 billion would help, but would get nowhere NEAR to eliminating the actual annual deficit (not the fake, "on budget" number that's reported).
Re: (Score:1)
Incorrect: http://www.usgovernmentspending.com/federal_deficit_chart.html $450B comes pretty close. And stop conflating deficit with gross debt, it's more complicated than just adding the deficit to that debt.
Btw, you know the difference between the public portion ($11.6T) and total debt ($19.3T), right?
Re: (Score:2)
Re: (Score:2)
"should be paying" != "congress/president spending like a drunken sailor on shore leave"
Most of us realize that we should spend less or equal to our income. Ideally, less so we can save for large purchases or retirement.
Of course, there are some that live on credit cards (or refinancing their homes at the height of the bubble and withdrawing cash to spend spend spend) but they get "caught up" eventually - usually by declaring bankruptcy.
Re: (Score:2)
Re: (Score:2)
Please run a sting opertion (Score:2)
The checks have to delivered somewhere.
Re: (Score:2)
Plenty of mules willing to work on their own dime for a promise of a 10% return.
"SECURITY MEASURES" = "FINDING OUT" (Score:4, Interesting)
This time, the IRS detected "automated attacks taking place at an increasing frequency" thanks to the additional defenses it added after that initial hack...
The IRS is not alone in this. After entities get hacked, they implement tighter detecting tools and sigh with the false comfort that they "are on top of things."
Look ...
If your storage building is being ransacked and you put up security cameras that show people breaking in, you have not actually SOLVED anything if the thefts continue.
It's not hard, folks: Get a goddam lock.
Easy solution PIV (Score:1)
Re:Easy solution PIV (Score:5, Interesting)
There are plenty of great second factor solutions. The better ones are really easy to use and provide a lot more security. But providers don't want roll out fancy new technology, and users are blissfully unaware of how security works, so they want the same thing that they have had for the last couple of decades.
The upshot is that even when second factors are rolled out, we essentially end up with something no more secure than password and pin, whereas there are beautiful solutions such as FIDO U2F that are ignored.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re:Time to replace the system. (Score:4, Informative)
Re: (Score:1)
I'm still LOLing at the Europeans even today, most of whom are mourning the first of many nations to leave the EU. It's a matter of time before the rest of the EU fails, too. I'm so thankful for being a Canadian, because we are smarter and better than the Europeans and Americans. Unlike the United States and most of Europe, Canada is not a failed state. Look for Canada to become the dominant power as China sinks deeper into recession, the United States spirals downward in decay, and the EU breaks apart at the seams.
You'd better hope the US doesn't decay too much or too far. One of the hallmarks of failed republics is to become an aggressor-state to prop up the failing system, and Canada would be a tempting and convenient target for US annexation and subsequent plundering of it's wealth and resources.
The US has the very real potential to become the greatest threat to the world since Nazi Germany if it goes full-fascist/socialist-oligarchy, which is a distinct possibility if/when the US economy and currency collapses, p
Re: (Score:3)
You'd better hope the US doesn't decay too much or too far. One of the hallmarks of failed republics is to become an aggressor-state to prop up the failing system, and Canada would be a tempting and convenient target for US annexation and subsequent plundering of it's wealth and resources.
Hmm...No, I think we already have plenty of maple syrup.
The US has the very real potential to become the greatest threat to the world since Nazi Germany if it goes full-fascist/socialist-oligarchy, which is a distinct possibility if/when the US economy and currency collapses, particularly if there's a 'cult of personality' populist-demagogue type of leader like Trump in charge at the time.
That's quite an if. Europe is much closer to that than the US is. Hell, in the bugger EU nations some 25% of their voters vote for actual self proclaimed fascists. And for all of the things you can say about Trump, fascist just doesn't fit at all. Sure, he's a loudmouth blowhard, and some people think that makes him dangerous, but it really doesn't.
Re: (Score:2)
No, what makes Trump dangerous is that nobody knows what his actual agenda is for his presidency, because nobody sane can believe the constant stream of lies he's spewing. That suggests to me that his agenda is something that would not get him elected if people actually knew anything about it.
Captcha: Damning
It really doesn't matter what kind of "agenda" he has. This isn't a communist country; the president doesn't have unlimited power.
Re: (Score:1)
Hey Nanook! Go buy yourself a sunlamp, and put it under the truck so you can start it up in the morning.
There's more ice in your brain than there is in the Article Ocean.
Re: (Score:1)
On the contrary, make them actually serve. They should fill out our tax forms. They have all the W-2s.
Re: (Score:3)
Re: (Score:2)
W-2s are the easy part, and if you take the standard deduction they are probably enough for the IRS to do your taxes for you. But, there are lots of other things that come into play:
- State income taxes are deductible.
- Capital gains are taxed at different rates depending on how long the asset was held, and only on the gain in value, with losses offsetting gains
- Mortgage interest is deductible.
- Property taxes are deductible
Plus a whole host of more complicated situations. If you have only wage income an
Re: (Score:1)
Right, all those statements are also reported to the IRS, they have everything they need. If they have questions, they can call the banks, brokers, or those other government offices. They can leave us alone, expect when it's time to send the refund.