IRS says thieves stole tax info from 100,000 • Hacker News Board

Re: IRS says thieves stole tax info from 100,000

#101

Post by ptaipale » Wed, May 27, 2015, 4:36 PM UTC

paulhauggis wrote: post #100

ptaipale wrote: post #93

Earlier quoted context omitted.

Shouldn't that work with companies as well, not just IRS? Take for example some large corporations. I.e. if Amazon or Google stores their customer information carelessly, and someone steals it - then Amazon would be victim, and if you say that they should have protected the information, you are blaming the victim because you don't like them? The American revenue service has even larger resources and also a larger res…

"and if you say that they should have protected the information, you are blaming the victim because you don't like them?" If we only blamed Amazon in your example, then yes, we would only be blaming the victim. How do we know they were "careless"?? They could have been using all of the correct security precautions and still got the data stolen. It could have been an employee that installed malware because they fell f…

There is a fundamental difference between HN and the IRS (for Americans, and corresponding agencies of the government for people in other countries): using HN is completely voluntary. Giving your personal information in a tax return is mandatory and not complying is punished severely.

In my opinion, this sets the required standard to a completely different class. The tax services have an important responsibility to process their information in a secure way. The information needs to be protected against leaks.

And from the outcome we can see that the protections are not adequate.

Re: IRS says thieves stole tax info from 100,000

#102

Post by chmaynard » Wed, May 27, 2015, 5:07 PM UTC

zaroth wrote: post #5

Krebs wrote about this in March: http://krebsonsecurity.com/2015/03/sign-up-at-irs-gov-before... He has some good advice; claim your account before someone else does.

After Brian Krebs exposed this security loophole in March 2015, the IRS apparently did nothing. Why doesn't the IRS site allow users to create a secure account? For example, see the Social Security site at https://secure.ssa.gov/.

Re: IRS says thieves stole tax info from 100,000

#103

Post by paulhauggis » Wed, May 27, 2015, 5:40 PM UTC

ptaipale wrote: post #101

paulhauggis wrote: post #100

Earlier quoted context omitted.

"and if you say that they should have protected the information, you are blaming the victim because you don't like them?" If we only blamed Amazon in your example, then yes, we would only be blaming the victim. How do we know they were "careless"?? They could have been using all of the correct security precautions and still got the data stolen. It could have been an employee that installed malware because they fell f…

There is a fundamental difference between HN and the IRS (for Americans, and corresponding agencies of the government for people in other countries): using HN is completely voluntary. Giving your personal information in a tax return is mandatory and not complying is punished severely. In my opinion, this sets the required standard to a completely different class. The tax services have an important responsibility to p…

"In my opinion, this sets the required standard to a completely different class. The tax services have an important responsibility to process their information in a secure way. The information needs to be protected against leaks."

There is no way to protect leaks 100%. So you have unrealistic expectations.

Re: IRS says thieves stole tax info from 100,000

#104

Post by jsat » Wed, May 27, 2015, 5:40 PM UTC

ceejayoz wrote: post #72

jsat wrote: post #35

Imagine if all government software was open source and significant bug reports and contributions were rewarded with cash... I hope we reach some happy medium between that and what we have today in the future.

This wasn't a hack or a bug - open source software built to do the same thing would've been just as vulnerable to this. Per the article, the attackers had to put "the taxpayer’s Social Security number, date of birth, address and tax filing status" into a form to get access.

I see. Maybe the additional exposure would have shed light on the risk involved?

Re: IRS says thieves stole tax info from 100,000

#105

Post by mdavidn » Wed, May 27, 2015, 5:56 PM UTC

ceejayoz wrote: post #70

malchow wrote: post #51

If this were a company, the headline would have been "IRS hacked; tax information stolen from 100,000." Instead the IRS was able to spin it to The Washington Post. The headline is "thieves stole tax info." Thieves! The real headline is that the IRS is hackable.

> The real headline is that the IRS is hackable. That's not borne out in the slightest by what we know from the article. These people might've been phishing victims - you wouldn't claim a bank is hackable because people entered their bank password on a phishing site.

But these aren't phishing victims. The IRS deployed a system which returns a treasure trove of personal information to anyone who presents a few shared secrets. This is a fundamentally flawed authentication mechanism devised by the IRS.

Re: IRS says thieves stole tax info from 100,000

#106

Post by ceejayoz » Wed, May 27, 2015, 6:13 PM UTC

mdavidn wrote: post #105

ceejayoz wrote: post #70

Earlier quoted context omitted.

> The real headline is that the IRS is hackable. That's not borne out in the slightest by what we know from the article. These people might've been phishing victims - you wouldn't claim a bank is hackable because people entered their bank password on a phishing site.

But these aren't phishing victims. The IRS deployed a system which returns a treasure trove of personal information to anyone who presents a few shared secrets. This is a fundamentally flawed authentication mechanism devised by the IRS.

Those shared secrets were likely obtained by either phishing or a data breach. There's no indication thus far that the IRS was the source of the information that let people obtain these returns.