A Potentially Tax-ing Problem

For most Americans out there, April marks our most hated time of year - tax season. While I understand this topic may be a good two weeks past its prime, I couldn't shake a nagging feeling after filing my taxes. With the IRS recently adoption of eFiling as the defacto standard for filing taxes, has society yet again forsaken security for speed?

Sure, you can still file the old fashion way, good ol' snail mail. This of course, comes with a few more weeks of waiting for your return (if you're lucky enough to get one) and tends to be more error prone than the online alternative. Therefore, its no surprise that more and more Americans are filing electronically. Sure, electronic filing has it benefits - no one will argue that. However, I would be remiss to state that the benefits out way the potential harmful consequences.

Taking a step back, last week as I was reading through my tradition sites, I noticed a story on digg informing users that Valve was hacked. Turns out that a friend of mine had an account with them. When he found out, his first reaction was that he needed to cancel his credit card. Smart move.

Now what would happen if a tax server were successfully hacked? You can't simply call up the government and request to cancel your social security number (well... you can, but they offer very few SSNs every year, and even if you get one, you literally start your life over - e.g. no credit history, etc). Let's take a second and think about this: What information is required when filling out taxes? Name, address, SSN, birthday, marital status, work history, salary, etc, etc, etc. Seems like a delicious amount of PII (Personally Identifiable Information). Identity theft anyone?

Am I too paranoid? I think not. I admit I file my taxes online (yes, I know I probably shouldn't - unfortunately it's too late for me), and this year I couldn't remember my password. "Forgot Password"? Why yes, yes I did. Of course, I was a little surprised to find the following email in my inbox:


Yes, they did indeed send me my password in plain text. Of course, this means they more than likely store it on their servers as plain text. Even entry level college courses stress the need to hash passwords to keep the information from hackers as well as 'curious' employees. On top of that, many mail clients do not connect over SSL, which then leaves open the possibility of sniffing the email. I would honestly like to see more from a company holding that much of my information.

Needless to say, I have my concerns.