4 ms·
Wow. According to several posters in that thread, Intuit was allowing guest users to pull up data from prior years' tax returns (and subsequently file this year
by bbatsell 12y ago
Wow. According to several posters in that thread, Intuit was allowing guest users to pull up data from prior years' tax returns (and subsequently file this year with correct data) by providing only an SSN and not any other form of authentication. If true, that's basically a criminal level of negligence.
- omgitstom 12y agoThat means you could brute force your way into getting someone else's tax return... scary
- thrownaway2424 12y agoThis has always been possible. I knew a guy who bulk downloaded returns from hr block because they required only last name, zip, and partial ssn. He picked a zip where everyone is named Stein and was born at the same hospital (which gets its own ssn shard) and went to town. Naturally they had no rate limiting.
- gaadd33 12y agoHow do you find a zipcode where everyone has the same last name? I'm guessing a very small town several hours from a single hospital?
- thrownaway2424 12y agoWrong it's one of the most populous zips in the nation and I'm being flippant about the name but when you are brute forcing things an unusual probability is all you need.
- gaadd33 12y agoOh seems like it would have been just as easy to grab census data for the past 50 years and run through last names by decreasing frequency. Here I thought you had found a unique zipcode.
- rhizome 12y agoCriminal! If only.
- MarkMc 12y agoCan anyone on HN with a TurboTax account confirm this is true?