4 ms·

"but it was pulling sensitive information, including unmasked Social Security numbers and employee banking information" Did ADP just admit they keep SSN and ba

"but it was pulling sensitive information, including unmasked Social Security numbers and employee banking information" Did ADP just admit they keep SSN and banking information in plain text on their servers???

CPLX 11y ago
No, but they admitted you can access that information if you are logged into an account. If you have figured out a way to do something like print a employee's copy of an IRS form like a W-2 or 1099 without having plaintext SSN information involved in the process I would sure be curious to hear about it.
- tzs 11y ago
  That raises an interesting question. Why is my SSN printed on my W-2? Presumably I already know my SSN, so do not need the W-2 to remind me of it.
  - CPLX 11y ago
    Because the SSN is the "primary key" for pretty much all interactions with the taxing authorities. That's why it's called a "Taxpayer Identification Number" and so on. Sure it's a sensitive piece of info, at least to some extent, but it's not some highly classified secret. Putting it on tax forms is sort of the point.
    - tzs 11y ago
      Right, which is why it needs to be on everything I send to the IRS, or that my employer (or their agents such as payroll companies) send to the IRS concerning me. But I don't see why it needs to be on things my employer (or their agents) send to me. Sure, SSN is not some highly classified secret, and it is on enough things it does not need to be on that having it on W-2 probably doesn't noticeably cause any extra harm. I'm just curious if it actually needs to be there. If I'm doing my tax return on paper instead of electronically, and need to physically attach a copy of my W-2, I can fill in the SSN field, just like I filed in the SSN field on the top of the 1040. Having the SSN on the form then, when it goes to the IRS makes sense so that they can match it up to the 1040 if it becomes separated from it accidentally [1]. If I'm doing my tax return electronically, the IRS uses the W-2 information they get from my employer (or its agents) electronically. The paper W-2 is really just to let me know the pay and withholding numbers so I can fill out my returns. [1] Well, maybe not. It did back in the days when they actually looked at the physical W-2, but now I believe they get an electronic copy even if the taxpayer is not filing electronically, and so I don't think they look at the attached W-2. In fact, I vaguely recall the last time I filed a paper return being told not to attach my W-2, although I'm not certain of that.
      - hundt 11y ago
        One reason could be so that you could verify that your information was sent to the IRS with the correct SSN.
      - CPLX 11y ago
        I'm not sure that entirely makes sense. This presupposes that your name and salary information is somehow less sensitive information than your SSN, and ignores the fact that essentially the entire point of the form existing at all is to document the statement "Please match SSN [X] with income [Y]" and removing one of those two pieces of data defeats that purpose.
function_seven 11y ago
Not at all. They said that Zenefits was pulling that info from their servers. ADP is probably not happy with the the prospect of Zenefits being a potential breach source for that info.
dsr_ 11y ago
Worse, that "in a manner that did not comply with ADT's standards for... security". So apparently you can retrieve sensitive information from them insecurely.
- MarkPNeyer 11y ago
  if you can view the info you've put on then site, the yes. it sounds like zenefits was scraping the personal ui. how could you display someone's social security number to them so that a screen grabber couldn't' get it?
  - pki 11y ago
    as a heavily mangled captcha?
tzs 11y ago
No. They admitted they keep it in some form that can be converted to plain text. I would expact that they need SSN for reporting to the IRS, and bank information for direct deposit. If they are following proper security practices, these will be encrypted on the servers, and get decrypted as needed. I'm not familiar with what clients can do via the administrative interface, so don't know if it is reasonable to provide access to the decrypted data over that interface.
deleted 11y ago
[deleted]

CPLX 11y ago

No, but they admitted you can access that information if you are logged into an account. If you have figured out a way to do something like print a employee's copy of an IRS form like a W-2 or 1099 without having plaintext SSN information involved in the process I would sure be curious to hear about it.

tzs 11y ago
That raises an interesting question. Why is my SSN printed on my W-2? Presumably I already know my SSN, so do not need the W-2 to remind me of it.
- CPLX 11y ago
  Because the SSN is the "primary key" for pretty much all interactions with the taxing authorities. That's why it's called a "Taxpayer Identification Number" and so on. Sure it's a sensitive piece of info, at least to some extent, but it's not some highly classified secret. Putting it on tax forms is sort of the point.
  - tzs 11y ago
    Right, which is why it needs to be on everything I send to the IRS, or that my employer (or their agents such as payroll companies) send to the IRS concerning me. But I don't see why it needs to be on things my employer (or their agents) send to me. Sure, SSN is not some highly classified secret, and it is on enough things it does not need to be on that having it on W-2 probably doesn't noticeably cause any extra harm. I'm just curious if it actually needs to be there. If I'm doing my tax return on paper instead of electronically, and need to physically attach a copy of my W-2, I can fill in the SSN field, just like I filed in the SSN field on the top of the 1040. Having the SSN on the form then, when it goes to the IRS makes sense so that they can match it up to the 1040 if it becomes separated from it accidentally [1]. If I'm doing my tax return electronically, the IRS uses the W-2 information they get from my employer (or its agents) electronically. The paper W-2 is really just to let me know the pay and withholding numbers so I can fill out my returns. [1] Well, maybe not. It did back in the days when they actually looked at the physical W-2, but now I believe they get an electronic copy even if the taxpayer is not filing electronically, and so I don't think they look at the attached W-2. In fact, I vaguely recall the last time I filed a paper return being told not to attach my W-2, although I'm not certain of that.
    - hundt 11y ago
      One reason could be so that you could verify that your information was sent to the IRS with the correct SSN.
    - CPLX 11y ago
      I'm not sure that entirely makes sense. This presupposes that your name and salary information is somehow less sensitive information than your SSN, and ignores the fact that essentially the entire point of the form existing at all is to document the statement "Please match SSN [X] with income [Y]" and removing one of those two pieces of data defeats that purpose.

function_seven 11y ago

Not at all. They said that Zenefits was pulling that info from their servers. ADP is probably not happy with the the prospect of Zenefits being a potential breach source for that info.

dsr_ 11y ago

Worse, that "in a manner that did not comply with ADT's standards for... security". So apparently you can retrieve sensitive information from them insecurely.

MarkPNeyer 11y ago
if you can view the info you've put on then site, the yes. it sounds like zenefits was scraping the personal ui. how could you display someone's social security number to them so that a screen grabber couldn't' get it?
- pki 11y ago
  as a heavily mangled captcha?

tzs 11y ago

No. They admitted they keep it in some form that can be converted to plain text. I would expact that they need SSN for reporting to the IRS, and bank information for direct deposit. If they are following proper security practices, these will be encrypted on the servers, and get decrypted as needed. I'm not familiar with what clients can do via the administrative interface, so don't know if it is reasonable to provide access to the decrypted data over that interface.

deleted 11y ago

[deleted]