Forgot your password?
typodupeerror
Canada Bug Government Security IT Your Rights Online

Canada Halts Online Tax Returns In Wake of Heartbleed 50

Posted by timothy
from the worse-than-a-syrup-heist dept.
alphadogg (971356) writes "Canada Revenue Agency has halted online filing of tax returns by the country's citizens following the disclosure of the Heartbleed security vulnerability that rocked the Internet this week. The country's Minister of National Revenue wrote in a Twitter message on Wednesday that interest and penalties will not be applied to those filing 2013 tax returns after April 30, the last date for filing the returns, for a period equal to the length of the service disruption. The agency has suspended public access to its online services as a preventive measure to protect the information it holds, while it investigates the potential impact on tax payer information, it said."
This discussion has been archived. No new comments can be posted.

Canada Halts Online Tax Returns In Wake of Heartbleed

Comments Filter:
  • Honest? (Score:4, Insightful)

    by RichMan (8097) on Thursday April 10, 2014 @09:32AM (#46713259)

    Is this the most honest response? The Canadian banks as a group say "our procedures mean we were never at risk".
    http://www.cbc.ca/news/busines... [www.cbc.ca]
    Who do you trust more to be truthfull?

    Is there any incentive for the banks to be honest about this?

    • by Anonymous Coward

      Only OPENSSL is affected. Run the heatbleed test against most Candian Banks they are fine.

      We have multiple HTTPS systems at work and only 1 of them was affected by this bug.
      No need to have your tinfoil hat on if you test with http://filippo.io/Heartbleed

    • by Anonymous Coward

      They probably just aren't running TLS 1.2. Openssl 0.9.8 isn't vulnerable.

    • Re:Honest? (Score:5, Informative)

      by compro01 (777531) on Thursday April 10, 2014 @10:49AM (#46714211)

      Testing does back up the bank's claims. RBC, CIBC, TD, Scotia, BMO, CWB, PCF, Tangerine, all of them show as unaffected on Filippo's tester [filippo.io].

      • Banks not lying? Wow, you really showed me. I should move all my banking to Canada, if I could.

        And no, I am not being sarcastic. I am too used to my country's banks and their MO, so it's kinda shocking to know some banks operate with a minimum of honesty.

    • Or it could be that banks lie. A lot.

  • Can Canadians still file their returns by mail, or do they have to use the Internet?

    • by Frederic54 (3788)
      We can do it the old way by mailing paper, yes. I filled my first one in 1997 via paper, and since 1998 I do it online :)
      • The one thing government has streamlined is the tax collection process.
        • by CastrTroy (595695)
          Most Canadians I know end up getting money back at the end of the year. It's specifically designed this way because it's much easier to take the money out of people's paycheques then to get them to send you a cheque at the end of the year.
          • by Obfuscant (592200)

            It's specifically designed this way because it's much easier to take the money out of people's paycheques then to get them to send you a cheque at the end of the year.

            The US withholding system was designed with this in mind. Also, perhaps just as important, it hides the true amount you are paying in taxes. You don't have to write a check for $12,000 so you're less likely to remember a month after you file that you actually did pay that much, but you'll remember you got $100 BACK! In my case I planned ahead to avoid a federal penalty for underpayment and wound up with a large "refund", which because I couldn't do the same for the state means I send them almost every penn

        • Actually, governments federal and provincial have streamlined a lot of the services they provide. In fact, in at least one case I can think of, major inefficiencies are starting to crop up because they've trimmed too much fat. Employment Insurance (including sick leave and parental leave), for example, takes a month or more to get not because of the process, but because they don't have enough operators answering the phones.

          • you make it sound like that it wasn't planned that way. EI is a major profit center for the federal gov't [it is VERY cash positive].

    • by mark-t (151149)

      It's inconvenient to do it the old way these days... they don't even mail out the forms anymore, as far as I know, you have to go get one yourself if you want to do it that way.

      But it's still definitely possible.

      • I'm pretty sure they are all downloadable and printable. And you might be able to get one from the post office? I can't remember them ever mailing them out preemptively. Now they have stopped mailing out the remittance stickers or forms or whatever they are, which makes it a lot harder to pay your taxes at the bank.

      • by Tridus (79566)

        Tax software can also just print off completed forms, which you can then mail. In fact there are certain cases where you can't netfile.

        They don't mail out forms because it's a huge waste of money and paper to send forms to people that are using software.

    • by Michalson (638911)
      Canadians can still file by mail just fine. The difference is in timing - if you file by mail it will take the longest to get a refund if you had one coming. If you file online you'll get it faster, and if you file it online and have signed up for direct deposit they have/had an advertised time of 8 days between filing and getting your refund deposited. Basically the less manual paper stuff that has to be processed and shuffled around, the faster the Canadian Revenue Agency will process your return.

      On the
  • by swillden (191260) <shawn-ds@willden.org> on Thursday April 10, 2014 @10:39AM (#46714061) Homepage Journal

    I thought about this last night, as I was working on my taxes. A lot of my tax information has moved on-line and so to complete my return I needed to log into bank, brokerage, mortgage lender and other web sites... sites I'd really prefer to avoid logging into right now until I'm sure they've been made safe. I did test each of them with a Heartbleed testing tool before logging in, but most people won't know to do that. I really wish the US had opted to move the filing date back a week or two.

    • by Anonymous Coward

      After some tests I noticed that at least a few large banks, brokers, and other companies are blocking the heartbleed test sites so if you use one of them you can't be sure.

    • by HungWeiLo (250320)

      Just because it's safe now doesn't mean they were safe a week ago. Presumably your data was there a week ago as well.

      • by swillden (191260)
        My data was, yes, but if I hadn't logged in it's vanishingly unlikely that my data was in the process space to be harvested. Heartbleed doesn't provide the attacker with a route to start reading databases used by web apps.
  • Don't worry. You can't hear her anyway because she's going to whisper through the whole thing.

  • Would Heartbleed affect those who use a preparation software like TurboTax and then e-file directly through the program? Or does it only affect the people who are using the website to fill out the form?

    When you E-File through TurboTax, no password is necessary, and no account is necessary. You do have to enter your bank account number if you want direct deposit, but that's it.

    I'm not well-versed in sockets and layers and all that. My experience is in other areas. But I'd like to know, because I'm just a

    • In both the desktop and web version of Turbo Tax, you still download a ".tax" file that you then have to log into the government site and upload (known as Netfile). You do not file directly using the TurboTax software. So this will block both desktop and web-based TurboTax users. The only information required to access NETFILE is your Date of Birth and your Social Insurance Number. But you probably don't want people get a hold of that information either. Or your bank account if it is included in the file y
      • My mistake. It turns out that the online version now allows you to submit directly, without the need for a intermediate file. I believe both were offline, but of course both are online now.
  • by Anonymous Coward

    CRA is looking pretty good on this one.

    They acknowledged the problem and shut the system down to correct it. No hiding, no misdirection, no CYA. The problem wasn't created by them but they live with it's consequences. They extended the deadline by the time taken to correct the problem. And they took action quickly and the correction timeline looks very reasonable to me.

    I say good on the CRA, and that's not something you often hear about the tax man.

We gave you an atomic bomb, what do you want, mermaids? -- I. I. Rabi to the Atomic Energy Commission

Working...