Some CRA Accounts Have Been Breached . . . | Page 2 | General financial discussion | Discussion forum

A couple of weeks ago I was ranting about CRA's MyAccount and sign-in partner.

https://www.highinterestsavings.ca/forum/general-financial-discussion/cra-myaccount-security/

Now this breach occurred. However, the more that I read about it, the more that I believe that CRA could have had adequate security but for whatever reason did not. i.e. 2-step verification, Recaptcha option (for preventing 'bots).

In practice, every website that you have an account with has your particular password recorded (this is logical otherwise you couldn't access the website). When (not if) the entity is breached, the criminals stole your userid (which many times is your email address) and, you have to assume, your password. This is why when the breach is reported, the customer is always asked to change his/her password asap.

Folks, you have to assume that every password you have with account with an entity will one day be stolen. With that in mind, create a different password for each application.

I know that they say to change your passwords every 90 days. How about change your passwords every time that a "breach" is reported (this is probably about the same frequency).

I am not a security expert, I am an accountant who has taken auditing courses over 30 years ago. I know an internal control "weakness" when I see it. I am surprised that these IT professionals could not see it.

Patch002 said
A couple of weeks ago I was ranting about CRA's MyAccount and sign-in partner.

https://www.highinterestsavings.ca/forum/general-financial-discussion/cra-myaccount-security/

Now this breach occurred. However, the more that I read about it, the more that I believe that CRA could have had adequate security but for whatever reason did not. i.e. 2-step verification, Recaptcha option (for preventing 'bots).

In practice, every website that you have an account with has your particular password recorded (this is logical otherwise you couldn't access the website). When (not if) the entity is breached, the criminals stole your userid (which many times is your email address) and, you have to assume, your password. This is why when the breach is reported, the customer is always asked to change his/her password asap.

Folks, you have to assume that every password you have with account with an entity will one day be stolen. With that in mind, create a different password for each application.

I know that they say to change your passwords every 90 days. How about change your passwords every time that a "breach" is reported (this is probably about the same frequency).

I am not a security expert, I am an accountant who has taken auditing courses over 30 years ago. I know an internal control "weakness" when I see it. I am surprised that these IT professionals could not see it.  

I second all website that contains financial info etc should have 2-step verification in place, that should be a requirement.

Would rather it take CRA all week to do it right than to rush it.

AFAIK, there are no income tax related payments due to CRA until end of September.

Don’t feel bad, Kidd, many, many people probably wish they were earning enough to have to pay that amount of taxes. A friend of mine complains that she earns too much to take advantage of OAS. You may have a good idea of what I say to her.

"To all the freeloaders riding ON the wagon, you're welcome."

Saying "your welcome" implies that they thanked you for your payment KIDD. Unfortunately it's exactly the opposite. Instead of being thankful for the generous government benefits that you and I pay for, they resent us because we were successful and they were not. BTW, I've got you beat as I will be paying $17,506 at the end of September. That's a total of April's payment on filing and 3 installment payments for me and my wife that I've held off on and my installments are a lot more than yours.

Classic example is my wife's sister. She pays no income tax at all, and gets the GIS, the Ontario Trillium Benefit and the HST refund, but complains that the government doesn't do anything for seniors. She has no idea how much she is benefiting and she was a teacher for 30 years.

pwm said
"To all the freeloaders riding ON the wagon, you're welcome."

Saying "your welcome" implies that they thanked you for your payment KIDD. Unfortunately it's exactly the opposite. Instead of being thankful for the generous government benefits that you and I pay for, they resent us because we were successful and they were not. BTW, I've got you beat as I will be paying $17,506 at the end of September. That's a total of April's payment on filing and 3 installment payments for me and my wife that I've held off on and my installments are a lot more than yours.

Classic example is my wife's sister. She pays no income tax at all, and gets the GIS, the Ontario Trillium Benefit and the HST refund, but complains that the government doesn't do anything for seniors. She has no idea how much she is benefiting and she was a teacher for 30 years.  

Teacher for 30 years with no pension ? What's her secret ?

Teacher for 30 years with no pension ?

Unscrupulous investment advisors from CI convinced her to take the commuted value of her pension and invest it with them. Also they sold her an unreasonable amount of inappropriate life insurance. That's the answer in a nutshell.

pwm said
"To all the freeloaders riding ON the wagon, you're welcome."

Saying "your welcome" implies that they thanked you for your payment KIDD. Unfortunately it's exactly the opposite.

Not everyone like that. I was writing thank you to Kidd, because it is people like him who will be paying my OAS, and my GIS, and OHIP, etc., etc. when I hit the certain age - but decided against posting it, because it could be considered sarcastic instead of sincere.

By the way, checking my tax return from the last year I was employed full time, it says "Total income tax deducted: $55,248.06"
I think that would be enough for two seniors collecting OAS+GIS in that year. Whoever you were, you are welcome.

krwilson said
CRA accounts are back online and now you must do a 3 page captcha before you get logged in.  

Not sure what you mean. I used Login-Partner and it’s the same as always. I guess if you login through CRA, you need to fully verify yourself before they accept that it’s really you.