response to tax software not encrypting tax info

[auto40951@hushmail.com]

-----BEGIN PGP SIGNED MESSAGE-----

PivX:

I am wondering, is it really the responsibility of every piece of software that handles potentially sensitive info to provide (strong)encryption capabilities?

I think the onus of protecting sensitive info should fall on the user in many cases. This obviously includes not sharing your tax info on KaZaA or on network shares and using reliable third-party encryption software to protect anything that you really don
't want other people to know about. NTFS permissions and EFS can also be used to this effect. In the end, these measures will also be way way way more effective than relying on some hacked together info encoding algorithm that merely obsfucates your tax i
nfo and introduces the additional
security "vulnerability" of weakly encoding the information.

-----BEGIN PGP SIGNATURE-----
Version: Hush 2.2 (Java)
Note: This signature can be verified at https://www.hushtools.com/verify

wl0EARECAB4FAj5wzmoXHGF1dG80MDk1MUBodXNobWFpbC5jb2 0ACgkQ7s7ZokLom1is
MQCgkLFM8vUJ/boRAC0EUTRlPlucuFcAl26K776nL35aCX8x5xU/IR/Olb8=
=SwAH
-----END PGP SIGNATURE-----




Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2

Big $$$ to be made with the HushMail Affiliate Program:
https://www.hushmail.com/about.php?s...ffiliate&l=427

[er t]

Mom and Pop use this software, your English teacher uses this software,
probably even your local baker... This is a case of Vendor vs. User... I
Thank PivX for helping the Community and WE must help out our users.

You can almost bet the that the users of the Tax program use IE to surf the
internet, and mostly unpatched. The dangerous web site, knowing the default
location of the Tax files, or even the unprotected "net use IP C:" doesn't
help out our users.

What could help our users is a default simple encryption of the Tax files.

You are correct when saying

"I am wondering, is it really the responsibility of every piece of software
that handles potentially sensitive info to provide (strong)encryption
capabilities?"

Because not everyone using today's computers can utilized EFS or a third
party encryption tool.



..er.587

-----Original Message-----
From: auto40951@hushmail.com [mailto:auto40951@hushmail.com]
Sent: Thursday, March 13, 2003 1:27 PM
To: bugtraq@securityfocus.com
Subject: response to tax software not encrypting tax info



-----BEGIN PGP SIGNED MESSAGE-----

PivX:

I am wondering, is it really the responsibility of every piece of software
that handles potentially sensitive info to provide (strong)encryption
capabilities?

I think the onus of protecting sensitive info should fall on the user in
many cases. This obviously includes not sharing your tax info on KaZaA or on
network shares and using reliable third-party encryption software to protect
anything that you really don't want other people to know about. NTFS
permissions and EFS can also be used to this effect. In the end, these
measures will also be way way way more effective than relying on some hacked
together info encoding algorithm that merely obsfucates your tax info and
introduces the additional security "vulnerability" of weakly encoding the
information.

-----BEGIN PGP SIGNATURE-----
Version: Hush 2.2 (Java)
Note: This signature can be verified at https://www.hushtools.com/verify

wl0EARECAB4FAj5wzmoXHGF1dG80MDk1MUBodXNobWFpbC5jb2 0ACgkQ7s7ZokLom1is
MQCgkLFM8vUJ/boRAC0EUTRlPlucuFcAl26K776nL35aCX8x5xU/IR/Olb8=
=SwAH
-----END PGP SIGNATURE-----




Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2

Big $$$ to be made with the HushMail Affiliate Program:
https://www.hushmail.com/about.php?s...ffiliate&l=427










__________________________________________________ _______________
Tired of spam? Get advanced junk mail protection with MSN 8.
http://join.msn.com/?page=features/junkmail

[Andreas Marx]

Hello!

The problem with the unencrypted files is not new. In 2000 we made a test=20
of common financial office programs, including MS Money, Quicken, Lexware,=
=20
Quickbooks etc. -- in most cases, we were able to disable a password=20
protection by just changing one byte in the (mostly unencrypted) files, or=
=20
you were able to recover the passwords in no time (with a calculator and a=
=20
simple hex editor). To make it short - no program has reliable protected=20
your data. We were always able to open the (possible confidential) files!

The feedback we got from the developers of the programs was quite=20
interesting: Most tried to increase the pressure that we remove the test=20
from our website ("to avoid legal problems"). Cool, isn't it? Actually, all=
=20
wanted to fix the problems we found ASAP, but after checking some of the=20
new versions after seeing the PivX posting I think, almost NOTHING has=20
changed in the above programs. Again: All wanted to fix the problems we've=
=20
found (in 2000) ASAP, but now, three years later, all products are still=20
wide-open.

Here's the original German review (from the German edition of PC World,=20
called PC-WELT -- we had to remove some details "to avoid legal problems"):

Sicherheitsl=F6cher in Finanzsoftware
http://www.pcwelt.de/ratgeber/online/15806/

cheers,
Andreas

--=20
Andreas Marx <amarx@gega-it.de>, http://www.av-test.org
GEGA IT-Solutions GbR, Klewitzstr. 7, 39112 Magdeburg, Germany
Phone: +49 (0)391 6075466, Fax: +49 (0)391 6075469