IRS-authorized eFile.com tax return software caught serving JavaScript malware
bleepingcomputer.com
bleepingcomputer.com
One of the fastest ways to monetize an open source software package is to sell your GitHub login to a bad actor or put malware in it yourself.
It would be extremely easy for a state level actor to compromise an npm dependency through bribery or blackmail.
What we desperately need is a hard reset of the tax code. Simple straightforward progressive tax brackets with no deductions whatsoever. If I overpaid send me a check. If I underpaid send me a bill.
No, they don't. They don't know if you acquired a dependent or lost one. They don't know if you are entitled to an EV credit. They don't know if you are landlord with rental income and expenses. They don't know if you donated to charity. The list goes on and on.
> If taxes were simplified, Americans would be willing to pay more
Any support for that claim?
Even if they know I was a landlord in a prior year, they still have no way to know how much rent I received during the year, or what my expenses were.
Sounds horrific
> The IRS in fact never asks and does not know the identity of your tenants.
Why is that a requirement to registering a contract? You’re just registering the rent, address and length.
In many cases they do. Births need to be certified at the time. Adoptions and fosters and guardianships have their own paperwork that needs to be filed and sometimes court time. Deaths need to be certified at the time.
> They don't know if you are entitled to an EV credit.
Cars need to be registered and plated.
> They don't know if you are landlord with rental income and expenses.
Landlords can already setup income tax disclosure and withholding on rentals at the time of accrual, just about the same as any other job. It doesn't need to be an "April surprise" non-withheld lump sum to the IRS (and it probably shouldn't ever be, but I'm not your CPA). Expense-related tax credits are certainly a complication, but that's probably tax credits that should be simplified anyway. If it was desired to keep them, it would probably make sense to report them as frequently and as timely as income tax withholding is allowed to be.
The only real complication to most of the above is that in the current US federal system a lot of the data is state-managed (birth/death certificates, car registrations, etc) and there'd need to be some way to, uh, federate that data in a safe way. But some of that data already needs to be "federated" anyway (SSNs key off of birth certificates).
That is a huge, currently insurmountable problem. The states are not likely to just roll over and kow tow to new, intrusive federal tax laws, look at the history of ACA (Obamacare).
Further, you don't seem to understand the requirements to be claimed as a dependent. Simply being the birth parent is only one small part, it also requires among other things a determination of residency household and who pays for support. There are a non-trivial number of tax returns filed which falsely claim a dependent (either deliberately or through ignorance), which then causes a lot of grief and delay for the taxpayer who is actually entitled to so claim.
And there are more requirements to claim an EV credit beyond simply the registration.
I note you didn't respond to the item about charitable donations. I could provide another twenty items that the IRS doesn't know enough about until you tell them if I wanted to take the time, and that still wouldn't be an exhaustive list.
In general, I feel like you are using the existing baroque complexity of the tax code as the reason not to simplify it. Of course that is a Catch-22! The above sentiment that the IRS "could just tell us what we owe" is a desire to simplify at its core. Other countries have simplified their tax codes to the point where they just automatically send a bill or a check and a sign-off of pre-completed forms. You are right, that's not possible with the complexity of today's US tax codes, but it is defeatist to suggest that the complexity of today's tax codes are unchangeable laws handed down from the stars that can't be simplified so that we could get the nice things that other countries have today (and that for-profit corporations like Intuit spend lots of money lobbying Congress telling them that Americans don't deserve such nice things).
One huge challenge is the fact that a lot of welfare is embedded into the system as tax credits. That is why it is so complicated to be sure the correct taxpayer gets to claim a child, since the credits amount to potentially many thousands of dollars. If this welfare money instead was delivered directly instead of via tax credits, then yes a lot of the complexity could be removed, but it's been this way so long, there is a lot of inertia.
There is indeed a lot of inertia from the "wish it was welfare" feeling giving a lot of reasons for people (and corporations, lol) to claw for keeping many of the tax credits in play because it does save them money in a noticeable way to their bottom line that also makes them feel like they "deserve it" (for "hard work" or other "earned" reasons) and that could be greatly simplified indeed by, I don't know, maybe correctly investing in real welfare projects instead.
Refundable tax credits are money in hand. (They may be delayed money in hand, but effectively that’s just welfare with eligibility determined with a lag, which is fairly common, though the lag for tax credits is longer than for most other welfare programs.)
But the main “welfare-like” tax credit (EITC) is also advanceable (via the W-5 process) as well as refundable, which removes the delayed aspect, too.
Supply Chain Compromise or False Positive: The Intriguing Case of efile.com [updated - confirmed malicious code] - https://isc.sans.edu/diary/Supply+Chain+Compromise+or+False+...
Analyzing the efile.com Malware "efail" - https://isc.sans.edu/diary/Analyzing+the+efilecom+Malware+ef...
edit: Of course I rushed to post this comment before actually looking at the linked story. The story links and credits one of these posts.
What exactly does the author think "IRS-authorized" means?
Anyway, there's that and confusing domain names likes like e-file(.com) that have got nothing to do with the concerned efile(.com) or the IRS, hence that note.
Other media outlets (e.g. https://www.pcworld.com/article/1682428/irs-certified-free-t... ) have put similar disclaimers in place for the avoidance of doubt: "(which is a separate, for-profit tax company, despite the identical name to IRS eFile)."
Thanks for noticing.