7 ms·

Tax-filing websites have been sending users financial info to Meta

79 points by coderjames 4y ago

MattDemers 4y ago
Isn't it great that nothing can make our lives easier unless we're giving up proportionally more in data, privacy, or liberty?
dang 4y ago
Tax filing websites have been sending users’ financial information to Facebook - https://news.ycombinator.com/item?id=33705532 https://news.ycombinator.com/item?id=33705532 - Nov 2022 (74 comments)
nathanaldensr 4y ago
https://news.ycombinator.com/item?id=33725825 https://news.ycombinator.com/item?id=33725825 https://news.ycombinator.com/item?id=33721300 https://news.ycombinator.com/item?id=33721300 https://news.ycombinator.com/item?id=33707454 https://news.ycombinator.com/item?id=33707454 https://news.ycombinator.com/item?id=33707235 https://news.ycombinator.com/item?id=33707235
- deleted 4y ago
  [deleted]
- pvg 4y ago
  These only make sense when they point to submissions with comments otherwise they're just links to nowhere.
andsoitis 4y ago
> A pixel on TaxAct’s website then sent some of that data to Facebook, including users’ filing status, their adjusted gross income, and the amount of their refund, according to a review by The Markup. A pixel is a powerful thing.
- jfghi 4y ago
  My uninformed mental model was that it’s rgb info but guessing there’s more to it? I suppose theoretically one could use a small handful of pixels to encode a lot that way though.
  - marcosdumay 4y ago
    It's probably requesting the pixel. All the info is on the request data. This is a very common pattern.
  - kristjansson 4y ago
    Pixel is just a term of art. Facebook (or whomever) have their JavaScript on the page, which sends information back. Historically, this would be a GET request for a 1x1 image, with all the information of interest packed into query params on the request. Hence, the “pixel” colloquialism.
- deleted 4y ago
  [deleted]
rqtwteye 4y ago
There really needs to be a crackdown on all this nonsense. I wonder if it would be feasible to create an infrastructure where everybody has a data pool and other companies can read the data with permission but it’s illegal for them to store anything. That way you could see who accesses your data and you could also revoke access.
- usui 4y ago
  This sounds absolutely, positively impossible. There can never be such a thing as read access without “store access”. Taken to the extreme, a person could read the data and then literally handwrite it down on a piece of paper. That’s storage. It is nearly impossible to prevent that. Also, if it’s illegal to duplicate the data, then it would have no purpose to be read from. For example, the system needs to access your birthdate field. Is using that piece of info somewhere considered storage, if it persists in any way? Probably. So what this means is that the next best thing we can do is enforce read access to trustworthy parties only, with confidence for now and the future.
  - black_puppydog 4y ago
    > This sounds absolutely, positively impossible. There can never be such a thing as read access without “store access”. but there could be very clear rules just how many $$$ in fines you have to pay per data point if you ever get caught with your pants down. The issue with these leaks is that the perps never have to pay for them. edit: that being said, I don't think a single such pool is a good idea since it would become the prime target for every hacker on the planet, right next to 1pass.
    - usui 4y ago
      Still, I don’t understand. If it’s illegal for a data point to be stored, how could it be used anywhere with confidence? If your microservice returns an illegal datum, and a consuming service needs to use it somewhere, how is that secondary usage not a form of storage? This is before taking into consideration things such as cached responses, temporary files, RAM, and other downstream services. You would also have to prove that datum wasn’t derived from anywhere else. What a legislative nightmare this sounds like!
ogurechny 4y ago
When in Rome, do as the Romans do. You might be mad at the cheap (or not so cheap) Chinese (or not so Chinese) smartphone manufacturer whose firmware updates come with crap apps and even trojans preinstalled, but that little business only wants to have a tiny piece of cake the big guys share. Can we scold it for swindling data if famous corporations do the same?
hash872 4y ago
So, does the GPDR (or the CCPA) prevent this for EU citizens? I'm a bit of a GPDR skeptic, but coming from a place where I'd like to see improvements in privacy legislation and more clarity. Is this specific practice, transmitting tax data to a 3rd party, outlawed in Europe?
- TastyJhinga 4y ago
  In most European countries, a third party is never involved in the tax filing process. The tax agency sends you a prefilled form that you just have to approve in most cases. Also, all tax records in my country used to be public until recently and I think even now that information is somewhat easy to get.
- grammers 4y ago
  Theoretically, yes. Practically lots of companies still ignore GDPR rules or have just not prioritized doing so (yet). If the business is tracking people and selling data, some just keep going until a fine hits...
ta988 4y ago
I looked at what apps on Android are doing on my phone yesterday. The amount of info apps are sending to Facebook and Google analytics is just jaw dropping.
- 2OEH8eoCRo0 4y ago
  Could you explain how you did this? I'm curious what mine is sending.

79 points by coderjames 4y ago

Isn't it great that nothing can make our lives easier unless we're giving up proportionally more in data, privacy, or liberty?

dang 4y ago

Tax filing websites have been sending users’ financial information to Facebook - https://news.ycombinator.com/item?id=33705532 https://news.ycombinator.com/item?id=33705532 - Nov 2022 (74 comments)

nathanaldensr 4y ago

https://news.ycombinator.com/item?id=33725825 https://news.ycombinator.com/item?id=33725825 https://news.ycombinator.com/item?id=33721300 https://news.ycombinator.com/item?id=33721300 https://news.ycombinator.com/item?id=33707454 https://news.ycombinator.com/item?id=33707454 https://news.ycombinator.com/item?id=33707235 https://news.ycombinator.com/item?id=33707235

deleted 4y ago
[deleted]
pvg 4y ago
These only make sense when they point to submissions with comments otherwise they're just links to nowhere.

andsoitis 4y ago

> A pixel on TaxAct’s website then sent some of that data to Facebook, including users’ filing status, their adjusted gross income, and the amount of their refund, according to a review by The Markup. A pixel is a powerful thing.

jfghi 4y ago
My uninformed mental model was that it’s rgb info but guessing there’s more to it? I suppose theoretically one could use a small handful of pixels to encode a lot that way though.
- marcosdumay 4y ago
  It's probably requesting the pixel. All the info is on the request data. This is a very common pattern.
- kristjansson 4y ago
  Pixel is just a term of art. Facebook (or whomever) have their JavaScript on the page, which sends information back. Historically, this would be a GET request for a 1x1 image, with all the information of interest packed into query params on the request. Hence, the “pixel” colloquialism.
deleted 4y ago
[deleted]

rqtwteye 4y ago

There really needs to be a crackdown on all this nonsense. I wonder if it would be feasible to create an infrastructure where everybody has a data pool and other companies can read the data with permission but it’s illegal for them to store anything. That way you could see who accesses your data and you could also revoke access.

usui 4y ago
This sounds absolutely, positively impossible. There can never be such a thing as read access without “store access”. Taken to the extreme, a person could read the data and then literally handwrite it down on a piece of paper. That’s storage. It is nearly impossible to prevent that. Also, if it’s illegal to duplicate the data, then it would have no purpose to be read from. For example, the system needs to access your birthdate field. Is using that piece of info somewhere considered storage, if it persists in any way? Probably. So what this means is that the next best thing we can do is enforce read access to trustworthy parties only, with confidence for now and the future.
- black_puppydog 4y ago
  > This sounds absolutely, positively impossible. There can never be such a thing as read access without “store access”. but there could be very clear rules just how many $$$ in fines you have to pay per data point if you ever get caught with your pants down. The issue with these leaks is that the perps never have to pay for them. edit: that being said, I don't think a single such pool is a good idea since it would become the prime target for every hacker on the planet, right next to 1pass.
  - usui 4y ago
    Still, I don’t understand. If it’s illegal for a data point to be stored, how could it be used anywhere with confidence? If your microservice returns an illegal datum, and a consuming service needs to use it somewhere, how is that secondary usage not a form of storage? This is before taking into consideration things such as cached responses, temporary files, RAM, and other downstream services. You would also have to prove that datum wasn’t derived from anywhere else. What a legislative nightmare this sounds like!

ogurechny 4y ago

When in Rome, do as the Romans do. You might be mad at the cheap (or not so cheap) Chinese (or not so Chinese) smartphone manufacturer whose firmware updates come with crap apps and even trojans preinstalled, but that little business only wants to have a tiny piece of cake the big guys share. Can we scold it for swindling data if famous corporations do the same?

hash872 4y ago

So, does the GPDR (or the CCPA) prevent this for EU citizens? I'm a bit of a GPDR skeptic, but coming from a place where I'd like to see improvements in privacy legislation and more clarity. Is this specific practice, transmitting tax data to a 3rd party, outlawed in Europe?

TastyJhinga 4y ago
In most European countries, a third party is never involved in the tax filing process. The tax agency sends you a prefilled form that you just have to approve in most cases. Also, all tax records in my country used to be public until recently and I think even now that information is somewhat easy to get.
grammers 4y ago
Theoretically, yes. Practically lots of companies still ignore GDPR rules or have just not prioritized doing so (yet). If the business is tracking people and selling data, some just keep going until a fine hits...

ta988 4y ago

I looked at what apps on Android are doing on my phone yesterday. The amount of info apps are sending to Facebook and Google analytics is just jaw dropping.

2OEH8eoCRo0 4y ago
Could you explain how you did this? I'm curious what mine is sending.