Wow. According to several posters in that thread, Intuit was allowing guest users to pull up data from prior years' tax returns (and subsequently file this year with correct data) by providing only an SSN and not any other form of authentication. If true, that's basically a criminal level of negligence.
That means you could brute force your way into getting someone else's tax return... scary
This has always been possible. I knew a guy who bulk downloaded returns from hr block because they required only last name, zip, and partial ssn. He picked a zip where everyone is named Stein and was born at the same hospital (which gets its own ssn shard) and went to town. Naturally they had no rate limiting.
How do you find a zipcode where everyone has the same last name? I'm guessing a very small town several hours from a single hospital?
Wrong it's one of the most populous zips in the nation and I'm being flippant about the name but when you are brute forcing things an unusual probability is all you need.
Oh seems like it would have been just as easy to grab census data for the past 50 years and run through last names by decreasing frequency.
Here I thought you had found a unique zipcode.
Can anyone on HN with a TurboTax account confirm this is true?