8

Attempting to log into H&R Block's website to file my taxes, as I've done for the last several years in a row, I'm now being prompted to "Update your account settings so they meet new IRS requirements." Specifically, I'm now required to replace my (already secure, never-been-compromised, contains-no-dictionary-words-or-commonly-used-sequences) password with one that meets their new overly-complex criteria (I'll never remember/guess anything that meets them all), and also add two additional security question/answer pairs (the one I had previously chosen is the only one of those they offer that has an answer that I'll remember and nobody else knows or could learn through research on me).

Ok, my ranting aside, this question is not about what password requirements and other account security features a service provider should use (there's plenty of that on InfoSec.SE). I just want to know where I can review these "new IRS requirements" that H&R block refers to, so I can check whether or not it's legit.

If the new requirements actually do exist, please include a direct link to them if possible (e.g. a link to something on irs.gov, as opposed to an article on a news site reporting about the requirements).

Improve this question
4
  • 2
    Some new requirements. Not sure it's relevant to what you've outlined though: irs.gov/individuals/new-security-safeguards
    – Peter K.
    Commented Feb 4, 2017 at 23:23
  • 3
    In addition to @PeterK. link, here's Krebs on the issue.
    – mkennedy
    Commented Feb 5, 2017 at 1:32
  • This doesn't quite solve your problem, but I would recommend using a password manager. Then you never have to remember passwords and can make them very complex and unique.
    – user428517
    Commented Mar 5, 2018 at 17:40
  • Relevant: xkcd.com/936
    – Robert Harvey
    Commented Mar 5, 2018 at 21:04

2 Answers 2

Reset to default
8

I'm not sure exactly what complexity H&R Block requires, but here's a section from Publication 1075 (September 2016) that might explain it:

The information system must, for password-based authentication:

a. Enforce minimum password complexity of:

  1. Eight characters
  2. At least one numeric and at least one special character
  3. A mixture of at least one uppercase and at least one lowercase letter
  4. Storing and transmitting only encrypted representations of passwords

b. Enforce password minimum lifetime restriction of one day

c. Enforce non-privileged account passwords to be changed at least every 90 days

d. Enforce privileged account passwords to be changed at least every 60 days

e. Prohibit password reuse for 24 generations

f. Allow the use of a temporary password for system logon requiring an immediate change to a permanent password

g. Password-protect system initialization (boot) settings

While some of these may only apply to internal computer systems, It does not surprise me that they would be enforcing similar (or more restrictive) client settings as well.

Improve this answer
2
  • 1
    While item "a" does match the complexity requirements H&R Block is now enforcing, as far as I can tell, Publication 1075 applies to government agencies, and does not appear to directly regulate any tax preparer, at least not within Section 9. (The term "agency/agencies" is not defined in Publication 1075, but it appears to refer to government agencies.) If I'm wrong about that, then this might be applicable...
    – Dan Henderson
    Commented Feb 18, 2017 at 21:42
  • 3
    Sigh! The IRS should talk to the nice people at NIST. Points 'c' and 'd' is directly contrary to NIST advice.
    – Martin Bonner supports Monica
    Commented Mar 5, 2018 at 15:27
-2

They are lying to you. There are no new IRS requirements to change your password on an e-file. H&R Block may well have some, but I would suggest you do your taxes elsewhere if you are being deceived by the Company that is providing the service.

You will not find any IRS info regarding the change you have mentioned. As a CPA, I am updated on a regular basis and that change just hasn't happened.

Improve this answer
4
  • 3
    Is it possible that the IRS have audited H&R Block and found that their practises are insufficient, and therefore demanded that they tighten up? Do H&R Block have any "official" affiliation with the IRS? (I'm in the UK where we don't have anything equivalent to H&R Block).
    – Vicky
    Commented Feb 17, 2017 at 9:12
  • 4
    I would have hoped that someone claiming authority due to their professional credentials, would accept a modicum of humility in providing such an answer. Please see the reference given by D Stanley highlighting how your answer may be incorrect, and consider whether this should impact how you highlight your credentials in the future.
    – Grade 'Eh' Bacon
    Commented Feb 17, 2017 at 20:00
  • 1
    I wonder if you misread the question? Your 2nd sentence might be correct, but the question doesn't say that the e-file password is changing. It says the H&R Block website login password must be changed. As Vicky suggested, perhaps the internal IRS security requirements are being "extended" for some reason.
    – TTT
    Commented Feb 17, 2017 at 20:32
  • I didn't misread the question although I did assume we are talking about an e-file using H&R Block as the service provider. The IRS has had many problems with fraudulent return filings as discussed in the linked comments above and most of the fraudulent returns were filed through H&R Block.
    – mikeford
    Commented Feb 18, 2017 at 16:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .