8

Attempting to log into H&R Block's website to file my taxes, as I've done for the last several years in a row, I'm now being prompted to "Update your account settings so they meet new IRS requirements." Specifically, I'm now required to replace my (already secure, never-been-compromised, contains-no-dictionary-words-or-commonly-used-sequences) password with one that meets their new overly-complex criteria (I'll never remember/guess anything that meets them all), and also add two additional security question/answer pairs (the one I had previously chosen is the only one of those they offer that has an answer that I'll remember and nobody else knows or could learn through research on me).

Ok, my ranting aside, this question is not about what password requirements and other account security features a service provider should use (there's plenty of that on InfoSec.SE). I just want to know where I can review these "new IRS requirements" that H&R block refers to, so I can check whether or not it's legit.

If the new requirements actually do exist, please include a direct link to them if possible (e.g. a link to something on irs.gov, as opposed to an article on a news site reporting about the requirements).

  • 2
    Some new requirements. Not sure it's relevant to what you've outlined though: irs.gov/individuals/new-security-safeguards – Peter K. Feb 4 '17 at 23:23
  • 3
    In addition to @PeterK. link, here's Krebs on the issue. – mkennedy Feb 5 '17 at 1:32
  • This doesn't quite solve your problem, but I would recommend using a password manager. Then you never have to remember passwords and can make them very complex and unique. – ell Mar 5 '18 at 17:40
  • Relevant: xkcd.com/936 – Robert Harvey Mar 5 '18 at 21:04
8

I'm not sure exactly what complexity H&R Block requires, but here's a section from Publication 1075 (September 2016) that might explain it:

The information system must, for password-based authentication:

a. Enforce minimum password complexity of:

  1. Eight characters
  2. At least one numeric and at least one special character
  3. A mixture of at least one uppercase and at least one lowercase letter
  4. Storing and transmitting only encrypted representations of passwords

b. Enforce password minimum lifetime restriction of one day

c. Enforce non-privileged account passwords to be changed at least every 90 days

d. Enforce privileged account passwords to be changed at least every 60 days

e. Prohibit password reuse for 24 generations

f. Allow the use of a temporary password for system logon requiring an immediate change to a permanent password

g. Password-protect system initialization (boot) settings

While some of these may only apply to internal computer systems, It does not surprise me that they would be enforcing similar (or more restrictive) client settings as well.

  • 1
    While item "a" does match the complexity requirements H&R Block is now enforcing, as far as I can tell, Publication 1075 applies to government agencies, and does not appear to directly regulate any tax preparer, at least not within Section 9. (The term "agency/agencies" is not defined in Publication 1075, but it appears to refer to government agencies.) If I'm wrong about that, then this might be applicable... – Dan Henderson Feb 18 '17 at 21:42
  • 3
    Sigh! The IRS should talk to the nice people at NIST. Points 'c' and 'd' is directly contrary to NIST advice. – Martin Bonner Mar 5 '18 at 15:27
-2

They are lying to you. There are no new IRS requirements to change your password on an e-file. H&R Block may well have some, but I would suggest you do your taxes elsewhere if you are being deceived by the Company that is providing the service.

You will not find any IRS info regarding the change you have mentioned. As a CPA, I am updated on a regular basis and that change just hasn't happened.

  • 3
    Is it possible that the IRS have audited H&R Block and found that their practises are insufficient, and therefore demanded that they tighten up? Do H&R Block have any "official" affiliation with the IRS? (I'm in the UK where we don't have anything equivalent to H&R Block). – Vicky Feb 17 '17 at 9:12
  • 4
    I would have hoped that someone claiming authority due to their professional credentials, would accept a modicum of humility in providing such an answer. Please see the reference given by D Stanley highlighting how your answer may be incorrect, and consider whether this should impact how you highlight your credentials in the future. – Grade 'Eh' Bacon Feb 17 '17 at 20:00
  • 1
    I wonder if you misread the question? Your 2nd sentence might be correct, but the question doesn't say that the e-file password is changing. It says the H&R Block website login password must be changed. As Vicky suggested, perhaps the internal IRS security requirements are being "extended" for some reason. – TTT Feb 17 '17 at 20:32
  • I didn't misread the question although I did assume we are talking about an e-file using H&R Block as the service provider. The IRS has had many problems with fraudulent return filings as discussed in the linked comments above and most of the fraudulent returns were filed through H&R Block. – mikeford Feb 18 '17 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.