An anonymous reader quotes a report from TechCrunch: The IRS will test a free tax filing service in 2024 for a subset of lucky taxpayers in as many as 13 states, the agency announced today. Direct File, as the service is called, is a shot across the bows of Turbotax, H&R Block, and other paid tax prep services, whose owners have resisted free and simple tax filing for decades. “This is a critical step forward for this innovative effort that will test the feasibility of providing taxpayers a new option to file their returns for free directly with the IRS,” said IRS Commissioner Danny Werfel in a press release announcing the news.

Over the last year and a half, the IRS has been building out the pilot program, which it characterizes as being “one more potential option” on the continuum from self-managed Free File, to commercial products like Turbotax, to a tax prep professional. The IRS describes Direct File as “a mobile-friendly, interview-based service” available in English and Spanish, intended for people with simpler tax situations like W-2s and common income credits and deductions. Whether the interviews are with actual people or some kind of automated or semi-automated process is unclear. But this, like many of its specifics, will likely change as the agency receives feedback from this limited scale pilot.

Arizona, California, Massachusetts, and New York are the four states that are integrating with Direct File for 2024 (i.e. the 2023 tax year); Alaska, Florida, New Hampshire, Nevada, South Dakota, Tennessee, Texas, Washington and Wyoming “may also be eligible,” due to not having state income tax, but it is not final. Every state was given the opportunity to participate in the Direct File program, but not all were “in a position to join.” Among the residents of these states, a limited number of individuals with “relatively simple returns” will have the opportunity to try Direct File. This will in turn “allow the IRS to evaluate the costs, benefits and operational challenges associated with providing a voluntary Direct File option to taxpayers.” In software terms, we’d probably call this an alpha.

Read more of this story at Slashdot.

Source: Slashdot – IRS Will Pilot Free, Direct Tax Filing In 2024

Last year, Andrew Appel, professor of computer science at Princeton University, wrote a 5-part series about Switzerland’s e-voting system, highlighting the inherent security vulnerabilities it faces and the safeguards the country has in place. Now, he’s writing about an interesting new vulnerability in the system that can be exploited to manipulate votes without anyone knowing. The vulnerability was discovered by Swiss computer scientist Andreas Kuster. From a blog post written by security technologist Bruce Schneier: “The Swiss Post e-voting system aims to protect your vote against vote manipulation and interference. The goal is to achieve this even if your own computer is infected by undetected malware that manipulates a user vote. This protection is implemented by special return codes (Prufcode), printed on the sheet of paper you receive by physical mail. Your computer doesn’t know these codes, so even if it’s infected by malware, it can’t successfully cheat you as long as, you follow the protocol.

Unfortunately, the protocol isn’t explained to you on the piece of paper you get by mail. It’s only explained to you online, when you visit the e-voting website. And of course, that’s part of the problem! If your computer is infected by malware, then it can already present to you a bogus website that instructs you to follow a different protocol, one that is cheatable. To demonstrate this, I built a proof-of-concept demonstration.”

Appel again: “Kuster’s fake protocol is not exactly what I imagined; it’s better. He explains it all in his blog post. Basically, in his malware-manipulated website, instead of displaying the verification codes for the voter to compare with what’s on the paper, the website asks the voter to enter the verification codes into a web form. Since the website doesn’t know what’s on the paper, that web-form entry is just for show. Of course, Kuster did not employ a botnet virus to distribute his malware to real voters! He keeps it contained on his own system and demonstrates it in a video.”

Read more of this story at Slashdot.

Source: Slashdot – Why Switzerland’s E-Voting System Is a Bad Idea

Long-time Slashdot reader couchslug shares a report from Ars Technica, writing: “A new attack on the right to do with one’s property as the owner sees fit. First step, threaten without providing evidence.” From the report: Before last week, owners of certain Mazda vehicles who also had a Home Assistant setup could create some handy connections for their car. One CX60 driver had a charger that would only power on when it confirmed his car was plugged in and would alert him if he left the trunk open. Another used Home Assistant to control their charger based on the dynamic prices of an Agile Octopus energy plan. Yet another had really thought it through, using Home Assistant to check the gas before their morning commute, alert them if their windows were down before rain was forecast, and remotely unlock and start the car in cold conditions. The possibilities were vast, and purportedly beyond what Mazda’s official app offered.

Mazda, however, had issues with the project, which was largely the free-time work of one software developer, Brandon Rothweiler. In a Digital Millennium Copyright Act (DMCA) notice sent to GitHub, Mazda (or an authorized agent) alleges that Rothweiler’s integration: contains code that “is violating [Mazda’s] copyright ownership”; used “certain Mazda information, including proprietary API information,” to “create code and information”; and contained code that “provides functionality same as what is currently” in Mazda’s apps posted to the Apple App Store and Google Play Store for Android.

One day later, Rothweiler made a pull request to the Home Assistant core project: “I’m removing the Mazda integration due to a legal notice sent to me by Mazda.” The Home Assistant project pushed an update to remove the integration, posted about the removal, and noted that they were “disappointed that Mazda has decided to take this position” and that “Mazda’s first recourse was not to reach out to us and the maintainer but to send a cease and desist letter instead.” One of the many commenters confused by Mazda’s code claims said they couldn’t find any of the copyrighted code the company referenced. Additionally, Ars Technica suggests the project “could be considered a fair use exception to the DMCA, as explained by the Electronic Frontier Foundation.”

“When Mazda contacted me, my options were to either comply or open myself up to potential legal risk,” said Rothweiler. “Even if I believe that what I’m doing is morally correct and legally protected, legal processes still have a financial cost. I can’t afford to take on that financial risk for something that I do in my spare time to help others.”

Read more of this story at Slashdot.

Source: Slashdot – Mazda’s DMCA Takedown Kills a Hobbyist’s Smart Car API Tool

An anonymous reader quotes a report from The Guardian: An estimated 20,000 Britons have been approached by Chinese state actors on LinkedIn in the hope of stealing industrial or technological secrets, the head of MI5 has said. Ken McCallum said industrial espionage was happening at “real scale,” and he estimated that 10,000 UK businesses were at risk, particularly in artificial intelligence, quantum computing or synthetic biology where China was trying to gain a march. “Week by week, our teams detect massive amounts of covert activity by the likes of China in particular, but also Russia and Iran,” the MI5 director general said ahead of a summit of domestic spy chiefs from the Five Eyes agencies hosted by the FBI in California. “Activity not aimed just at government or military secrets. Not even just aimed at our critical infrastructure but increasingly [at] promising startups — innovative companies spun out of our universities, academic research itself, and people that understandably may not think national security is about them.”

A key attack vector, McCallum said, was to try and steal information by Chinese actors posing as recruitment consultants on LinkedIn. “We think we’re above 20,000 cases where that initial approach has been made online through sites of that sort,” he said, compared to 10,000 two and a half years ago. […] On Tuesday, the agency said it was aware of 20 instances of Chinese companies considering or pursuing use of “obfuscated investment, imaginative company structures” to circumvent regulations in order to gain access to technology developed by British companies and in universities. Details were scant but MI5 indicated it was aware of at least two Chinese companies trying to identify legal loopholes to access the sensitive technology of UK firms undetected, and another Chinese company acquiring research data stolen from a top UK university.

Read more of this story at Slashdot.

Source: Slashdot – 20,000 Britons Approached By Chinese Agents On LinkedIn, Says MI5 Head

Meta will now let you block Instagram from collecting your data across the apps and websites you visit. From a report: The company says that it’s expanding the ability to disable this kind of tracking to Instagram, allowing you to review which businesses are sharing information with Meta, disconnect specific activity, or clear the collected information. You can now find this feature, called Activity Off-Meta Technologies, within the platform’s Accounts Center. It was previously only available for Facebook. Meta receives information from third-party websites that use its business tools, such as the Meta Pixel, which tracks users on the web and allows Meta to serve personalized ads on its platforms.

Read more of this story at Slashdot.

Source: Slashdot – Meta Will Now Let You Stop Instagram From Tracking You Across the Web