A couple of months ago, I blogged about the security holes in the ePass system, the online application that allows you to login to Canadian government websites. It all started when I noticed some fundamental flaws in the Canadian passport website after Chris had already exposed last April how generally frustrating it is to use.
Developers from the Passport Canada office started leaving nasty comments on my blog:
Now, now. Everybody must live with the frustration of a world not as perfect as our own little person.
If the Passport application system was able to handle a sudden increase (what? 500% maybe? thanks to USA) without a glitch, it would mean that for many years this system had been running with way too much bandwidth and server muscles. Who would be crying then? Chris, Jonathan, Clay and their friends would be crying to the world that the government was wasting money all these years running such a system! (source – “Jo Blo”)
And on my friend’s blog:
do you know anything about security… whiner
if you can’t even figure out who built it you must be a simpleton.. oh yeah u use a mac … (source – “dl”)
Well today a “situation” popped-up that “in order to safeguard existing systems and to maintain the integrity of CRA’s taxpayer information holdings, Mr Dorais ordered tax filing processes halted.” (source). From the CRA commissioner, “The security of taxpayer information remains paramount as we strive to understand and correct this situation” (source). Maybe they finally got it through their heads that ePass is not secure.
It’s a difficult situation since a rewrite of their system would take months, and tax season is upon us. But I’m not sure how safe I, or anyone else, should feel if we’re using their our fundamentally flawed system to file our taxes this year.
A final note, although the CRA website turned off their ePass component, Passport on-line is still up-and-running (and open to exploit).
UPDATE: Looks like they might have just taken the site down because of some “computer work done on the weekend”. *sigh* I’m sure it’ll be back soon, and just as crap-tas-tic 
(Thanks for the update, Mike)
UPDATE #2: To add insult to injury:
“The security and integrity of taxpayer data has not been compromised. This problem is not the result of illegal activity, computer hackers or a virus.
We have now traced the source of the problem to software maintenance conducted on March 4, 2007. We are currently working to bring all systems back online gradually.” (source)
Hey!
I was just about to pm you on digg about this.
It’s rather amusing they got their ducks in a row, just a month before the deadline.
Maybe now they will listen to you guys in the future.
Guess we gotta print off our QuickTax forms and snail mail ‘em
Whiner!
I think they need more “whiners” working for them
But the fact that the Passport website is still online shows they still may not get it yet
I’m stunned that government employees would waste time bickering on a blog instead of working on fixing the problem. The media should know about this.
[...] holdings, Mr Dorais ordered tax filing processes halted.??? Here’s one of the exploits thahttp://www.keebler.net/blog/2007/03/07/epasscanada-revenue-agency-online-tax-filing-suspended/canada revenue agencyhttp://www.cbsa-asfc.gc.ca/E/pub/cp/rc4105/rc4105-e.htmlCanada Customs and [...]
[...] Suspended … the online application that allows you to login to canadian government websites. …http://www.keebler.net/blog/2007/03/07/epasscanada-revenue-agency-online-tax-filing-suspended/Building Capacity to Accelerate Service Transformation and e …For example, the canadian Consumer [...]
[...] holdings, Mr Dorais ordered tax filing processes halted.??? Here’s one of the exploits thahttp://www.keebler.net/blog/2007/03/07/epasscanada-revenue-agency-online-tax-filing-suspended/NETFILE – Home pageThe NETFILE transmission service allows you to file your personal income tax and [...]