Keebler/Blog

Back in January, I blogged about the security holes in the ePass system, the online application that allows you to login to Canadian government websites. It all started when I noticed some fundamental flaws in the Canadian passport website after Chris had already exposed last April how generally frustrating it is to use.

Developers from the Passport Canada office (their IPs point right back to them) started leaving nasty comments on my blog:

Now, now. Everybody must live with the frustration of a world not as perfect as our own little person.

If the Passport application system was able to handle a sudden increase (what? 500% maybe? thanks to USA) without a glitch, it would mean that for many years this system had been running with way too much bandwidth and server muscles. Who would be crying then? Chris, Jonathan, Clay and their friends would be crying to the world that the government was wasting money all these years running such a system! (source – “Jo Blo”)

And on my friend’s blog:

do you know anything about security… whiner

if you can’t even figure out who built it you must be a simpleton.. oh yeah u use a mac … (source – “dl”)

Well this week, Passport Canada had to be completely shutdown for two days when someone noticed that they were saving login credentials in a browser cookie. That is egregious error by a web-developer, and shows a completely disregard for security practices. Now, after two days, they are back online and saying, “Now the Internet site of Passport Canada is one of the most secure” (source).

Are you serious?! Firstly, how are you determining that? Put your site on HTTPS all you want; you cannot repair application security holes through anything but a complete line-by-line examination of your code-base.

Secondly, the security hole I found is still there. You may have found and patched one hole, but the entire system is still open to exploit.

In the end, as a citizen myself, these websites are trying to protect my information and I want to help. I emailed Passport Canada and the CRA to try to get in touch with someone that way. Please, if you read this, drop me a line in the comments. I will do whatever I can to help you close these holes. Even if you don’t believe me that there are some, what do you have to lose?

If you’re wondering why WhyYouShould is responding very slowly (if at all) tonight, it looks like my hosting provider DiscountASP is experiencing a denial-of-service attack. They’re working on it and hopefully WYS will be back soon

From Discountasp.net:

Dear Customer,

We experienced a network-wide outage Thursday morning and late evening as the result of a distributed denial of service attack. You can read details related to the outage here: http://community.discountasp.net/default.aspx?f=6&m=18216&p=1
…

A couple of months ago, I blogged about the security holes in the ePass system, the online application that allows you to login to Canadian government websites. It all started when I noticed some fundamental flaws in the Canadian passport website after Chris had already exposed last April how generally frustrating it is to use.

Developers from the Passport Canada office started leaving nasty comments on my blog:

Now, now. Everybody must live with the frustration of a world not as perfect as our own little person.

If the Passport application system was able to handle a sudden increase (what? 500% maybe? thanks to USA) without a glitch, it would mean that for many years this system had been running with way too much bandwidth and server muscles. Who would be crying then? Chris, Jonathan, Clay and their friends would be crying to the world that the government was wasting money all these years running such a system! (source – “Jo Blo”)

And on my friend’s blog:

do you know anything about security… whiner

if you can’t even figure out who built it you must be a simpleton.. oh yeah u use a mac … (source – “dl”)

Well today a “situation” popped-up that “in order to safeguard existing systems and to maintain the integrity of CRA’s taxpayer information holdings, Mr Dorais ordered tax filing processes halted.” (source). From the CRA commissioner, “The security of taxpayer information remains paramount as we strive to understand and correct this situation” (source). Maybe they finally got it through their heads that ePass is not secure.

It’s a difficult situation since a rewrite of their system would take months, and tax season is upon us. But I’m not sure how safe I, or anyone else, should feel if we’re using their our fundamentally flawed system to file our taxes this year.

A final note, although the CRA website turned off their ePass component, Passport on-line is still up-and-running (and open to exploit).

UPDATE: Looks like they might have just taken the site down because of some “computer work done on the weekend”. *sigh* I’m sure it’ll be back soon, and just as crap-tas-tic (Thanks for the update, Mike)

UPDATE #2: To add insult to injury:

“The security and integrity of taxpayer data has not been compromised. This problem is not the result of illegal activity, computer hackers or a virus.

We have now traced the source of the problem to software maintenance conducted on March 4, 2007. We are currently working to bring all systems back online gradually.” (source)