0

I'm filling out tax information. The accountants out-source the survey collecting the tax info to another company. Seems fair enough - I'd rather have computer experts handle the technical implementation of my information's security than have tax accountants trying to do it.

Problem is that when I pause work on inputting the info, the survey company emails me a link to return to the survey. No password involved at any stage. Anyone with the link can access the survey.

Obviously someone malicious could read the email. Or maybe I might use a browser that stores the URL. Or since the URL only has 5 random characters in it, it's probably possible to guess a random URL and get into someone's survey after enough tries.

But if I were to reach out to these companies, what should I say? Whenever I see something like this (plain text emails of passwords in particular), and complain, people just ignore it. So can anyone advise how to highlight the vulnerability in a way that gets people to take it seriously?

Improve this question
1
  • For plaintext passwords, I would recommend Plain Text Offenders.
    – user163495
    Sep 4, 2019 at 13:41

1 Answer 1

Reset to default
2

Simply contacting both companies to register your concerns is a first step.

Secondly, there are likely personal data protection laws/regulations that cover either company that you can reference and appeal to if you are not satisfied with the responses from the companies.

You can't force anyone to do anything to change how they process information. You can inform, encourage, and bring in regulators when applicable.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .