News for hackers. Stuff that matters.
Re:I was let go for refusing to deploy a dark pattern by wing-_-nuts on Friday June 25, 2021 @10:40AM (#27631345)
I was doing my taxes on taxact a year or two ago, when I noticed a small lag every time I switched fields. Every time I went to the next field, a network request was being made to some third party analytics thing with the data I entered.

Somewhere, in the back of my mind I know that all data I enter online is inevitably being hovered up and used for god knows what, but when you're suddenly made aware of it, it's really unnerving.

Something about this makes me want to have a 'falling down' moment. Let me get this straight, not only is our tax system so complex and error prone i have to pay money to a third party to figure out how much I should be paying to our government, but the software company I pay then turns around and sells my data? The government does nothing to remedy this? It really goes to show who our government serves, and it sure as hell isn't 'the people'.

Re:I was let go for refusing to deploy a dark pattern by btown on Friday June 25, 2021 @11:31AM (#27632048)
A brief reminder, especially when talking about dark patterns, that Intuit and its peers have spent 20 years making this a reality and cloaking their legal obligations to provide free options, as detailed in https://www.propublica.org/article/inside-turbotax-20-year-f... :

> Internal presentations lay out company tactics for fighting “encroachment,” Intuit’s catchall term for any government initiative to make filing taxes easier — such as creating a free government filing system or pre-filling people’s returns with payroll or other data the IRS already has. “For a decade proposals have sought to create IRS tax software or a ReturnFree Tax System; All were stopped,” reads a confidential 2007 PowerPoint presentation from an Intuit board of directors meeting. The company’s 2014-15 plan included manufacturing “3rd-party grass roots” support. “Buy ads for op-eds/editorials/stories in African American and Latino media,” one internal PowerPoint slide states.

> The centerpiece of Intuit’s anti-encroachment strategy has been the Free File program, hatched 17 years ago in a moment of crisis for the company. Under the terms of an agreement with the federal government, Intuit and other commercial tax prep companies promised to provide free online filing to tens of millions of lower-income taxpayers. In exchange, the IRS pledged not to create a government-run system.

> Since Free File’s launch, Intuit has done everything it could to limit the program’s reach while making sure the government stuck to its end of the deal. As ProPublica has reported, Intuit added code to the Free File landing page of TurboTax that hid it from search engines like Google, making it harder for would-be users to find.

> What is clear is that Intuit’s business relies on keeping the use of Free File low. The company has repeatedly declined to say how many of its paying customers are eligible for the program, which is currently open to anyone who makes under $66,000. But based on publicly available data and statements by Intuit executives, ProPublica estimates that roughly 15 million paying TurboTax customers could have filed for free if they found Free File. That represents more than $1.5 billion in estimated revenue, or more than half the total that TurboTax generates. Those affected include retirees, students, people on disability and minimum-wage workers.

Re:I was let go for refusing to deploy a dark pattern by mkr-hn on Friday June 25, 2021 @11:46AM (#27632236)
The audacity they have to run ads promising to simplify taxes when they're responsible for that complexity is amazing.
Re:I was let go for refusing to deploy a dark pattern by btown on Friday June 25, 2021 @12:07PM (#27632547)
Saying "it wasn't me, it was my boss who created the situation, I'm just trying to make people's lives better within these constraints!" is the best way to calcify and perpetuate those constraints.
Re:I was let go for refusing to deploy a dark pattern by musingsole on Friday June 25, 2021 @12:16PM (#27632704)
Oof this hits close to home these days. I just want to scream "we're doing this to ourselves!!!"
Re:I was let go for refusing to deploy a dark pattern by orcasauce on Friday June 25, 2021 @12:36PM (#27633079)
We must keep filing taxes complicated, for the sake of Capitalism! This reads like Huxley.
Re:I was let go for refusing to deploy a dark pattern by wizzwizz4 on Friday June 25, 2021 @12:32PM (#27632986)
Consider installing Local Sheriff: https://addons.mozilla.org/en-GB/firefox/addon/local-sheriff... It detects these abuses and lets you know.
Re:I was let go for refusing to deploy a dark pattern by handrous on Friday June 25, 2021 @12:29PM (#27632929)
Letting JavaScript initiate requests or mutate data associated with forms was a huge mistake.
Re:I was let go for refusing to deploy a dark pattern by jareklupinski on Friday June 25, 2021 @10:46AM (#27631436)
I mean... in a way... it is "serving its people"...

in a "To Serve Man" sort of way ;) https://en.wikipedia.org/wiki/To_Serve_Man_(The_Twilight_Zon...

installing ublock Origin should help block most of those nasty analytics hoovers

Re:I was let go for refusing to deploy a dark pattern by freedomben on Friday June 25, 2021 @03:24PM (#27635169)
This happened to me with GMail recently. I fat fingered and accidentally opened dev tools and saw every single keystroke triggered a request back to home. I obviously knew this was happening, but seeing it happen in real time really, really unnerved me.
Re:I was let go for refusing to deploy a dark pattern by isleyaardvark on Friday June 25, 2021 @03:55PM (#27635478)
Gmail autosaves emails as drafts while you’re typing, so at least in that case there’s an excuse.
Re:I was let go for refusing to deploy a dark pattern by nokya on Friday June 25, 2021 @07:20PM (#27637426)
They also brought the dark pattern to automatically upload and save any file you select in the file uploaded control, even when you mistakenly selected the wrong file.

For more than twenty years, we had to click "upload" or alike to confirm the upload of a file to a server. I wonder how many millions or billions files Google steals (yes, that's theft) from gullible users who use their web interface.

Re:I was let go for refusing to deploy a dark pattern by djur on Friday June 25, 2021 @09:09PM (#27638100)
How is it a "dark pattern" to upload a file that you selected to upload? And how is it "theft" to accept a file that was selected for upload? What benefit does Google get from this "theft"?
Re:I was let go for refusing to deploy a dark pattern by nokya on Saturday July 03, 2021 @05:59PM (#27725273)
Well, that is my opinion.

If I take an analogy: think of it as if you were typing a message in an IM chat window. Anything you'd type would be sent immediately to the service owner, whether or not you click "send" at the end. I understand this feel normal to you but I personally find this abusive and a total treachery from Google.

To support my point: I used to have access to a corporate proxy that performs TLS inspection for a little less than 50k employees. I looked into this specific scenario to get an idea of how many employees were being abused by this. It is quite easy to find: just filter for queries sent to GMail's API when you cancel a file upload or you remove an attachment from a draft. We have several hundreds of those events each year in our logs.

These people quite candidly think they "cancelled" the upload, but it didn't. Google got the file, analysed it, extracted knowledge out of it and potentially adjusted your profile and your employer's. This falls under the definition of a dark pattern.

There is something worse than using GMail for your emails: it's using GMail's web interface.

Re:I was let go for refusing to deploy a dark pattern by djur on Monday July 05, 2021 @03:27PM (#27741127)
> Google got the file, analysed it, extracted knowledge out of it and potentially adjusted your profile and your employer's

How do you know this? It's against their stated privacy policy.

This is also a kind of strange position to be arguing when you just described snooping on people's secure communications. Why is that OK and what Gmail does isn't?

Re:I was let go for refusing to deploy a dark pattern by nokya on Monday July 05, 2021 @07:17PM (#27742731)
I don't think it is a strange position, what you seem to describe is actually completely illegal... You may have jumped to conclusions too rapidly. Let me try changing your mind :)

We do not prevent our users from using GMail for personal use, but we analyze the traffic for malicious or deviant patterns to detect potential data leaks. Analyzing the amount of users who inadvertently send a file in GMail then rapidly "change their mind" is still, in our shared opinion, a relevant analysis to perform. We report the number of quarterly cases in an awareness newsletter and remind users to be attentive when selecting a file to be uploaded in webmails.

Good thing: the occurrences have decreased since we raise this concern. We cannot prove it is linked to our newsletter but our "ego" enjoys believing so.

I would have agreed with you if I actually had both a username and a filename shown on my screen, but this does not happen. Our report shows the total count of cancelled uploads per country.

We have someone at HR who can actually see the detailed events (including file names) for a given user. It seems to that this would match what you see as "snooping". But this an investigation led by Human resources upon a suspicion of employee misbehavior. It has nothing to do with our infosec activities.

I hope I changed your mind, at least a little ;)

Re:I was let go for refusing to deploy a dark pattern by djur on Monday July 05, 2021 @11:34PM (#27743998)
My point was that in both cases the potential for abuse exists but that users have to trust that existing policies will prevent that abuse. Why should your users trust you and not Google to follow your stated policies?
Re:I was let go for refusing to deploy a dark pattern by nokya on Saturday July 10, 2021 @12:51PM (#27794716)
In my opinion, we offer a more trustworthy relationship in three ways: 1. We don't use ambiguous wording in our policies. 2. Any employee interested in knowing how we process these requests can actually come physically and see in detail how they are processed. 3. Our business does not depend upon our ability to harvest our employee data and monetize it.
Re:I was let go for refusing to deploy a dark pattern by chubot on Friday June 25, 2021 @01:10PM (#27633553)
I’ve been using taxact for 4 years, and have found it better than TurboTax. This year something seemed off — quality issues and I think they were pushing for more upgrades. More dark patterns maybe, or at least grey.

Did something happen? Did they change ownership? Any good alternatives to taxact?

Re:I was let go for refusing to deploy a dark pattern by eropple on Friday June 25, 2021 @02:07PM (#27634315)
Tax preparation is one of those places I've found that going to a person rather than a website actually really pays off. TurboTax et al handle simple cases fine but if you have a complex situation (I own a home, owned a business, etc etc) having a person who's in the room with you and can directly ask you questions and interpret data that you've got on hand is invaluable.

My tax preparer is something like $250 a year and reduced my liability in a very tumultuous year from about $20K to about $9K by understanding what I actually had going on and helping to work through it.

Re:I was let go for refusing to deploy a dark pattern by FireBeyond on Friday June 25, 2021 @04:01PM (#27635535)
And an actual tax preparer, not a script reader like H&R Block.

The first year I moved to the US, I had a whole bunch of things going on. Buying a house, working from home, buying a hybrid car etc., getting married. I had no real idea about the tax system, so saved all our receipts etc., and went to H&R Block.

"So what do you want to claim?"

"What can I claim?"

"What do you mean?"

"Here's a bunch of receipts and I can tell you all the details."

[vaguely confused look] "Let's go through the app."

And I watched as basically she transcribed our most basic information into their in house version of something akin to TurboTax.

I could have done that myself.

I complained. And did, eventually, get someone there who knew how to not be a glorified transcriptionist.

And then the next year found someone who had knowledge of their own.

Re:I was let go for refusing to deploy a dark pattern by chubot on Friday June 25, 2021 @06:33PM (#27637083)
Yup, that happened to me. I paid something like $250 for a tax preparer who just entered the info into TurboTax.

It hit a weird case and she didn't know what to do. Eventually I looked up the actual tax code and told her what to do. As far as I remember it was about splitting the cost basis over multiple years. I owned some weird stock where that came up.

Re:I was let go for refusing to deploy a dark pattern by eropple on Friday June 25, 2021 @04:07PM (#27635608)
AFAIK, TurboTax does sell access to a version of their software for the script reader, too. ;)
Re:I was let go for refusing to deploy a dark pattern by Penguinx628 on Friday June 25, 2021 @01:54PM (#27634132)
I recommend CreditKarma Tax. Intuit purchased them to destroy them but was forced to sell that division to square. if that's any indicator of how much of a threat they are to intuits revenue stream.
Re:I was let go for refusing to deploy a dark pattern by knodi123 on Friday June 25, 2021 @07:26PM (#27637495)
Me too. I have the exact same tax situation as last year, but now it pushed me really hard to upgrade, and at the very last step, it told me that something I entered on page 1 meant that they required me to go up by 1 pricing tier. They VERY CLEARLY made this product so that it wouldn't tell me that I needed to upgrade until I got to the very last step, so that I would feel intimidated at the idea of starting over with someone cheaper. So I switched to TurboTax, went through the same thing, and wound up paying $10 more as an F-You to TaxAct. Although turbotax did the same thing to me, so my moral high ground is pretty imaginary.
Re:I was let go for refusing to deploy a dark pattern by sgerenser on Saturday June 26, 2021 @07:14AM (#27640936)
Pro tip: TurboTax Deluxe offline version (not the web based one) has all of the forms and schedules, even complex stuff like schedule C businesses, rental properties, and partnerships. They’ll try to upsell you to Premier or Business for “extra guidance,” but you can just say “no keep going in Deluxe.” Deluxe with State can usually be had for $40 or less, but it’s $60 even at full retail.
Re:I was let go for refusing to deploy a dark pattern by suzzer99 on Friday June 25, 2021 @02:11PM (#27634367)
Sounds like it was not only shady, but incompetent in making the calls synchronous.