Wwwxx: 2018 Tax App [updated]
Because the developer used the subdomain wwwxx.[redacted].com , they failed to secure the API endpoints. Security researchers discovered that by simply changing a number in the URL ( /user/1234/taxform to /user/1235/taxform ), you could view another person’s partially completed tax return.
However, the story of serves as a perfect cautionary tale: Never trust your tax data to a startup with a typo for a name. Stick to IRS Free File, established CPAs, or the major vendors. Your SSN will thank you. Do you have a dusty old phone with the wwwxx app still installed? Do not plug it into your computer. Contact a data destruction service. wwwxx 2018 tax app
While the name “wwwxx” now feels like a typo or a forgotten URL shortener, in early 2018, it was a curiosity for early adopters looking to avoid bloated desktop software. But what happened to the wwwxx 2018 Tax App? And what lessons does it hold for today’s filers? In 2018, the IRS was still struggling with the aftermath of the Tax Cuts and Jobs Act (TCJA). Most major apps (TurboTax, H&R Block) were playing catch-up with the new tax brackets. Enter the wwwxx app. Because the developer used the subdomain wwwxx
As we approach another tax deadline, it is easy to forget the Wild West era of mobile tax filing. Seven years ago, in the chaotic weeks leading up to the April 2018 deadline, a niche application known simply as attempted to disrupt how freelancers and gig-economy workers filed their 1099-MISC forms. Stick to IRS Free File, established CPAs, or