Encryption Secured E-Mails

[peggysioux]

What software program are tax preparers using to securely e-mail their clients tax sensitive material?

[Gretel]

I use Adobe PDF with a password. It not the most secure, e-mail never is.

A better solution is a web portal but I am not there yet. I recently purchased Webroot Internet Security, which has a feature for secure transfer of a file. Client receives e-mail and then follows a link. I like how it works.

However, I had to play with it a little to find out how to use, and, stupid me, did not write down the steps and by now have forgotten already. So I will need to play again once I need it.

[ttbtaxes]

Secure portal

I'm curious what options there are. My very limited understanding is that in order to securely transmit an email the sender and receiver must both use the same encrypted software.

I couldn't easily find a solution so, several years ago, I went the secure portal route. Clients and I each upload any sensitive information or documents.

[taxxcpa]

E-mailing

I use PDF Factory and use the client's SSN as the password. If anyone is able to determine their SSN, then their identity has already been stolen.

I noticed that one of the worksheets that I sent by e-mail shows the SSN as XXX-XX-1234 like most credit card bills. Maybe the IRS should adopt that instead of requiring full SSNs. Or give everyone a 50-digit PIN to use instead of their SSN

[Gary2]

I use PDF Factory and use the client's SSN as the password. If anyone is able to determine their SSN, then their identity has already been stolen.

I noticed that one of the worksheets that I sent by e-mail shows the SSN as XXX-XX-1234 like most credit card bills. Maybe the IRS should adopt that instead of requiring full SSNs. Or give everyone a 50-digit PIN to use instead of their SSN

Back before public awareness and government regulation of privacy issues, it was easy to get a SSN by simply pulling a credit report. It's still not all that difficult to find SSNs. That's why you ask for addresses, birthdays, etc.

I think it would be safer to use a program to generate a random PIN, perhaps appended to their SSN. Then just tell them the PIN over the phone.

[JohnH]

I also prefer pdf Factory. The free version is handy for learning how to use it, and the pruchased version (about $50), provides the ability to password-protect files.

http://fineprint.com/products/pdffactory/index.html

It's also handy when someone asks you to email a copy of their return to a third party. Just verbally agree on a password, encrypt the copy, email it to the client. The client can forward it to whomever they wish and they can give that person the password verbally as well.

[DMICPA]

Secured E-mails update

The last time this was discussed appears to be two years ago.

Now I am considering getting the password protected email software. pdf Factory seemed to be popular among the users here.

Is this still a good way to go?

Has anything substantially better come out in the last two years?


Bob

[Roberts]

I use PrimoPDF - produces secure PDF files with 128-bit encryption for free and without any watermark.

You can download at cnet.com. I've never had any of the problems the reviewers have had and I think they could be avoided by generating a larger file - allowing better clarity.

[JohnH]

I'm still using pdfFactory, but when I get a chance I think I'll try Primo PDF for comparison.

Don't know why I'm using pdfFactory rather than a free one, other than the fact that it's only $60 and I'm familiar with it.

[veritas]

I have to make a few comments

First of all I usually dissuade all requests for tax returns by email. Mail or pick it up. And if they get pushy I charge.

I remember when ppl used to have copies of their own to supply a copy to the bank. Of course they also had things like a check register and with a balance to boot!

Then came overnight mail. And that was soon replaced by the fax. Now it's email because the lender is lazy and wants an electronic file rather than taking their time to scan in a document.


Oh and don't forget the CPA (because we know only CPAs do tax returns)letter prognosticating the future.

Is there a pattern here?

[veritas]

A website

Indicated it would take a PC .25 seconds to decipher a nine digit number.

https://howsecureismypassword.net/

[Gary2]

Indicated it would take a PC .025 seconds to decipher a nine digit number.

https://howsecureismypassword.net/

A nine digit number is only a billion combinations. With a nine character, randomly generated string containing upper case, lower case, numbers and punctuation, the answer it gave was 275 days. Still not enough. I typically use at least 12 characters, and a random password generator.

[ATSMAN]

Client says no password

How do you handle a pdf file if the taxpayer says don't encrypt it. I have had a few situations where the taxpayer received the file but for some reason was not able to open the file. After a couple of tries they tell me to send it unencrypted because they don't have the time to stop by my office and pickup the hard copy.

Are we ok if taxpayer says send it unencrypted. I use Pdf Factory and Drake's internal pdf encryption for tax documents.

[Roberts]

A nine digit number is only a billion combinations. With a nine character, randomly generated string containing upper case, lower case, numbers and punctuation, the answer it gave was 275 days. Still not enough. I typically use at least 12 characters, and a random password generator.

The password I use for my stuff = 3 hours because I use a symbol like "$" instead of a 5.
The password I use for clients = 11 minutes.
The time it takes a thief to open up someones mailbox and take the tax return I just mailed them <10 seconds.
Client of mine is the Chief Information Officer of a Fortune 500 company. He'd rather I email him something unencrypted than mail it to him.

If you use a 12 digit randomly generated password with all those combinations, how do you notify the client of the password?

[ATSMAN]

The password I use for my stuff = 3 hours because I use a symbol like "$" instead of a 5.
The password I use for clients = 11 minutes.
The time it takes a thief to open up someones mailbox and take the tax return I just mailed them <10 seconds.
Client of mine is the Chief Information Officer of a Fortune 500 company. He'd rather I email him something unencrypted than mail it to him.

If you use a 12 digit randomly generated password with all those combinations, how do you notify the client of the password?

Excellent observation. How do you inform the client a 12 digit password. I suppose you can call or e-mail it separately. But 12 digits may be too much for some people to type in exactly.

I have been using what my bank does. First 4 characters then last four digits. I do not e-mail the password. I call and tell them personally (no VM).