“After reviewing the HTTP responses from the CRA My Account login page, it’s clear the agency has not configured even some of the most basic security features.”
Every Canadian has to use My Account to file taxes, and the new terms say the Canada Revenue Agency is not liable if your data gets stolen there. The excuse is that it took “all reasonable steps.” Its login page is missing cookie protections and recommended security headers. The terms also ban scanning the site, and threat actors don’t read terms of use pages.