Declaration on line: 2 small problems

[allanb]

I've just been through the process of re-registering for online tax declarations.  It succeeded, but with a couple of glitsches:

(1)  The instructions said that at some point I would be asked to enter a password, but I wasn't.  So anyone with access to my computer now has access to my tax file.  This doesn't matter too much in my domestic situation, but it shouldn't be that way.

(2)  Near the end of the procedure the system strongly advised me to make a backup copy of the "certificate" or "key".  This is a sensible idea and I would like to do it, but there was no clue about the name of the file containing it, or where it is stored on the computer.

When I registered for the first time, three years ago, the same things happened, but I just assumed that I'd made some mistake, and left it at that.

Is there anyone who has had the same experience, or who can guess what I might be doing wrong?

[Clair]

There have been some changes to the online declaration this year (http://www.completefrance.com/cs/forums/1635896/ShowPost.aspx).

Could it be the reason?

Edit: I have just visited the impôts website and my certificate is still valid, so no re-registration was necessary.

[gosub]

If you are using Firefox got to TOOLS, OPTIONS, ADVANCED, ENCRYPTION. to view certificates, probably similar in I.E.

[allanb]

Thanks for both replies.

Gosub: that solves the backup problem (and also allows me to put a password on the backup file, which is good).  However,  I still don't have password protection on my access to my actual tax account.

Clair: I'm not sure I can remember exactly why it was necessary for me to re-register, but I know that there was some problem which caused the Impôts system to say "the solution to this problem is to de-register and then re-register" or words to that effect.  I promise I didn't choose to do it for fun! 

At one point I think I read that registration was only good for three years - is this possible?

[Clair]

[quote user="allanb"]At one point I think I read that registration was only good for three years - is this possible?[/quote]

That's correct. Mine is valid until 24/04/2010.

If you follow Gosub's instructions above, you can find out the expiry date of yours.

[allanb]

And (to come back to my first point) do you have a password that protects access to your account?

[Clair]

No password.

[Ron Avery]

"And (to come back to my first point) do you have a password that protects access to your account?"

Yes, but some systems like Firefox have a habit of autofilling but you can turn this off. 

 

Allen, remember you also have to know your finance number and teledeclaration number to do anything much and you cannot pay any bills without having the invoice number.  No, its nothing like as secure as the Government gateway in the UK with its 16 digit gobbleydegook passwords but heh, its France and a darn site easier to use!!

[Clair]

[quote user="Ron Avery"]"And (to come back to my first point) do you have a password that protects access to your account?"

Yes, but some systems like Firefox have a habit of autofilling but you can turn this off.

[/quote]

I use Firefox and no password is required or asked for.

I just click on "Particuliers", then on "Accedez à votre espace".

The site then asks for the certificate, which is automatically selected, click on it and Robert est my oncle!

[Ron Avery]

Maybe we are not comparing like with like  My current certificate which now expires in 3 days time,

 "Je vous informe que votre certificat électronique expire dans 10 jours ce qui entraînera la résiliation automatique de votre abonnement." 

needs a password and I enter that at the point that you now don't.

But the message I got telling me that my old certificate was expiring also invited me to log on and I could either declare on line without a certificate or continue to use the existing one.

- vous pouvez déclarer sans certificat, à partir de n’importe quel ordinateur. Vous pouvez aussi continuer à utiliser votre certificat.

So it seems, all I now have to do is log on "et voila" [:)]

[allanb]

[quote user="Clair"]I use Firefox and no password is required or asked for.  I just click on "Particuliers", then on "Accédez à votre espace".  The site then asks for the certificate, which is automatically selected, click on it and Robert est my oncle![/quote]

Exactly the same for me.

So, in other words, anyone with access to your computer, without providing any personal identification, can have a look at your last income tax return and see the amounts of tax assessed and tax paid?

That's not exactly what I would call "confidentiality".

The message that Ron quoted -

...vous pouvez déclarer sans certificat, à partir de n’importe quel ordinateur. Vous pouvez aussi continuer à utiliser votre certificat...

- seems to mean that for the purpose of declaring tax, you can use the certificate, or not, as you wish.

The whole thing is, to say the least, bizarre.  Does anyone see a glimmer of sense in it?

[Ron Avery]

Allen, you still need your numero fiscale and teledeclerant number to access your accounts or do anything, I guess they want more people to do their returns on line and maybe whilst at work.  Its the same with the bank, all I need is my account number and password, with HSBC I need date of birth,  12 character log in number and a security number, French internet security does not appear to be as stringent, maybe they just don't see why anyone would want to access other people's tax declarations.

[gosub]

If you have the certificate on your own personal computer, who else has access to it, or would want to access it? After making your declaration online, you can always delete the the certificate, if you feel your security might me threatened, but it's only a tax declaration.

If you choose this year, not to use a certificate and want to be able to to access your tax account from any computer you have access to, you will  have to enter three different passwords. Secure enough for me.

[suein56]

[quote user="Ron Avery"]Its the same with the bank, all I need is my account number and password, with HSBC I need date of birth,  12 character log in number and a security number, French internet security does not appear to be as stringent... [/quote]

What I have found is that in the UK once you are 'in' to your account you can transfer money without any further need for inputting another password. But, by contrast in France, whilst I can access my bank account relatively easily, if I want to do anything proactive like transferring money, I am asked for another password. Likewise in the UK once I am into my account I can set up a new payment transfer and use it immediately, here I am obliged to set it up online but wait 2/3 days for confirmation that it is functioning - incase it was not me that set up the payment.

Sue

[Clair]

Very true, Suein56, although...

I recently set up an online transfer from Mr Clair bank account towards my account in the same bank.

The transfer had to be acknowledged by phone and I was asked to confirm the tel number given by Mr Clair when the account was set up.

When the bank called the following day, Mr Clair, who works nights, was in bed. I answered the call and I was asked to confirm "his" transfer instructions towards my account.

It's a good thing they know me and I know them, but honestly, I could have been any scammer giving her own tel number...[blink]

[Sunday Driver]

The electronic certificate has nothing to do with security.

It merely contains a digital signature which you originally set up the first time you declared on-line and which has, up until now, served to legally 'sign' your on-line tax declaration.  Clearly they have decided to dispense with this 'signature' requirement, making use of the certificate optional so you are not tied to using the same computer every time.

In terms of the secure access to your account, your teledeclarant number,tax reference code and your last year's RFR provide the actual security.  As long as you don't pass this information to a third party then they can't access your account.

 

 

[allanb]

[quote user="Sunday Driver"]In terms of the secure access to your account, your teledeclarant number, tax reference code and your last year's RFR provide the actual security.  As long as you don't pass this information to a third party then they can't access your account. [/quote]It depends what you mean by "access to the account".   I understand that you need the  télédéclarant number, etc, to make a payment or a new declaration.  My complaint - if you can call it that - is that anyone using my computer can look at my past tax returns, without entering any information at all: just by a series of clicks.

If that's the way it's intended to work, it's a bad system.  (Would you approve of an online banking service that required personal identification to make a payment, but allowed any casual user of your computer to look at the history of your account?)

But in fact I don't think it is deliberate.  Here is what the site says about the workings of the "espace abonné" (my emphasis):

En possession de votre certificat électronique, vous pouvez utiliser les services en ligne autant de fois que vous le souhaitez, en cliquant simplement sur "Espace abonné>Accédez à votre espace". Votre certificat électronique, implanté sur votre ordinateur, s’affiche automatiquement, cliquez sur OK. Indiquez ensuite dans “ Clé privée ” le mot de passe que vous avez mentionné lorsque vous avez obtenu votre certificat.

But this doesn't happen; I am not asked for a password, and I was never invited to create one - neither this year, nor the first time three years ago.  Evidently it didn't happen for Clair either.  I think it's a programming error.

[Clair]

[quote user="allanb"]... I am not asked for a password, and I was never invited to create one - neither this year, nor the first time three years ago.  Evidently it didn't happen for Clair either.  I think it's a programming error.[/quote]

Hang on just a sec please... [:)]

When I said I was not being asked for a password to log on to the account, I was not referring to the original set-up. I was only referring to the day-to-day access to my tax account.

(To be honest, I cannot remember how I set up the access, as I was having problems with my previous laptop and I had to bring all my data across to this new one.)

[allanb]

Sorry if I misrepresented you!

But if you can "access your account" - in the sense of looking at past returns - without entering a password, then I think that illustrates my point anyway, doesn't it?

[suein56]

[quote user="allanb"]But if you can "access your account" - in the sense of looking at past returns - without entering a password, then I think that illustrates my point anyway, doesn't it?  [/quote]

My access seems safe enough:

Last year I declared online via IE using the certificate I acquired the year before. I had to choose the certificate, verify it and then input my password before I was allowed to access details of my tax account. This year if I access the Impots site using IE exactly the same thing happens. If I access the site using Firefox then it says it cannot find a certificate and tells me to try again or reregister. But there is now also the option to declare online without a certificate using a system of 3 passwords.

Sue

[Clair]

[quote user="suein56"]... I access the Impots site using IE exactly the same thing happens. If I access the site using Firefox then it says it cannot find a certificate and tells me to try again or reregister. [/quote]

The certificate is stored by the browser, so if you use different browsers( IE, FF, Chrome, Opera), technically you need a certificate for each.

On my old PC, I used to access my French tax account via MS Money, but I could not access it from FF or IE, as the certificate was stored by MS Money.

[allanb]

[quote user="suein56"]I had to choose the certificate, verify it and then input my password before I was allowed to access details of my tax account...[/quote]But I don't have a password and have never had an opportunity to create one; and the system never asks me for one, no matter what I want to do.  That's my point.

It sounds as though we're talking about two different versions of the system: I suppose that's possible.