Carter Yagemann

Carter Yagemann

Assistant Professor of Computer Science and Engineering at the Ohio State University with interests in automated vulnerability discovery, root cause analysis, exploit prevention, and cyber-physical security.

H&R Block App Analytics for 2019

Last year I wrote a blog post about using the analytics publicly released by the USA government to gleam some information about H&R Block's mobile apps. If you haven't read it, I recommend doing so because in this post I'm going to give an update for the 2019 tax year.

I haven't changed the code or data source, so check the original blog post for those and as I previously mentioned, I've been collecting this data since 2016 and I'm happy to share upon request.

Results

Here are the results for 2019, in no particular order:

  • From January 13 through April 11, 497 requests were made by MyBlock and 334,960 by Taxes.
  • 322,749 requests were made from phones while 12,708 were tablets; about 96% of the requests were phones.
  • 100% of requests were made by devices running iOS.
  • Three versions of MyBlock appear in the dataset: 6.6.0, 6.8.0, and 7.0.1.
  • Seven versions of Taxes appear in the dataset: 7.7.1, 7.8.0, 8.1.0, 8.2.0, 8.3.0, 8.5.0, and 8.6.0.
  • 100% of requests contain "Mozilla" in the user-agent.

And the security question from the original blog post:

  • 197,548 requests used TouchID, 88,094 FaceID, and 49,815 showed neither keyword; 59%, 26%, and 15%, respectively.

Comparison to 2018

  • Whereas in 2018 the vast majority of requests were made by MyBlock, in 2019 almost all requests were made by Taxes.
  • No requests by Android devices appear in 2019.
  • The change in usage of TouchID, FaceID, and neither is -15%, 19%, and -4%, respectively.

Discussion

It's interesting that no requests were made from Android devices in 2019. The MyBlock app is listed on the Play store, so why don't they appear in the data? One possibility is they no longer use a special user agent. Another is they no longer communicate with a USA government website contained in the public analytic data. It's hard to know for certain what the root cause is.

We can also see that the usage of FaceID is rising at a cost to both of the other categories. This implies conversions came from both existing TouchID users and new adopters. The shift makes sense as more FaceID compatible phones reach customer hands. It'll be interesting to see if this trend continues in 2020 or if the adoption of Apple's biometric features reaches premature saturation.