Share this content
0
860

Topup Tax Software by Absolute Tax

Topup Tax Software by Absolute Tax

Didn't find your answer?

Search AccountingWEB

Hi, has anyone used Topup Tax by Absolute Tax? You can buy increments of 5 returns for £25 + vat and the maximum you can pay is £1000 plus vat if you exceed 200 returns.  Does anyone have any experience using this software and if so is it any good?

Replies (5)

Please login or register to join the discussion.

By Tim Vane
20th Jun 2019 14:04

It’s fine for the odd form or two each year but I wouldn’t want to use it every day, or even every week.

Thanks (1)
Photo
By Phil Mountjoy
09th Aug 2019 11:42

I had a quick look at the trial software but not enough yet to make a decision. However, my AVG antivirus software has blocked the website because apparently it is on Google's list of sites that use http for payment rather than https. I can't say if that is true until I figure out how to access the website again. Quite glad I haven't paid for it yet.

Thanks (0)
Replying to Phil Mountjoy:
avatar
By johnhemming
09th Aug 2019 12:19

I am not sure that is a real issue with Absolute Tax. I have run a quick test on their security (TLS). They get a grade "A" from SSLLabs. That is not the top grade, but it should be good enough. Some MTD providers don't manage "A".

Thanks (0)
Replying to johnhemming:
Photo
By Phil Mountjoy
09th Aug 2019 16:23

The problem occurs when I try to update the software. AVG seems to have a problem with www.topup-software.co.uk. I could add the URL to the exceptions list but I'm a bit wary of doing that if it is not secure.
SSL Labs come up with the following which could well mean that the site is safe:

We were able to retrieve a certificate for this site, but the domain names listed in it do not match the domain name you requested us to inspect. It's possible that:

The web site does not use SSL, but shares an IP address with some other site that does.
The web site no longer exists, yet the domain name still points to the old IP address, where some other site is now hosted.
The web site uses a content delivery network (CDN) that does not support SSL.
The domain name is an alias for a web site whose main name is different, but the alias was not included in the certificate by mistake.

Thanks (0)
Replying to Phil Mountjoy:
avatar
By johnhemming
09th Aug 2019 17:19

You are right to be worried about this.

The site has a rubbish certificate which is over 4 years out of date for a different server name and is "self signed". Hence it means nothing.

You should not add it to the exceptions list as it means that it is vulnerable to a MITM (Man In The Middle) attack.

The server at 164.177.138.156 is listening on port 443. I think it does use SSL as an option, but it also does cleartext on port 80.

It is probably contrary to HMRC's terms of use to have this as part of MTD if it is part of MTD.

Hence from a cybersecurity perspective it is pretty dreadful.

I would personally be nervous about allowing any exceptions on the issue of wrong certificates as it creates an immediate vulnerability. It is not the same as a certificate that is a few days out of date (or even hours), but something that you can have no confidence in.

Thanks (1)
Share this content