[mindslight]

So much web software shamelessly includes malware. When you need proprietary software to do anything sensitive, a better approach is to pirate an installable software package, install and fully update it, make sure it works, kill the VM's Internet access and never reenable it, and communicate only via Samba on the local network. This takes care of OS, developer, and distributor malware in one fell swoop.

(I agree with another comment saying we need privacy legislation that would stop this sort of thing, but in the mean time the only thing you can change is yourself)

[mistrial9]

hah! - this is getting downvotes and yet there is some truth in it. Anyone with experience over time has seen the erosion of privacy and repeated data leaks from consumer-facing companies.. in the case of tax preparation software, leaking explicitly private and sensitive financial details with names and unique identifying information, directly.

What choice is there when commercial companies push user-hostile and perhaps directly illegal leaks like this?

I will not advocate software piracy on a sealed VM like the pp here, but please consider the skill, time and effort it takes to write acceptable consumer software, as a direct barrier to entry for "fair" players, and then add network effects.. With that, consider the personal productivity software that has been built slowly and well over two decades in an open way.. where the user of the software has the right and ability to examine, modify and use the code.

I predict that intrusion and forced-interference into tax transactions will increase over time in almost every jurisdiction around the world. There really is no better time than now to re-examine your own practices with software on the open net.

[mindslight]

You could pay for the software and do the same thing. But if you still have to spend so much effort making sure the publisher isn't attacking you, what obligation do you have? It's a low trust economy and thus law of the jungle. A privacy law akin to the GDPR could increase the level of trust and support straightforwardly participating in that economy. All we have right now is the dumpster fire drumbeat of whichever companies were found abusing their users this week, with vanishingly small reason to not keep doing it once they're out of the limelight.