If someone is able to hijack a session, they could install programs that create back doors to allow an intruder to take full control of the computer. They can theoretically target specific files to specific users, such as a program to monitor the user's computer or network, even behind a firewall. Intuit has chosen not to encrypt the sessions, thereby creating this risk. The user has no control over what information is retrieved from their system. They must simply hope that Intuit won't do something to violate their privacy, and that no malicious users will hijack a legitimate session.
Users are unaware of what information is being collected and for what purpose it is being used.
Issue 2 QuickBooks 2000 is integrated with Microsoft Internet Explorer 5. Many of the windows in QuickBooks are HTML generated on the fly. With the seamless web integration, Intuit has created certain text items within the GUI that are in fact links to web sites, and not buttons, to perform local program functions. These links are not labeled as such and appear no different than HTML links that open other local windows. This in itself is not such a security problem.