8 ms·

USPS ‘Informed Delivery’ Is Stalker’s Dream

112 points by tonyztan 9y ago

wristmittens 9y ago
I tied my email address to my USPS address three apartments and half a decade ago. Apparently I never updated it since I'm now receiving email from Informed Delivery with images of mail addressed to that apartment which is obviously not addressed to me...
- tedmiston 9y ago
  I wonder if they’ve thought through this use case for apartments. It seems like you shouldn’t receive anything that doesn’t match your name or “current resident”.
  - devrand 9y ago
    When I registered a change of address with USPS they automatically canceled my informed delivery at the old address. You also cannot have multiple addresses. So you would need to cancel your old informed digest to register your new address for informed digest. I guess the best solution would be for them to periodically send a letter to registered addresses with a code they can use to view/manage informed digest reciepients for that address.
  - kylehotchkiss 9y ago
    It all works out if you do moving notification with them. Which everybody should be doing, as things from the IRS or old utility bills sometimes tend to not make it to new address you give them. Plus some of the moving coupons they mail you are pretty good deals. Win-win.
    - rconti 9y ago
      Incorrect. My Informed Delivery information was 2 moves out of date and I always file change of address, my ballots are sent to the new address, etc. Looking back on it, I don't think there's any requirement you use your usps.gov login to file a change of address, but that site's info is what they use for informed delivery.
zeveb 9y ago
What's really sad is that the USPS could be in the identity business. What other organisation has agents who canvas the entire country on a daily basis, visiting every home and business?
- digikata 9y ago
  And has offices where one could go and have physical checks for establishing identity...
  - wohlergehen 9y ago
    This actually how it works in Germany. The postal service provides PostIdent [1]. E.g. when opening a bank account, you get a letter with which you go to a post office where you sign and your ID gets checked. 1: https://de.wikipedia.org/wiki/Postident https://de.wikipedia.org/wiki/Postident
- zaroth 9y ago
  Isn't this a prime example of what happens when USPS puts a toe in the water of the identity business? Be careful what you wish for!
- protomyth 9y ago
  I don't disagree about their ability to be in the identity business, but the image of them doing home delivery everywhere is a bit dated. There are swaths of the US where you get a PO Box and no delivery of any kind.
  - dawnerd 9y ago
    Or basically any new development since they require cluster boxes now. Unless it’s a quick stop for the driver, expect lots of “attempted delivery” slips.
    - protomyth 9y ago
      Wow, that would suck, but at least they probably have a street addresses. That whole 911 thing is oddly implemented.
gregmac 9y ago
I signed up for a service from UPS a few years ago that notifies me of impending shipments and lets me do a few limited things like 'Hold for pickup'. The authentication for it was simple and reasonably secure: they physically mailed me a card with a verification number I had to type in. It took a few days of course, but only someone with access to my mailbox can get the card (and my mailbox requires a key to open). This "knowledge-based authentication" system USPS is using is most definitely less secure, and I can't fathom how it wouldn't be immensely more complex to build and maintain.
- zaroth 9y ago
  If you move, would UPS catch that and automatically turn it off?
  - gregmac 9y ago
    Hm, I am not sure. The program is called UPS My Choice, one of the items in their FAQ [1] has: "There are some common reasons why you’re currently unable to enroll in UPS My Choice, including:" "You recently moved to a new home. There may be little or no public record information about your move. Unfortunately, until updated information about your move becomes part of the public record through mortgages, deeds, utility bills, etc., you won't be able to enroll." It does sound like they do more verification, but it's not clear if they check this regularly to deactivate accounts. It also makes me wonder if they verify by the name the shipment is going to (matching last name). I've never had something shipped to my house that didn't have my last name on it so I'm not sure. [1] https://www.ups.com/us/en/help-center/tracking-support/validate-identity.page https://www.ups.com/us/en/help-center/tracking-support/valid...
    - lostapathy 9y ago
      They do verify names. I have had packages shipped to my house on behalf of friends, or in a hobby business name, and don't get notified like I get for my packages.
  - huebnerob 9y ago
zaroth 9y ago
This part was the most interesting to me; There is a final precaution that should block anyone from signing up as you: Readers who have taken my advice to freeze their credit files with the four major consumer credit reporting bureaus (Equifax, Experian, Innovis and Trans Union) will find they are not able to sign up for Informed Delivery online. That’s because having a freeze in place should block Equifax from being able to ask you the four KBA questions. Do people realize that the freeze locks you out of any service using KBA to authenticate? E.g. would this include sites like login.gov?
- tedmiston 9y ago
  Is it easy or possible to freeze and unfreeze on demand as needed?
  - dawnerd 9y ago
    Sure if you like paying the fee every time. Shouldn’t have a fee to begin with though. Just a way to talk people out of it, really.
    - gertef 9y ago
      Equifax is waiving the fee since the recent incident.
      - dawnerd 9y ago
        From what I read it's just on their identity service which isn't actually a freeze. Also doesn't solve the problem of the other agencies charging. You really need a freeze against them all.
    - greenyoda 9y ago
      Apparently, in some states, they're not allowed by law charge a fee. I'm in NY, and I was able to freeze my credit reports for free.
  - rdiddly 9y ago
dboreham 9y ago
Funny I thought the exact same thing when my wife forwarded the email to me the other day. Like: "What were they thinking??"
Aloha 9y ago
As someone who uses this service, I find it invaluable.
- benburleson 9y ago
  Would it not be just as valuable if they required better security to use it?
  - Aloha 9y ago
    it depending on how much - if it required a trip to the post office to enroll, probably not, if it required me to mail a postcard back confirming I wish to enroll, probably.
ckorhonen 9y ago
I've been using the service for a while and really like it. One oddity though - about 3 months ago my wife started getting Informed Delivery emails for our old address, didn't sign up for it and it was obvious from the names on the envelopes that we are not the current residents. Very odd...
eeeeeeeeeeeee 9y ago
Something else to keep in mind with this service: your email provider is now getting metadata on all of your physical mail. By default, USPS sends the actual image of the front of the letter to your email.
- eeeeeeeeeeeee 9y ago
  Also, it looks like you can't change this behavior. I'd prefer if I simply received an email that said "you have mail coming soon, sign in to view the image" but it appears to either be off/on, you can't customize the actual notification message.
- DarronWyke 9y ago
  Which really doesn't matter if you use that same address for online ordering. Which has your address plastered on it. In plain text.
  - devy 9y ago
    No, that's not the point. It's not the plain text address info that matters but the sender (who sends you snail mail) matters. E.G. 123 Main St, Music City, USA is public knowledge to all people touches your physical mails, but no one has the entire picture of all physical mails you are getting from in your physical inbox (shops, banks etc.), until now with Informed Delivery courtesy of USPS.
  - eeeeeeeeeeeee 9y ago
    Maybe go read what I wrote before replying? I'm talking about metadata. They will see every company/person you correspond with by mail now.
analogmemory 9y ago
So I tried to signup and all the "knowledge-based authentication" questions were places I'd never lived or phone numbers i'd never used. So I failed the authentication. Now I need to go into a physical post office and verify in person. This seems like a better option!
rconti 9y ago
I'm accidentally stalking someone via Informed Delivery. They emailed me, saying my address is eligible, so I signed in with my USPS account. It ONLY listed an address from 2 moves ago; I haven't lived there in over 6 years. There was no other way to sign up. So I signed up, assuming just some records were out of date, or I'd be able to update my address once signed in. Nope. I'm getting informed delivery digests for a woman I don't know for an address I haven't lived at in 6 years. I changed my address in my USPS online profile, and stopped getting the digests, but haven't gotten them for my new address yet. What's frustrating about this is what's always frustrating about these kinds of services -- I have no idea how they're tracking me, and hence no understanding of how data is indexed. USPS knows my address. I've filed change of address forms with them every time I've moved. The mail was duly forwarded each time. I've put holds on my mail multiple times when on vacation. The hold was honored. I've bought postage online. Etc. As an end user, I would't go so far as to say I can't tell how it works, but I shouldn't have to know, and I don't bother. If I file my change of address or mail hold, and it works, that's all I care about. I don't bother to see if I have a saved session, if I'm logged in or if there's just a cookie, and if those services are tied to my online profile. I just go to the site, punch in the info, and use it. So I found it quite surprising that my online profile would have such horribly out of date info (with no obvious way of updating it during the Informed Delivery signup process).
chx 9y ago
While we do not have the same service in Canada, the federal my tax account "forgot password" functionality is snail mail. Drove me nuts before I moved to a password manager because I travel so much. Much like the presumed clients of this service. So sending a snail mail would not be as effective as this article makes it -- unless it's not verification but the password itself. Consequently: what the post should do is create an account for everyone eligible and send out a note with username and password. Done.
test6554 9y ago
I wish I could have 72 hours to review the front of all my snail mail electronically and either select "release to mailbox" or "shred/recycle/delete". After 72 hours it just assumes you want to release it to your mailbox. Logistically, something like that could save the post office a bunch of money since they don't refund postage just because it was delivered electronically. Furthermore, people expecting a high-priority package would be more likely to log in and release it to their mailbox more quickly. Also I wish I could opt to "block sender" for ads and other junk. The post office would still get money/postage, but I would just give the post office advanced consent to shred/recycle all mail from this sender and consider it officially delivered.
- gertef 9y ago
  > I wish I could have 72 hours to review the front of all my snail mail electronically https://www.google.com/search?q=postal+mail+virtual https://www.google.com/search?q=postal+mail+virtual > The post office would still get money/postage, The post office can't take money from a customer and then fail to provide the service because someone else told them to. That would be fraid.
- ghostly_s 9y ago
  > Also I wish I could opt to "block sender" for ads and other junk. The post office would still get money/postage, but I would just give the post office advanced consent to shred/recycle all mail from this sender and consider it officially delivered. I don't think you understand how junk mail works -- the mailers have a close business relationship with the USPS, and the fact that you can't 'block' it is a deliberate design pattern. Junk mail is a huge (possibly the major?) revenue stream for the post office. Forcing you to physically handle their advertising message before discarding it is the whole value proposition of this form of advertising; junk mailers aren't gonna keep paying the USPS if the ads are never getting to you.
  - djsumdog 9y ago
    In many other countries, you can put "No junk mail" or "No bulk mail" on your letterbox. The US post service, being a service provided by the state, should help to prevent wasting paper and serve the people, not the corporations. In the US, the corporations are not just the primary customers of the USPS, they pretty much own them as far as influence goes.

112 points by tonyztan 9y ago

I tied my email address to my USPS address three apartments and half a decade ago. Apparently I never updated it since I'm now receiving email from Informed Delivery with images of mail addressed to that apartment which is obviously not addressed to me...

tedmiston 9y ago
I wonder if they’ve thought through this use case for apartments. It seems like you shouldn’t receive anything that doesn’t match your name or “current resident”.
- devrand 9y ago
  When I registered a change of address with USPS they automatically canceled my informed delivery at the old address. You also cannot have multiple addresses. So you would need to cancel your old informed digest to register your new address for informed digest. I guess the best solution would be for them to periodically send a letter to registered addresses with a code they can use to view/manage informed digest reciepients for that address.
- kylehotchkiss 9y ago
  It all works out if you do moving notification with them. Which everybody should be doing, as things from the IRS or old utility bills sometimes tend to not make it to new address you give them. Plus some of the moving coupons they mail you are pretty good deals. Win-win.
  - rconti 9y ago
    Incorrect. My Informed Delivery information was 2 moves out of date and I always file change of address, my ballots are sent to the new address, etc. Looking back on it, I don't think there's any requirement you use your usps.gov login to file a change of address, but that site's info is what they use for informed delivery.

zeveb 9y ago

What's really sad is that the USPS could be in the identity business. What other organisation has agents who canvas the entire country on a daily basis, visiting every home and business?

digikata 9y ago
And has offices where one could go and have physical checks for establishing identity...
- wohlergehen 9y ago
  This actually how it works in Germany. The postal service provides PostIdent [1]. E.g. when opening a bank account, you get a letter with which you go to a post office where you sign and your ID gets checked. 1: https://de.wikipedia.org/wiki/Postident https://de.wikipedia.org/wiki/Postident
zaroth 9y ago
Isn't this a prime example of what happens when USPS puts a toe in the water of the identity business? Be careful what you wish for!
protomyth 9y ago
I don't disagree about their ability to be in the identity business, but the image of them doing home delivery everywhere is a bit dated. There are swaths of the US where you get a PO Box and no delivery of any kind.
- dawnerd 9y ago
  Or basically any new development since they require cluster boxes now. Unless it’s a quick stop for the driver, expect lots of “attempted delivery” slips.
  - protomyth 9y ago
    Wow, that would suck, but at least they probably have a street addresses. That whole 911 thing is oddly implemented.

gregmac 9y ago

I signed up for a service from UPS a few years ago that notifies me of impending shipments and lets me do a few limited things like 'Hold for pickup'. The authentication for it was simple and reasonably secure: they physically mailed me a card with a verification number I had to type in. It took a few days of course, but only someone with access to my mailbox can get the card (and my mailbox requires a key to open). This "knowledge-based authentication" system USPS is using is most definitely less secure, and I can't fathom how it wouldn't be immensely more complex to build and maintain.

zaroth 9y ago
If you move, would UPS catch that and automatically turn it off?
- gregmac 9y ago
  Hm, I am not sure. The program is called UPS My Choice, one of the items in their FAQ [1] has: "There are some common reasons why you’re currently unable to enroll in UPS My Choice, including:" "You recently moved to a new home. There may be little or no public record information about your move. Unfortunately, until updated information about your move becomes part of the public record through mortgages, deeds, utility bills, etc., you won't be able to enroll." It does sound like they do more verification, but it's not clear if they check this regularly to deactivate accounts. It also makes me wonder if they verify by the name the shipment is going to (matching last name). I've never had something shipped to my house that didn't have my last name on it so I'm not sure. [1] https://www.ups.com/us/en/help-center/tracking-support/validate-identity.page https://www.ups.com/us/en/help-center/tracking-support/valid...
  - lostapathy 9y ago
    They do verify names. I have had packages shipped to my house on behalf of friends, or in a hobby business name, and don't get notified like I get for my packages.
- huebnerob 9y ago

zaroth 9y ago

This part was the most interesting to me; There is a final precaution that should block anyone from signing up as you: Readers who have taken my advice to freeze their credit files with the four major consumer credit reporting bureaus (Equifax, Experian, Innovis and Trans Union) will find they are not able to sign up for Informed Delivery online. That’s because having a freeze in place should block Equifax from being able to ask you the four KBA questions. Do people realize that the freeze locks you out of any service using KBA to authenticate? E.g. would this include sites like login.gov?

tedmiston 9y ago
Is it easy or possible to freeze and unfreeze on demand as needed?
- dawnerd 9y ago
  Sure if you like paying the fee every time. Shouldn’t have a fee to begin with though. Just a way to talk people out of it, really.
  - gertef 9y ago
    Equifax is waiving the fee since the recent incident.
    - dawnerd 9y ago
      From what I read it's just on their identity service which isn't actually a freeze. Also doesn't solve the problem of the other agencies charging. You really need a freeze against them all.
  - greenyoda 9y ago
    Apparently, in some states, they're not allowed by law charge a fee. I'm in NY, and I was able to freeze my credit reports for free.
- rdiddly 9y ago

dboreham 9y ago

Funny I thought the exact same thing when my wife forwarded the email to me the other day. Like: "What were they thinking??"

Aloha 9y ago

As someone who uses this service, I find it invaluable.

benburleson 9y ago
Would it not be just as valuable if they required better security to use it?
- Aloha 9y ago
  it depending on how much - if it required a trip to the post office to enroll, probably not, if it required me to mail a postcard back confirming I wish to enroll, probably.

ckorhonen 9y ago

I've been using the service for a while and really like it. One oddity though - about 3 months ago my wife started getting Informed Delivery emails for our old address, didn't sign up for it and it was obvious from the names on the envelopes that we are not the current residents. Very odd...

eeeeeeeeeeeee 9y ago

Something else to keep in mind with this service: your email provider is now getting metadata on all of your physical mail. By default, USPS sends the actual image of the front of the letter to your email.

eeeeeeeeeeeee 9y ago
Also, it looks like you can't change this behavior. I'd prefer if I simply received an email that said "you have mail coming soon, sign in to view the image" but it appears to either be off/on, you can't customize the actual notification message.
DarronWyke 9y ago
Which really doesn't matter if you use that same address for online ordering. Which has your address plastered on it. In plain text.
- devy 9y ago
  No, that's not the point. It's not the plain text address info that matters but the sender (who sends you snail mail) matters. E.G. 123 Main St, Music City, USA is public knowledge to all people touches your physical mails, but no one has the entire picture of all physical mails you are getting from in your physical inbox (shops, banks etc.), until now with Informed Delivery courtesy of USPS.
- eeeeeeeeeeeee 9y ago
  Maybe go read what I wrote before replying? I'm talking about metadata. They will see every company/person you correspond with by mail now.

analogmemory 9y ago

So I tried to signup and all the "knowledge-based authentication" questions were places I'd never lived or phone numbers i'd never used. So I failed the authentication. Now I need to go into a physical post office and verify in person. This seems like a better option!

rconti 9y ago

I'm accidentally stalking someone via Informed Delivery. They emailed me, saying my address is eligible, so I signed in with my USPS account. It ONLY listed an address from 2 moves ago; I haven't lived there in over 6 years. There was no other way to sign up. So I signed up, assuming just some records were out of date, or I'd be able to update my address once signed in. Nope. I'm getting informed delivery digests for a woman I don't know for an address I haven't lived at in 6 years. I changed my address in my USPS online profile, and stopped getting the digests, but haven't gotten them for my new address yet. What's frustrating about this is what's always frustrating about these kinds of services -- I have no idea how they're tracking me, and hence no understanding of how data is indexed. USPS knows my address. I've filed change of address forms with them every time I've moved. The mail was duly forwarded each time. I've put holds on my mail multiple times when on vacation. The hold was honored. I've bought postage online. Etc. As an end user, I would't go so far as to say I can't tell how it works, but I shouldn't have to know, and I don't bother. If I file my change of address or mail hold, and it works, that's all I care about. I don't bother to see if I have a saved session, if I'm logged in or if there's just a cookie, and if those services are tied to my online profile. I just go to the site, punch in the info, and use it. So I found it quite surprising that my online profile would have such horribly out of date info (with no obvious way of updating it during the Informed Delivery signup process).

chx 9y ago

While we do not have the same service in Canada, the federal my tax account "forgot password" functionality is snail mail. Drove me nuts before I moved to a password manager because I travel so much. Much like the presumed clients of this service. So sending a snail mail would not be as effective as this article makes it -- unless it's not verification but the password itself. Consequently: what the post should do is create an account for everyone eligible and send out a note with username and password. Done.

test6554 9y ago

I wish I could have 72 hours to review the front of all my snail mail electronically and either select "release to mailbox" or "shred/recycle/delete". After 72 hours it just assumes you want to release it to your mailbox. Logistically, something like that could save the post office a bunch of money since they don't refund postage just because it was delivered electronically. Furthermore, people expecting a high-priority package would be more likely to log in and release it to their mailbox more quickly. Also I wish I could opt to "block sender" for ads and other junk. The post office would still get money/postage, but I would just give the post office advanced consent to shred/recycle all mail from this sender and consider it officially delivered.

gertef 9y ago
> I wish I could have 72 hours to review the front of all my snail mail electronically https://www.google.com/search?q=postal+mail+virtual https://www.google.com/search?q=postal+mail+virtual > The post office would still get money/postage, The post office can't take money from a customer and then fail to provide the service because someone else told them to. That would be fraid.
ghostly_s 9y ago
> Also I wish I could opt to "block sender" for ads and other junk. The post office would still get money/postage, but I would just give the post office advanced consent to shred/recycle all mail from this sender and consider it officially delivered. I don't think you understand how junk mail works -- the mailers have a close business relationship with the USPS, and the fact that you can't 'block' it is a deliberate design pattern. Junk mail is a huge (possibly the major?) revenue stream for the post office. Forcing you to physically handle their advertising message before discarding it is the whole value proposition of this form of advertising; junk mailers aren't gonna keep paying the USPS if the ads are never getting to you.
- djsumdog 9y ago
  In many other countries, you can put "No junk mail" or "No bulk mail" on your letterbox. The US post service, being a service provided by the state, should help to prevent wasting paper and serve the people, not the corporations. In the US, the corporations are not just the primary customers of the USPS, they pretty much own them as far as influence goes.