9 ms·

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many ot

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify residents when someone at their address signs up for Informed Delivery. The USPS addressed that shortcoming earlier this year, announcing it had started alerting all households by mail whenever anyone signs up to receive scanned notifications of mail delivered to their address. > However, it appears that ID thieves have figured out ways to hijack identities and order new credit cards in victims’ names before the USPS can send their notification What the actual hell? You can sign up online to get mail scanned… without any physical verification you're at the address, with only a physical notification being sent after-the-fact? What the hell are USPS smoking? It makes me wonder what you need to do to sign up for this. I wonder… goes to website it seems like the only thing they do is ask for the address, and you check a box to accept the T&Cs. I don't know if there's actual verification beyond that step, but it doesn't sound like there is…

Spooky23 8y ago
That’s a real shame. I must have signed up after that letter was sent. It’s a great service otherwise.
mannykannot 8y ago
> What the hell are USPS smoking? Whatever it is, there is a lot of it about.
ams6110 8y ago
You can forward someone else's mail too. Just go to the post office, fill out the form, and drop it in the mailbox. There's no verification, though there is notification at both the old and the new address. Not to mention it's a crime to do that.
- TazeTSchnitzel 8y ago
  Here in Sweden, everyone's address has to be registered with the Tax Agency. In their (securely authenticated by digital ID which can only be obtained using photo ID) online services you can choose to disallow changes of your registered address which are not made digitally to prevent this kind of thing. Personally I have this turned on, because I'm conscious that every piece of information you'd need to send a fake address change notification for me is either public or easily obtainable with a call to the Tax Agency, which is far from reassuring.
  - SamBam 8y ago
    That system would also allow us to completely get rid of our horrendous voter registration system, and make universal voting a reality.
    - TazeTSchnitzel 8y ago
      It would. In fact, Sweden has no “voter registration” per se, everyone who is registered as living here just gets a voting card in the mail before the election, I did earlier this year. (I only moved to Sweden this year and had no idea how to register to vote, turns out I don't need to!) It's not great for privacy though, so I understand the resistance of the US and the UK to it. Mind you, the US wouldn't have to make the whole thing public like Sweden does for… reasons.
      - dwighttk 8y ago
        What if you have like 10 addresses? Can you vote 10x?
        TazeTSchnitzel 8y ago
        One registered main address per person, though you can register an additional “special post address” if you want to get your mail somewhere other than where you sleep for an extended period of time. You can't vote twice even if you did get two cards, you have to show ID (which I dislike, but it's at least relatively easy to obtain here) and your name is crossed out on the voter list once you've voted.
_JamesA_ 8y ago
I signed up earlier this year and the validation required answering several multiple choice questions with data from my credit report such as mortgage, car loan, etc. I also received a postcard confirming that Informed Delivery had been activated for my postal address.
- TazeTSchnitzel 8y ago
  I see, so they do some kind of verification. Thanks for your reply! I guess asking about credit report info is inadequate if people are managing to abuse this. One problem with that kind of thing is it's essentially security by obscurity, it's not deliberately created secret knowledge that can be trusted, it's stuff which happens to not be public and which only you should know, but there's no guarantee and you can't easily change it, right?
  - _JamesA_ 8y ago
    The more I think about it I might be getting the validation mixed up with healthcare.gov. I definitely received the postcard though.
- shimon 8y ago
  I signed up a few months ago and had this type of validation as well. I didn't get a postcard, presumably they hadn't started that practice yet.
- rootusrootus 8y ago
  Same here. I signed up late last year and they used the same kind of credit bureau-based system that social security uses to verify your identity by asking questions about previous addresses, current mortgage or car loans, etc. Maybe it would be good to also add in a postcard check where they send you a code to verify you have access to mail for the address anyway. Sure, a thief could too, but in that case there isn't much of an extra risk to informed delivery since you'd be compromised already.
- sesutton 8y ago
  I just signed up and 2 out of the 4 questions could easily have been looked up on Zillow and they're all multiple choice with 4 options. The 2 questions were the year my house was built and the original sale price. So anyone would've had a 1/16 chance of just guessing it right.
3pt14159 8y ago
Yeah. It's essentially this bad almost everywhere. You think "surely X" but no. Almost never X. Almost always some lazy Y or nothing at all. After a couple consulting contracts / vuln disclosures I updated my priors of how competent the government was. I'm actually getting worried now that everything is going cyber-physical and corporations can pull the wool over their eyes. The government is great at offense, but defence is boring. Especially at non-fancy agencies / departments. And the salaries are low. But it doesn't even matter really. Basically so many things are broken and offense gets better over time while defence gets worse. I'm fighting for regulations, etc. But this stuff is so ill-defined that the government has trouble understanding it. I have come to blame the universities. The CompSci department should have gone to the Civil or Nuclear Engineering department and said "ok, how do we think about time frames over 100 years?" and built out courses out of that. But other than a handful of rare exceptions, right now most grads come out not understanding the true gravity of their decisions. The one nice thing is that offense is usually incompetent too. I've been on projects dealing with real crime[0]. The number of people nailed with just getting an IP is lolsy. Most criminals are stupid. I partly want to relay what the smartest 2%ile did just to show how low the bar is, but I fear educating the lower 98%. [0] Not stupid drug war stuff.
- shimon 8y ago
  This is a great perspective but it's important to remember your sample bias -- you're only making judgments about the offender you've identified. Or more snarkily, you've only caught the people dumber than you. When you're talking about basic attacks to steal some money, this is a substantial but not world-changing effect. On the other hand, a government or cartel willing to invest significant resources in cyber offense can really move the needle. What we've seen Russia, North Korea, Israel, and others achieve is probably only a fraction of what they've actually achieved.
  - 3pt14159 8y ago
    Yes, but they don't put their crack team on most stuff. Have you read the Snowden leaks? The actual raw content? It's pretty tame shit. My main takeaway was ahh, yes the world is as insecure as I thought it was not oh, these guys are using space laser technology hacks. They've got crack teams to break into some harder gear, and they've got some crazy awesome cryptanalyses going on, but for most of it it's just what you were I would do if someone asked us to get into a bank or whatever. Most stuff is easy to hack anyway unless it's a fully patched iPhone or patched / stripped / locked down Windows server. Plus you can see the codebases these guys have put out anyway. There was that peodophile CIA coder that had some of his personal codebase match his internal work and there are a bunch of current and former NSA / CSE guys floating around conferences. I sat with a whole table of them and watched them fall for a simple social engineering attack one minute after being told they were going to fall for the attack. They're not gods shimon.
LeftTurnSignal 8y ago
I use this service, and when I signed up there was nothing to verify I was who I was. I just put in my address, created an account, and within a day or so could get scans of mail sent to my e-mail. This is pretty great too. I moved about two months ago, and switched addresses in Informed Delivery. I got a letter saying I switched, but I never put their code into Informed Delivery, and I still get scans of my mail at the new place. I got the scans before the validation letter, so I could easily have stolen that, and no one would know I'm seeing their mail.... *Edit to make things clearer. I have not validated anything. The letter says I won't get emails unless I put the code in the letter in Informed Delivery. I did not do that ever and I still get the emails.
- tinus_hn 8y ago
  Note that tampering with the mail, even if there are little technical limitations, is a federal crime that carries pretty severe penalties.
  - obmelvin 8y ago
    I don't think GP is suggesting that anyone here tamper with mail. However, if you are someone who steals identities and money why would you care? This is pretty easy to verify properly and short of the time delay I can't think of any negative of doing so.
  - Someone1234 8y ago
    People love repeating this for some reason, but mail crime is under-funded, rarely investigated, and even more rarely enforced. Realistically if you tamper with mail nothing at all will happen to you, until your fraud raises to a headline figure and could get someone a promotion.
    - jeffmould 8y ago
      Interesting you say this as I had heard similar stories of underfunded mail crime investigations in the past. However, where I live is a very seasonal location. Population goes from 10000+ over the summer to under 1000 during the winter months. Several years ago a couple people in the community noticed problems with their mail (mail seemingly missing, receiving wrongly addressed items, etc..). They called the postal service and an investigator was out in days. Within two weeks there were hidden cameras mounted in various locations around town pointed at mailboxes. A few more weeks and they apprehended an individual going through mailboxes based on the photos from those cameras. I don't know the final outcome, but the total turnaround from notification to arrest was less than 3 months.
eof 8y ago
I went on (am on) a long international trip, and had my mail forwarded to my father's. It prompted me to sign up for that, and without any verification I immeidately started getting scans of every package being sent to my father's house. He was never notified by them, nothing came in the mail. This was ~8 months ago.
davemp 8y ago
This seems like yet another instance showcasing the staggering lack of engineering ethics going on in critical information infrastructure designs. We have/used methods (PE licensure) to ensure that some sort of ethical engineering is occurring in critical designs. I hope we can find a way to bring these practices back and protect the people who cannot be reasonably expected (or asked) to understand these designs.
joering2 8y ago
> What the hell are USPS smoking? They always been smoking something. When they released their "forward your mail to your new home online" feature where they charge your credit card $1 to verify your new ZIP code, I read it somewhere on dark web that a gift card works as well. I was actually purchasing new house, so I figured I give it a try! I bought a $20 gift card Visa Vanilla (with cash) and registered it online (during my visit in Starbucks using their WiFi) with my new ZIP code (you can provide any ZIP code while you register your gift card - its only for further verification) and sure it worked out like a charm! I figure I am not the only one that succeed with this. Then I read few months later at the same forum someone answer that USPS is blocking gift and prepaid cards at the moment. But for few months at least a hell broke out loose when you could load $20 gift card and pretty much forward mail of 20 strangers to your desired location, at $1 per pop.
beckler 8y ago
We had Informed Delivery at our old house, and now we have it at our new house... except we don't know how to stop receiving emails from the old house, so we know what the homeowner of our old house gets every day.
- bubblethink 8y ago
  Did you setup a different email account for your new house ? I think they have some very simple check (not that secure obviously) that a single email can only sign up for informed delivery for one address.
- conscion 8y ago
  There's a link at the bottom of every email to unsubscribe
privong 8y ago
> What the actual hell? You can sign up online to get mail scanned… without any physical verification you're at the address, with only a physical notification being sent after-the-fact? I signed up for Informed Delivery a couple weeks ago, and it did ask for additional verification information. It was similar to questions asked by financial institutions when opening accounts online: "which of these 4 addresses have you lived at in the past?", "What was the name of your first pet?", etc. All presumably information that has been collected by companies such as Experian.
SilasX 8y ago
I'm guessing they were going off the doctrine of "You have no expectation of privacy in the external packaging of your mail" <insert lawyeresque point about "lol tons of people handle and see it">. Thus, they didn't see a need for tight security regarding who can get access to such images.
deleted 8y ago
[deleted]
microcolonel 8y ago
> What the hell are USPS smoking? Well, at least a court could likely construe it as Theft or receipt of stolen mail matter generally, which is a felony and carries a fine and not more than five years imprisonment. Unlike the address change scams, which are kinda harder to classify, there are good legal reasons not to abuse this service.
wild_preference 8y ago
A scary reminder of how we're only at the very tip of the social engineering / identity faking problem. An incredible amount of our systems are just based on an honor system, yet targeted attacks are so, well, targeted that these systems are slow to change. Like how I reset my Bank of America 2FA three years ago with just my name and billing address of my card. It's kind of like internet abuse and DDoS in a way: I see HNers recommending something like CloudFront. Yet after being on the receiving end of a dedicated attacker that was able to bleed my financials, I would never use it again. And since it's not a widespread problem by nature of being a targeted attack, people continually have to learn the hard way on an individual basis, if they even get unlucky to begin with. So there's no real widespread need to change. Or, how many HNers unknowingly use a webhost that null routes them under attack yet never experienced that?
kenneth 8y ago
It only scans the outside of the letter, not the contents. I'm not sure I follow how that's enough to steal a credit card number or other sensitive information in the mail.
- moonka 8y ago
  It lets you know when something is coming that's worth stealing. Cuts down on your chances of being caught for a bunch of junk mail down quite a bit.
- Shivetya 8y ago
  Validation of the full name of the person living there? Regardless, it is a great service to sign up for. You do get it automatically if you have other accounts or used too. I had a few people sign up for it at work. the reason I started was we had a disappearing mail issue in my neighborhood that was eventually solved. plus its good to know when stuff you are expecting actually arrived. since I order a bit online having the packages listed is a great feature but they do not photo scan those. you can set delivery instructions for some its free, its useful, and while it does have a security issue along with nearly every service the post office offers it hurts you not for using it. in a day an age where we have privacy issues one of the biggest is proving who you are to agencies that have a real effect on your life and others. so we need to solve the ID issue as well.
sfont 8y ago
I signed up for it for my P.O. Box a few months ago. It had those credit history style questions such as have you owned property in such and such a county or what month did you make this purchase. But none were relevant to me or my business so I had to verify in person. The in person verification consisted of showing them my id.
TallGuyShort 8y ago
Others have referenced mail forwarding, which is obviously very bad, but mail holds work the same way. Most residential mailboxes at older homes face sidewalks and are trivial to steal from anyway. I thought my current setup in a new neighborhood would be ideal: individual locking boxes. And then one day mail got jammed in my side of the lock and I couldn't open it, so I waited for the mail carrier who promptly opened their side and handed me the contents with no verification at all. It's just a shitshow all-round. There's virtually no thought for security or intrgrity of the system at any level.
oh_sigh 8y ago
You still need to go to the actual mailbox to steal the credit cards, so you could presumably steal the verification as well. I don't actually see what this buys a person beyond I guess knowing when the credit card will show up so he can intercept it, but really you could just figure 3 days to receive a new card and be right most of the time.
deleted 8y ago
[deleted]
bubblethink 8y ago
I vaguely remember that at least some USPS service (could have been forwarding) asks for ID verification questions that would be in your credit profile or other databases. UPS also does something similar for their own equivalent, but UPS does send a physical letter if it cannot confirm that the address belongs to you.
dgzl 8y ago
I'll second this. Recently I moved back to my home state and decided to have my more serious mail sent to my grandparent's permanent home address instead of my temporary new address. I signed up for this Informed Delivery service, and now I get a scanned image of every piece of mail entering my grandparent's mailbox. It's a security nightmare.
what_ever 8y ago
You need to verify. Either with some questions related to your credit check (like previous addresses, employment history) or physically getting a mail to that address. A version of this was already possible to do using address forwarding which included same way of verification.

Spooky23 8y ago

That’s a real shame. I must have signed up after that letter was sent. It’s a great service otherwise.

mannykannot 8y ago

> What the hell are USPS smoking? Whatever it is, there is a lot of it about.

ams6110 8y ago

You can forward someone else's mail too. Just go to the post office, fill out the form, and drop it in the mailbox. There's no verification, though there is notification at both the old and the new address. Not to mention it's a crime to do that.

TazeTSchnitzel 8y ago
Here in Sweden, everyone's address has to be registered with the Tax Agency. In their (securely authenticated by digital ID which can only be obtained using photo ID) online services you can choose to disallow changes of your registered address which are not made digitally to prevent this kind of thing. Personally I have this turned on, because I'm conscious that every piece of information you'd need to send a fake address change notification for me is either public or easily obtainable with a call to the Tax Agency, which is far from reassuring.
- SamBam 8y ago
  That system would also allow us to completely get rid of our horrendous voter registration system, and make universal voting a reality.
  - TazeTSchnitzel 8y ago
    It would. In fact, Sweden has no “voter registration” per se, everyone who is registered as living here just gets a voting card in the mail before the election, I did earlier this year. (I only moved to Sweden this year and had no idea how to register to vote, turns out I don't need to!) It's not great for privacy though, so I understand the resistance of the US and the UK to it. Mind you, the US wouldn't have to make the whole thing public like Sweden does for… reasons.
    - dwighttk 8y ago
      What if you have like 10 addresses? Can you vote 10x?
      - TazeTSchnitzel 8y ago
        One registered main address per person, though you can register an additional “special post address” if you want to get your mail somewhere other than where you sleep for an extended period of time. You can't vote twice even if you did get two cards, you have to show ID (which I dislike, but it's at least relatively easy to obtain here) and your name is crossed out on the voter list once you've voted.

_JamesA_ 8y ago

I signed up earlier this year and the validation required answering several multiple choice questions with data from my credit report such as mortgage, car loan, etc. I also received a postcard confirming that Informed Delivery had been activated for my postal address.

TazeTSchnitzel 8y ago
I see, so they do some kind of verification. Thanks for your reply! I guess asking about credit report info is inadequate if people are managing to abuse this. One problem with that kind of thing is it's essentially security by obscurity, it's not deliberately created secret knowledge that can be trusted, it's stuff which happens to not be public and which only you should know, but there's no guarantee and you can't easily change it, right?
- _JamesA_ 8y ago
  The more I think about it I might be getting the validation mixed up with healthcare.gov. I definitely received the postcard though.
shimon 8y ago
I signed up a few months ago and had this type of validation as well. I didn't get a postcard, presumably they hadn't started that practice yet.
rootusrootus 8y ago
Same here. I signed up late last year and they used the same kind of credit bureau-based system that social security uses to verify your identity by asking questions about previous addresses, current mortgage or car loans, etc. Maybe it would be good to also add in a postcard check where they send you a code to verify you have access to mail for the address anyway. Sure, a thief could too, but in that case there isn't much of an extra risk to informed delivery since you'd be compromised already.
sesutton 8y ago
I just signed up and 2 out of the 4 questions could easily have been looked up on Zillow and they're all multiple choice with 4 options. The 2 questions were the year my house was built and the original sale price. So anyone would've had a 1/16 chance of just guessing it right.

3pt14159 8y ago

Yeah. It's essentially this bad almost everywhere. You think "surely X" but no. Almost never X. Almost always some lazy Y or nothing at all. After a couple consulting contracts / vuln disclosures I updated my priors of how competent the government was. I'm actually getting worried now that everything is going cyber-physical and corporations can pull the wool over their eyes. The government is great at offense, but defence is boring. Especially at non-fancy agencies / departments. And the salaries are low. But it doesn't even matter really. Basically so many things are broken and offense gets better over time while defence gets worse. I'm fighting for regulations, etc. But this stuff is so ill-defined that the government has trouble understanding it. I have come to blame the universities. The CompSci department should have gone to the Civil or Nuclear Engineering department and said "ok, how do we think about time frames over 100 years?" and built out courses out of that. But other than a handful of rare exceptions, right now most grads come out not understanding the true gravity of their decisions. The one nice thing is that offense is usually incompetent too. I've been on projects dealing with real crime[0]. The number of people nailed with just getting an IP is lolsy. Most criminals are stupid. I partly want to relay what the smartest 2%ile did just to show how low the bar is, but I fear educating the lower 98%. [0] Not stupid drug war stuff.

shimon 8y ago
This is a great perspective but it's important to remember your sample bias -- you're only making judgments about the offender you've identified. Or more snarkily, you've only caught the people dumber than you. When you're talking about basic attacks to steal some money, this is a substantial but not world-changing effect. On the other hand, a government or cartel willing to invest significant resources in cyber offense can really move the needle. What we've seen Russia, North Korea, Israel, and others achieve is probably only a fraction of what they've actually achieved.
- 3pt14159 8y ago
  Yes, but they don't put their crack team on most stuff. Have you read the Snowden leaks? The actual raw content? It's pretty tame shit. My main takeaway was ahh, yes the world is as insecure as I thought it was not oh, these guys are using space laser technology hacks. They've got crack teams to break into some harder gear, and they've got some crazy awesome cryptanalyses going on, but for most of it it's just what you were I would do if someone asked us to get into a bank or whatever. Most stuff is easy to hack anyway unless it's a fully patched iPhone or patched / stripped / locked down Windows server. Plus you can see the codebases these guys have put out anyway. There was that peodophile CIA coder that had some of his personal codebase match his internal work and there are a bunch of current and former NSA / CSE guys floating around conferences. I sat with a whole table of them and watched them fall for a simple social engineering attack one minute after being told they were going to fall for the attack. They're not gods shimon.

LeftTurnSignal 8y ago

I use this service, and when I signed up there was nothing to verify I was who I was. I just put in my address, created an account, and within a day or so could get scans of mail sent to my e-mail. This is pretty great too. I moved about two months ago, and switched addresses in Informed Delivery. I got a letter saying I switched, but I never put their code into Informed Delivery, and I still get scans of my mail at the new place. I got the scans before the validation letter, so I could easily have stolen that, and no one would know I'm seeing their mail.... *Edit to make things clearer. I have not validated anything. The letter says I won't get emails unless I put the code in the letter in Informed Delivery. I did not do that ever and I still get the emails.

tinus_hn 8y ago
Note that tampering with the mail, even if there are little technical limitations, is a federal crime that carries pretty severe penalties.
- obmelvin 8y ago
  I don't think GP is suggesting that anyone here tamper with mail. However, if you are someone who steals identities and money why would you care? This is pretty easy to verify properly and short of the time delay I can't think of any negative of doing so.
- Someone1234 8y ago
  People love repeating this for some reason, but mail crime is under-funded, rarely investigated, and even more rarely enforced. Realistically if you tamper with mail nothing at all will happen to you, until your fraud raises to a headline figure and could get someone a promotion.
  - jeffmould 8y ago
    Interesting you say this as I had heard similar stories of underfunded mail crime investigations in the past. However, where I live is a very seasonal location. Population goes from 10000+ over the summer to under 1000 during the winter months. Several years ago a couple people in the community noticed problems with their mail (mail seemingly missing, receiving wrongly addressed items, etc..). They called the postal service and an investigator was out in days. Within two weeks there were hidden cameras mounted in various locations around town pointed at mailboxes. A few more weeks and they apprehended an individual going through mailboxes based on the photos from those cameras. I don't know the final outcome, but the total turnaround from notification to arrest was less than 3 months.

eof 8y ago

I went on (am on) a long international trip, and had my mail forwarded to my father's. It prompted me to sign up for that, and without any verification I immeidately started getting scans of every package being sent to my father's house. He was never notified by them, nothing came in the mail. This was ~8 months ago.

davemp 8y ago

This seems like yet another instance showcasing the staggering lack of engineering ethics going on in critical information infrastructure designs. We have/used methods (PE licensure) to ensure that some sort of ethical engineering is occurring in critical designs. I hope we can find a way to bring these practices back and protect the people who cannot be reasonably expected (or asked) to understand these designs.

joering2 8y ago

> What the hell are USPS smoking? They always been smoking something. When they released their "forward your mail to your new home online" feature where they charge your credit card $1 to verify your new ZIP code, I read it somewhere on dark web that a gift card works as well. I was actually purchasing new house, so I figured I give it a try! I bought a $20 gift card Visa Vanilla (with cash) and registered it online (during my visit in Starbucks using their WiFi) with my new ZIP code (you can provide any ZIP code while you register your gift card - its only for further verification) and sure it worked out like a charm! I figure I am not the only one that succeed with this. Then I read few months later at the same forum someone answer that USPS is blocking gift and prepaid cards at the moment. But for few months at least a hell broke out loose when you could load $20 gift card and pretty much forward mail of 20 strangers to your desired location, at $1 per pop.

beckler 8y ago

We had Informed Delivery at our old house, and now we have it at our new house... except we don't know how to stop receiving emails from the old house, so we know what the homeowner of our old house gets every day.

bubblethink 8y ago
Did you setup a different email account for your new house ? I think they have some very simple check (not that secure obviously) that a single email can only sign up for informed delivery for one address.
conscion 8y ago
There's a link at the bottom of every email to unsubscribe

privong 8y ago

> What the actual hell? You can sign up online to get mail scanned… without any physical verification you're at the address, with only a physical notification being sent after-the-fact? I signed up for Informed Delivery a couple weeks ago, and it did ask for additional verification information. It was similar to questions asked by financial institutions when opening accounts online: "which of these 4 addresses have you lived at in the past?", "What was the name of your first pet?", etc. All presumably information that has been collected by companies such as Experian.

SilasX 8y ago

I'm guessing they were going off the doctrine of "You have no expectation of privacy in the external packaging of your mail" <insert lawyeresque point about "lol tons of people handle and see it">. Thus, they didn't see a need for tight security regarding who can get access to such images.

deleted 8y ago

[deleted]

microcolonel 8y ago

> What the hell are USPS smoking? Well, at least a court could likely construe it as Theft or receipt of stolen mail matter generally, which is a felony and carries a fine and not more than five years imprisonment. Unlike the address change scams, which are kinda harder to classify, there are good legal reasons not to abuse this service.

wild_preference 8y ago

A scary reminder of how we're only at the very tip of the social engineering / identity faking problem. An incredible amount of our systems are just based on an honor system, yet targeted attacks are so, well, targeted that these systems are slow to change. Like how I reset my Bank of America 2FA three years ago with just my name and billing address of my card. It's kind of like internet abuse and DDoS in a way: I see HNers recommending something like CloudFront. Yet after being on the receiving end of a dedicated attacker that was able to bleed my financials, I would never use it again. And since it's not a widespread problem by nature of being a targeted attack, people continually have to learn the hard way on an individual basis, if they even get unlucky to begin with. So there's no real widespread need to change. Or, how many HNers unknowingly use a webhost that null routes them under attack yet never experienced that?

kenneth 8y ago

It only scans the outside of the letter, not the contents. I'm not sure I follow how that's enough to steal a credit card number or other sensitive information in the mail.

moonka 8y ago
It lets you know when something is coming that's worth stealing. Cuts down on your chances of being caught for a bunch of junk mail down quite a bit.
Shivetya 8y ago
Validation of the full name of the person living there? Regardless, it is a great service to sign up for. You do get it automatically if you have other accounts or used too. I had a few people sign up for it at work. the reason I started was we had a disappearing mail issue in my neighborhood that was eventually solved. plus its good to know when stuff you are expecting actually arrived. since I order a bit online having the packages listed is a great feature but they do not photo scan those. you can set delivery instructions for some its free, its useful, and while it does have a security issue along with nearly every service the post office offers it hurts you not for using it. in a day an age where we have privacy issues one of the biggest is proving who you are to agencies that have a real effect on your life and others. so we need to solve the ID issue as well.

sfont 8y ago

I signed up for it for my P.O. Box a few months ago. It had those credit history style questions such as have you owned property in such and such a county or what month did you make this purchase. But none were relevant to me or my business so I had to verify in person. The in person verification consisted of showing them my id.

TallGuyShort 8y ago

Others have referenced mail forwarding, which is obviously very bad, but mail holds work the same way. Most residential mailboxes at older homes face sidewalks and are trivial to steal from anyway. I thought my current setup in a new neighborhood would be ideal: individual locking boxes. And then one day mail got jammed in my side of the lock and I couldn't open it, so I waited for the mail carrier who promptly opened their side and handed me the contents with no verification at all. It's just a shitshow all-round. There's virtually no thought for security or intrgrity of the system at any level.

oh_sigh 8y ago

You still need to go to the actual mailbox to steal the credit cards, so you could presumably steal the verification as well. I don't actually see what this buys a person beyond I guess knowing when the credit card will show up so he can intercept it, but really you could just figure 3 days to receive a new card and be right most of the time.

deleted 8y ago

[deleted]

bubblethink 8y ago

I vaguely remember that at least some USPS service (could have been forwarding) asks for ID verification questions that would be in your credit profile or other databases. UPS also does something similar for their own equivalent, but UPS does send a physical letter if it cannot confirm that the address belongs to you.

dgzl 8y ago

I'll second this. Recently I moved back to my home state and decided to have my more serious mail sent to my grandparent's permanent home address instead of my temporary new address. I signed up for this Informed Delivery service, and now I get a scanned image of every piece of mail entering my grandparent's mailbox. It's a security nightmare.

what_ever 8y ago

You need to verify. Either with some questions related to your credit check (like previous addresses, employment history) or physically getting a mail to that address. A version of this was already possible to do using address forwarding which included same way of verification.