3 ms·

So it turns out the US Postal Service is very easy to trick. You merely fill out a simple form with no real verification and get them to forward somebody else

So it turns out the US Postal Service is very easy to trick. You merely fill out a simple form with no real verification and get them to forward somebody else's mail to your address, which enables all manner of profitable fraud. HOWEVER doing that is a hardcore crime. You can be sent to federal prison for years for doing that. So the USPS is not secure in any sort of mathematical sense, but in practice most people trust it most of the time, because security isn't just about technical implementation details like encryption. Similarly wiretapping telephone lines may be straight forward, but you'd have to be exceptionally daring or stupid to actually do it.

dragonwriter 8y ago
> HOWEVER doing that is a hardcore crime. You can be sent to federal prison for years for doing that. So the USPS is not secure in any sort of mathematical sense, but in practice most people trust it most of the time, because security isn't just about technical implementation details like encryption. But if your data is such that it would be a “hardcore crime” to seek access to it fraudulently, or the main reason people would do so is to commit a “hardcore crime”, using an information channel that is only considered secure because of the social safeguard that breaching it's trivial protection is itself a “hardcore crime” is probably foolhardy, since engaging in such a crime is cost already accepted by the attackers you are concerned about.
- darkpuma 8y ago
  That's true. However most of what people would prefer be confidential isn't data that would be sufficiently profitable to make risking federal prison rational. e.g. medical records. I don't want my medical records made public, but nobody is going to make themselves rich by violating my privacy. So, for example, doctors using faxes makes a lot of sense. Maybe not for doctors with high profile celebrity or politician clients who value their privacy, but for the most part.
  - dragonwriter 8y ago
    > However most of what people would prefer be confidential isn't data that would be sufficiently profitable to make risking federal prison rational. (1) Don't assume you know all potential criminals’ utility functions (especially, don't assume all of their utility is financial), and, more important (2) Don't presume crime is usually rational, in the first place.
    - darkpuma 8y ago
      It's not so much a presumption as an observation that the system works most of the time for most people. Yes there are edge cases, nobody would deny that.
pintxo 8y ago
I am quite certain the reason this works is analog vs digital. You can only pull off something like this in the analog world a couple of times max, before you are caught and sentenced. And the average expected outcome (expressed in some financial unit) is probably quite small. Alternatively, the (financial) costs in the analog world are higher than the expected gains, so no sane persons would bother trying. It is probably equally small for doing similar things digital (like over the internet) BUT you can expect to be able to perform it multi times over AND if you choose your country of residence sensibly, you will not go to jail - ever. We can probably model this something like this: Expected Outcome: (1 - propabilityOfGettingCaught)^timesExecuted * timesExecuted * money The more often executed, the more likely to be caught Analog: (1 - .1)^10 + 10 * 10,000 ~= 35k Digital: (1 - .00001)^100,000 + 100,000 * 10 ~= 370k Digital, save location: (1-0)^100,000 + 100,00 * 10 ~= 1m

dragonwriter 8y ago

> HOWEVER doing that is a hardcore crime. You can be sent to federal prison for years for doing that. So the USPS is not secure in any sort of mathematical sense, but in practice most people trust it most of the time, because security isn't just about technical implementation details like encryption. But if your data is such that it would be a “hardcore crime” to seek access to it fraudulently, or the main reason people would do so is to commit a “hardcore crime”, using an information channel that is only considered secure because of the social safeguard that breaching it's trivial protection is itself a “hardcore crime” is probably foolhardy, since engaging in such a crime is cost already accepted by the attackers you are concerned about.

darkpuma 8y ago
That's true. However most of what people would prefer be confidential isn't data that would be sufficiently profitable to make risking federal prison rational. e.g. medical records. I don't want my medical records made public, but nobody is going to make themselves rich by violating my privacy. So, for example, doctors using faxes makes a lot of sense. Maybe not for doctors with high profile celebrity or politician clients who value their privacy, but for the most part.
- dragonwriter 8y ago
  > However most of what people would prefer be confidential isn't data that would be sufficiently profitable to make risking federal prison rational. (1) Don't assume you know all potential criminals’ utility functions (especially, don't assume all of their utility is financial), and, more important (2) Don't presume crime is usually rational, in the first place.
  - darkpuma 8y ago
    It's not so much a presumption as an observation that the system works most of the time for most people. Yes there are edge cases, nobody would deny that.

pintxo 8y ago

I am quite certain the reason this works is analog vs digital. You can only pull off something like this in the analog world a couple of times max, before you are caught and sentenced. And the average expected outcome (expressed in some financial unit) is probably quite small. Alternatively, the (financial) costs in the analog world are higher than the expected gains, so no sane persons would bother trying. It is probably equally small for doing similar things digital (like over the internet) BUT you can expect to be able to perform it multi times over AND if you choose your country of residence sensibly, you will not go to jail - ever. We can probably model this something like this: Expected Outcome: (1 - propabilityOfGettingCaught)^timesExecuted * timesExecuted * money The more often executed, the more likely to be caught Analog: (1 - .1)^10 + 10 * 10,000 ~= 35k Digital: (1 - .00001)^100,000 + 100,000 * 10 ~= 370k Digital, save location: (1-0)^100,000 + 100,00 * 10 ~= 1m