4 ms·
I'm kinda concerned about the security angle on all of this. You have people phoning up UPS finding out the addresses of where packages are going, and potentia
by dotBen 16y ago
I'm kinda concerned about the security angle on all of this.
You have people phoning up UPS finding out the addresses of where packages are going, and potentially writing down the address if it turns out not to be theirs.
You can see from the tracking results on UPS that UPS are leaving a lot of these on the steps of residences and thus if you setup the correct monitoring you now have the possibility of people running around to the houses of freshly delivered laptops to take them from the door step.
Additionally, where people have signed for them, their last name is listed and with the addition of the zip code from the original source this creates further concern. I've already been able to find out the identity of someone who received one who lives in my zipcode because he has an unusual last name. I just searched for their last name + zipcode on Google and could confirm he is a developer at Engine Yard.
The weak points in the chain are that UPS assumes you must be one of the authorized parties if you have a valid tracking number in hand, and so when you call up to enquire they take that as validation.
What this really comes down to is how these tracking numbers + zipcodes became public in the first place (http://news.ycombinator.com/item?id=1996623 http://news.ycombinator.com/item?id=1996623)
- vikramhaer 16y agoI don't think they say the address right away when you ask for it. Fairly certain they ask you to confirm your name and the address that's meant to be on the package and mention if it is the same or not. Regardless, this certainly raises a concern.
- SystemOut 16y agoJust did it and the call went like this: Me: I'd like to confirm the address of a package being sent to me. Agent: Is it the package ending in the code XXXX? Me: Yes Agent: What is the address? Me: The address is XXX XXXXX. Agent: No, the address listed is YYY YYYYY. Me: Thanks. Beyond being disappointed it wasn't my address I have to say I was a bit surprised they let the address out that easily. She could have easily just said that was not the address it was shipped to.
- progtick 16y agosame here. Me: I want to verify the address. Agent: One moment... The address is xyz. Lol!
- vikramhaer 16y agoHmm, interesting. I called in and they asked me to confirm the address but never repeated the actual listed address. Guess it depends on who's on the other end.