3 ms·

The barcode in the article decodes to "JGB S11221017031011395940006622112101 BC046285E760466C01" if anyone fancies having a crack at making a stamp keygen.

Leynos 3y ago
I didn't actually realize one could fit so much into such a small barcode. I do wonder if this now means it is in theory possible to track items sent by letter post.
- kuschku 3y ago
  It is. Other european mail services, e.g. DHL, have been offering tracking for every new stamp for a while now.
- Ekaros 3y ago
  We forget just how automated sorting of mail now is. Only probable manual part is by the person doing delivery, and that is just for their own convenience. Everything else is automated, with few hard to read addresses going through manual sorting. Where they are tracked too.
1letterunixname 3y ago
Likely, they use some authenticated hash like HMAC SHA-256 with a schedule of randomly chosen keys added periodically. (Can't really rotate out keys once generated.) GFL reversing the algorithm AND any working key. Also, an "is it used" database has to be kept to prevent an analog replay attack by reusing the same barcode. The most efficient way to keep track of used stamps would be a bloom filter. A poor implementation would lead to false positives, and mailers being accused of fraud. It also has should be highly reliable, highly available, and geographically disperse.
- Wingy 3y ago
  Would pure random + a central database not be more practical? Assuming the barcode is a 10-by-50 grid, that's 500 bits of entropy. With 100 bits of entropy, you need over 100 trillion codes to have a 0.4% chance of a collision. Every added bit makes it twice as unlikely. There's no need to have crypto if you're the authority on both assigning and verifying the barcodes. That way, no attacker will be able to create a barcode and have any hope of it working.
  - andrewaylett 3y ago
    They're not the only ones creating barcodes -- stamps come with non-specific data, but bulk mailers are allowed to create their own, with embedded routing and billing codes. The spec is here: https://www.royalmail.com/sites/default/files/Royal-Mail-Mailmark-barcode-definition-document-September-2015.pdf https://www.royalmail.com/sites/default/files/Royal-Mail-Mai...
- cyanydeez 3y ago
  More likely people (criminals) realized consumers can't protect themselves from near complete fakes and someone's out there making bank.
cyanydeez 3y ago
What's important is it doesn't prevent counterfeit to consumers, which is failed planning.

Leynos 3y ago

I didn't actually realize one could fit so much into such a small barcode. I do wonder if this now means it is in theory possible to track items sent by letter post.

kuschku 3y ago
It is. Other european mail services, e.g. DHL, have been offering tracking for every new stamp for a while now.
Ekaros 3y ago
We forget just how automated sorting of mail now is. Only probable manual part is by the person doing delivery, and that is just for their own convenience. Everything else is automated, with few hard to read addresses going through manual sorting. Where they are tracked too.

1letterunixname 3y ago

Likely, they use some authenticated hash like HMAC SHA-256 with a schedule of randomly chosen keys added periodically. (Can't really rotate out keys once generated.) GFL reversing the algorithm AND any working key. Also, an "is it used" database has to be kept to prevent an analog replay attack by reusing the same barcode. The most efficient way to keep track of used stamps would be a bloom filter. A poor implementation would lead to false positives, and mailers being accused of fraud. It also has should be highly reliable, highly available, and geographically disperse.

Wingy 3y ago
Would pure random + a central database not be more practical? Assuming the barcode is a 10-by-50 grid, that's 500 bits of entropy. With 100 bits of entropy, you need over 100 trillion codes to have a 0.4% chance of a collision. Every added bit makes it twice as unlikely. There's no need to have crypto if you're the authority on both assigning and verifying the barcodes. That way, no attacker will be able to create a barcode and have any hope of it working.
- andrewaylett 3y ago
  They're not the only ones creating barcodes -- stamps come with non-specific data, but bulk mailers are allowed to create their own, with embedded routing and billing codes. The spec is here: https://www.royalmail.com/sites/default/files/Royal-Mail-Mailmark-barcode-definition-document-September-2015.pdf https://www.royalmail.com/sites/default/files/Royal-Mail-Mai...
cyanydeez 3y ago
More likely people (criminals) realized consumers can't protect themselves from near complete fakes and someone's out there making bank.

cyanydeez 3y ago

What's important is it doesn't prevent counterfeit to consumers, which is failed planning.