3 ms·
Ran an LE request desk for a while and the whole thing was PDFs from .gov-ish email addresses. Only real control we had was calling the agency back on a number
by hndhyc0bdt 21d ago
Ran an LE request desk for a while and the whole thing was PDFs from .gov-ish email addresses. Only real control we had was calling the agency back on a number we looked up ourselves, not the one on the letterhead.
- Maxion 20d agoI've done that as well and this is what most of those do look like.
- znnajdla 21d agoWhat is LE? Let’s Encrypt?
- ericpauley 21d agoGuessing Law Enforcement
- nkrisc 20d agoLaw enforcement.
- guillybarres 20d agoSwing and a miss.
- r_lee 20d agohow would you come to that conclusion based on the context here?
- LoganDark 20d agoUh, not knowing otherwise? Which is why they were asking?
- sikozu 20d agoYou say .gov-ish, does this mean compromised gov email accounts, spoofed email addresses or domains that look like government domains?
- Maxion 20d ago.gov is a US thing, and not even all US agencies use .gov ending emails.
- deleted 20d ago[deleted]
- codedokode 20d agoYou do not need to compromise anything, you can put any address in the "from" field. Email has no universal verification for sender address.
- haakon 20d agoI would sincerely hope .gov addresses use SPF/DKIM/DMARC. That makes spoofing impossible. In Revolut's case, the sender's email system had been compromised.
- wodenokoto 20d agoAnd what about the rest of the world?
- edelbitter 20d agoIs it uncommon/impossible to ask for the federally-brokered in-person procedure in the US? (The way I know it: Local court or police officer shows up at our office later that day and hands over a printout matching the request that we had been unable to confirm, on request of federal authority, in turn on request of the authority demanding we hand over some customers data. Those two requests utilizing government agency-internal auth mechanisms we do not need to know or care about.)
- formerly_proven 20d ago> Those two requests utilizing government agency-internal auth mechanisms we do not need to know or care about. Most likely: > and the whole thing was PDFs from .gov-ish email addresses But I guess this moves the liability for answering fake requests to the local branch.
- SoftTalker 20d agoYou'd still want to verify that with the court or authority? I've been served before and sometimes it's just a person in street clothes who hands you an envelope. And even if it's a court bailiff or officer or something like that, would you be able to distinguish a real uniform, ID and badge from a fake one?
- edelbitter 20d agoThe uniformed woman with the pistol is whatever the stitching on the chest pocket say she is. Is that not true just the same even in places where other people may routinely open-carry?
- chrisjj 20d ago> Only real control we had was calling the agency back on a number we looked up ourselves Way to difficult for Revolut, evidently.