Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

krebsonsecurity.com

Post reply on HN
Print view View original

21–30 of 135 posts

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#21

Post by SamBam »

TazeTSchnitzel wrote: post #17
ams6110 wrote: post #11

Earlier quoted context omitted.

You can forward someone else's mail too. Just go to the post office, fill out the form, and drop it in the mailbox. There's no verification, though there is notification at both the old and the new address. Not to mention it's a crime to do that.

Here in Sweden, everyone's address has to be registered with the Tax Agency. In their (securely authenticated by digital ID which can only be obtained using photo ID) online services you can choose to disallow changes of your registered address which are not made digitally to prevent this kind of thing. Personally I have this turned on, because I'm conscious that every piece of information you'd need to send a fake a…

That system would also allow us to completely get rid of our horrendous voter registration system, and make universal voting a reality.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#22

Post by TazeTSchnitzel »

esotericn wrote: post #15
TazeTSchnitzel wrote: post #12

Earlier quoted context omitted.

So, they shouldn't try to use identifying information to track down people committing crimes?

I'm not really sure how to answer this. Sure. That's not actually how "identity theft" affects people for the most part. The case of the police turning up at your door or some sort of court summons because a fake "TazeTSchnitzel" performed fraud is pretty rare. What actually happens is some opaque credit score thing whereby you just find interacting with the system harder because someone else fucked up. For example,…

Ah, yes, I see the argument about credit reports. Putting aside the question of whether they can exist at all, the security checks are laughable and therefore someone can make a black mark on yours by impersonating you with much greater ease than should be the case.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#23

Post by TazeTSchnitzel »

SamBam wrote: post #21
TazeTSchnitzel wrote: post #17

Earlier quoted context omitted.

Here in Sweden, everyone's address has to be registered with the Tax Agency. In their (securely authenticated by digital ID which can only be obtained using photo ID) online services you can choose to disallow changes of your registered address which are not made digitally to prevent this kind of thing. Personally I have this turned on, because I'm conscious that every piece of information you'd need to send a fake a…

That system would also allow us to completely get rid of our horrendous voter registration system, and make universal voting a reality.

It would. In fact, Sweden has no “voter registration” per se, everyone who is registered as living here just gets a voting card in the mail before the election, I did earlier this year. (I only moved to Sweden this year and had no idea how to register to vote, turns out I don't need to!)

It's not great for privacy though, so I understand the resistance of the US and the UK to it. Mind you, the US wouldn't have to make the whole thing public like Sweden does for… reasons.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#24

Post by listenallyall »

esotericn wrote: post #2

The fact that "identity theft" is still a thing in 2018 is an indictment on the legacy financial industry. If not for the web of opaque "agencies" that collect and sell data about individuals without affirmative action on behalf of the individual (frankly still surprised this is legal) it would be a complete non-issue. It's irrelevant to me whether someone else opens an account with my name - just as it's irrelevant…

> web of opaque "agencies"

While I've got no love for credit-reporting agencies, and they have managed to mangle my file, they do act as a non-partisan 3rd party that can (when their records are accurate) verify that a person is credit-worthy -- Which is a highly valuable service. Banks can offer low rates and other economic incentives to credit-worthy people, and make decisions for hundreds of thousands of dollars (i.e. a mortgage) in minutes, due to the existence of TransUnion, etc.

If it was possible for you to opt-out (or refuse to opt-in), you'd pay much more for a mortgage or any loan, decisions would take weeks, you'd be burdened with having to self-report your credit history (i.e. collect every statement on every account for the past 5-10 years) and since you are self-reporting, banks would still add a premium on because they would assume you've "forgotten" to include the credit card which you skipped payments on for 3 months back a few years ago.

As an analogy, auto insurers can easily check your accident and claims history -- imagine what your premiums would be if insurers had no way to check. They would have to assume the worst about almost everyone, and charge accordingly.

Do credit agencies need to be more accurate, and more secure? Absolutely. But wishing to opt-out entirely would likely be detrimental to you personally.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#25

Post by esotericn »

listenallyall wrote: post #24
esotericn wrote: post #2

The fact that "identity theft" is still a thing in 2018 is an indictment on the legacy financial industry. If not for the web of opaque "agencies" that collect and sell data about individuals without affirmative action on behalf of the individual (frankly still surprised this is legal) it would be a complete non-issue. It's irrelevant to me whether someone else opens an account with my name - just as it's irrelevant…

> web of opaque "agencies" While I've got no love for credit-reporting agencies, and they have managed to mangle my file, they do act as a non-partisan 3rd party that can (when their records are accurate) verify that a person is credit-worthy -- Which is a highly valuable service. Banks can offer low rates and other economic incentives to credit-worthy people, and make decisions for hundreds of thousands of dollars (…

I pretty much have opted out entirely. I'm sure these agencies collect information on me regardless, there's not much I can do about that.

I have no need for loans other than possibly a mortgage - I find it difficult to conceive of why one would even want a loan, outside of the first few years of adulthood.

The mortgage is a stickler, but given that I have no desire to lock myself in to the traditional 25 years of working to buy a house in a high CoL area, it really just means saving before buying.

It would be nice to have those things, but not with the additional stress involved of satisfying arbitrary requirements all the time.

I prefer to live life without thinking about how other entities wish to 'rank' me all the time. I'd find it stifling to do otherwise.

> As an analogy, auto insurers can easily check your accident and claims history -- imagine what your premiums would be if insurers had no way to check. They would have to assume the worst about almost everyone, and charge accordingly.

More realistically, you'd be asked to provide your claim history, and if you fraudulently provided a fake history, you'd be hit with severe penalties.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#27

Post by tinus_hn »

LeftTurnSignal wrote: post #20
TazeTSchnitzel wrote: post #3

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify res…

I use this service, and when I signed up there was nothing to verify I was who I was. I just put in my address, created an account, and within a day or so could get scans of mail sent to my e-mail. This is pretty great too. I moved about two months ago, and switched addresses in Informed Delivery. I got a letter saying I switched, but I never put their code into Informed Delivery, and I still get scans of my mail at…

Note that tampering with the mail, even if there are little technical limitations, is a federal crime that carries pretty severe penalties.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#28

Post by esotericn »

TazeTSchnitzel wrote: post #22
esotericn wrote: post #15

Earlier quoted context omitted.

I'm not really sure how to answer this. Sure. That's not actually how "identity theft" affects people for the most part. The case of the police turning up at your door or some sort of court summons because a fake "TazeTSchnitzel" performed fraud is pretty rare. What actually happens is some opaque credit score thing whereby you just find interacting with the system harder because someone else fucked up. For example,…

Ah, yes, I see the argument about credit reports. Putting aside the question of whether they can exist at all, the security checks are laughable and therefore someone can make a black mark on yours by impersonating you with much greater ease than should be the case.

Right.

The other main category of problem that comes with identity theft is my own resources being used (e.g. an account, bank or otherwise) by a non-me.

Again, this goes away if you use real authentication rather than "oh, he has a photo of a pink bit of plastic with an address on it?, gosh must be him, here you go!".

It would be more expensive to do so, though, so we don't. The burden is pushed on to the end user.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#29

Post by eof »

TazeTSchnitzel wrote: post #3

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify res…

I went on (am on) a long international trip, and had my mail forwarded to my father's. It prompted me to sign up for that, and without any verification I immeidately started getting scans of every package being sent to my father's house. He was never notified by them, nothing came in the mail. This was ~8 months ago.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#30

Post by davemp »

TazeTSchnitzel wrote: post #3

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify res…

This seems like yet another instance showcasing the staggering lack of engineering ethics going on in critical information infrastructure designs. We have/used methods (PE licensure) to ensure that some sort of ethical engineering is occurring in critical designs. I hope we can find a way to bring these practices back and protect the people who cannot be reasonably expected (or asked) to understand these designs.
Post reply on HN