FWIW, the Informed Delivery isn't available everywhere. I tried to sign up and was denied.
Yes, not available at P.O. Boxes afaict too. I wish it were, until I read Krebs' article!
U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service
41–50 of 135 posts
Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service
#42Earlier quoted context omitted.
I use this service, and when I signed up there was nothing to verify I was who I was. I just put in my address, created an account, and within a day or so could get scans of mail sent to my e-mail. This is pretty great too. I moved about two months ago, and switched addresses in Informed Delivery. I got a letter saying I switched, but I never put their code into Informed Delivery, and I still get scans of my mail at…
Note that tampering with the mail, even if there are little technical limitations, is a federal crime that carries pretty severe penalties.
I don't think GP is suggesting that anyone here tamper with mail. However, if you are someone who steals identities and money why would you care? This is pretty easy to verify properly and short of the time delay I can't think of any negative of doing so.
Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service
#43When my wife signed up for this a few months ago I was astonished to see that the envelope scans are sent in the clear in an email. I didn't realize at the time that there is in addition no authentication of the sign up process!
Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service
#44FWIW, the Informed Delivery isn't available everywhere. I tried to sign up and was denied.
Yes, not available at P.O. Boxes afaict too. I wish it were, until I read Krebs' article!
This is incorrect; you can indeed get Informed Delivery for [at least some] P O Boxes, postal employees don't know how to do it, but if you change the address on your Credit Card to be the P O Box, and then try authenticating using that card, it passes fine. That's what I did for my own P O Box, for example (it failed the first time when my card was using my street address).
Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service
#45Earlier quoted context omitted.
That system would also allow us to completely get rid of our horrendous voter registration system, and make universal voting a reality.
It would. In fact, Sweden has no “voter registration” per se, everyone who is registered as living here just gets a voting card in the mail before the election, I did earlier this year. (I only moved to Sweden this year and had no idea how to register to vote, turns out I don't need to!) It's not great for privacy though, so I understand the resistance of the US and the UK to it. Mind you, the US wouldn't have to mak…
What if you have like 10 addresses? Can you vote 10x?
Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service
#46Despite the security issues, this is a pretty cool service - I wonder if the UK Royal Mail is doing it ... oh of course not
Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service
#47Earlier quoted context omitted.
I pretty much have opted out entirely. I'm sure these agencies collect information on me regardless, there's not much I can do about that. I have no need for loans other than possibly a mortgage - I find it difficult to conceive of why one would even want a loan, outside of the first few years of adulthood. The mortgage is a stickler, but given that I have no desire to lock myself in to the traditional 25 years of wo…
In many cities, you can't even rent an apartment without a credit history.
Can't say I've experienced that. I hear that credit agencies in the US are pretty entrenched though so it doesn't surprise me!
The main difficulty I have here in the UK is with agencies that are extremely bureaucratic and can't deal with minor deviations from protocol.
I tend to rent directly from individuals for that reason. I prefer speaking to actual humans rather than drones in layers of a bureaucracy.
Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service
#48Earlier quoted context omitted.
It would. In fact, Sweden has no “voter registration” per se, everyone who is registered as living here just gets a voting card in the mail before the election, I did earlier this year. (I only moved to Sweden this year and had no idea how to register to vote, turns out I don't need to!) It's not great for privacy though, so I understand the resistance of the US and the UK to it. Mind you, the US wouldn't have to mak…
What if you have like 10 addresses? Can you vote 10x?
One registered main address per person, though you can register an additional “special post address” if you want to get your mail somewhere other than where you sleep for an extended period of time. You can't vote twice even if you did get two cards, you have to show ID (which I dislike, but it's at least relatively easy to obtain here) and your name is crossed out on the voter list once you've voted.
Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service
#49Earlier quoted context omitted.
Yeah. It's essentially this bad almost everywhere. You think "surely X" but no. Almost never X. Almost always some lazy Y or nothing at all. After a couple consulting contracts / vuln disclosures I updated my priors of how competent the government was. I'm actually getting worried now that everything is going cyber-physical and corporations can pull the wool over their eyes. The government is great at offense, but de…
This is a great perspective but it's important to remember your sample bias -- you're only making judgments about the offender you've identified. Or more snarkily, you've only caught the people dumber than you. When you're talking about basic attacks to steal some money, this is a substantial but not world-changing effect. On the other hand, a government or cartel willing to invest significant resources in cyber offe…
Yes, but they don't put their crack team on most stuff.
Have you read the Snowden leaks? The actual raw content?
It's pretty tame shit. My main takeaway was ahh, yes the world is as insecure as I thought it was not oh, these guys are using space laser technology hacks.
They've got crack teams to break into some harder gear, and they've got some crazy awesome cryptanalyses going on, but for most of it it's just what you were I would do if someone asked us to get into a bank or whatever. Most stuff is easy to hack anyway unless it's a fully patched iPhone or patched / stripped / locked down Windows server.
Plus you can see the codebases these guys have put out anyway. There was that peodophile CIA coder that had some of his personal codebase match his internal work and there are a bunch of current and former NSA / CSE guys floating around conferences.
I sat with a whole table of them and watched them fall for a simple social engineering attack one minute after being told they were going to fall for the attack.
They're not gods shimon.
Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service
#50I use Informed Delivery (pretty handy), so when I started reading the article, I thought -- I should be safe, because I already signed up for the account at my address.
Not so! FTA: "Normally in these cases I’d urge readers to simply plant their flag by registering an account to claim their address. However, the USPS allows new account creations for anyone currently able to receive mail at your address, which means that claiming your address may involve registering an account with every adult present at your address."