Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 135 posts

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#61

Post by LeftTurnSignal »

tinus_hn wrote: post #27
LeftTurnSignal wrote: post #20

Earlier quoted context omitted.

I use this service, and when I signed up there was nothing to verify I was who I was. I just put in my address, created an account, and within a day or so could get scans of mail sent to my e-mail. This is pretty great too. I moved about two months ago, and switched addresses in Informed Delivery. I got a letter saying I switched, but I never put their code into Informed Delivery, and I still get scans of my mail at…

Note that tampering with the mail, even if there are little technical limitations, is a federal crime that carries pretty severe penalties.

Yup.

This is all my own mail. When I switched ID to the new address, I no longer received emails of mail going to my old address automatically. So there's that.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#62

Post by SilasX »

tinus_hn wrote: post #27
LeftTurnSignal wrote: post #20

Earlier quoted context omitted.

I use this service, and when I signed up there was nothing to verify I was who I was. I just put in my address, created an account, and within a day or so could get scans of mail sent to my e-mail. This is pretty great too. I moved about two months ago, and switched addresses in Informed Delivery. I got a letter saying I switched, but I never put their code into Informed Delivery, and I still get scans of my mail at…

Note that tampering with the mail, even if there are little technical limitations, is a federal crime that carries pretty severe penalties.

Observing someone else's mail wouldn't count as tampering with it. Some other category might apply though.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#63

Post by [deleted] »

TazeTSchnitzel wrote: post #3

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify res…

[deleted]

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#64

Post by microcolonel »

TazeTSchnitzel wrote: post #3

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify res…

> What the hell are USPS smoking?

Well, at least a court could likely construe it as Theft or receipt of stolen mail matter generally, which is a felony and carries a fine and not more than five years imprisonment. Unlike the address change scams, which are kinda harder to classify, there are good legal reasons not to abuse this service.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#65

Post by latchkey »

I'm sitting here in Vietnam. For two years now, I get pictures every day of my friends mail emailed to me because I switched my address to her house when I left the US. I was not asked a single question about it, they just started appearing after I filed a change of address notice, which cost me like $1 or something. Something seems so wrong with that.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#66

Post by specialist »

ams6110 wrote: post #51
SamBam wrote: post #21

Earlier quoted context omitted.

That system would also allow us to completely get rid of our horrendous voter registration system, and make universal voting a reality.

Except in the USA, voting is constitutionally a state thing, not federal.

Federal laws, oversight. Local administration.

https://www.eac.gov

Cue the fever dreams whenever anyone merely suggests we harmonize, normalize the details. As if predictable standards for signature verification will inevitably lead to a military coup.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#67

Post by driverdan »

I've been using mailbox services (UPS Store) for almost 15 years. It costs extra money but pays for itself many times over.

I never have packages stolen, never have to wait around to sign for things, my mail is locked up, I don't have to put a mail hold or have a friend get my mail when I travel, and never have to deal with changing addresses. It also improves my privacy since fewer people have my street address. I don't worry about someone doxing me.

It's not foolproof. Someone could social engineer access to my box or packages. Doing so requires significantly more effort and risk than grabbing something off a porch so it's much less likely. It would have to be highly targeted too.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#68

Post by sp00ls »

mfielder wrote: post #38

I've noticed after first signing up around April that whatever scanner they're using can see through the envelope and you can pretty clearly read at least part of the contents for a standard folded letter, but at some point later in the year the contrast of the images was changed and it wasn't as common to see it anymore. Most of my mail is junk, but I can only imagine the kinds of opportunity that capability at scal…

I noticed the same thing with the see through envelope part. I live in an apartment and get mail in my informed delivery dashboard addressed to past tenants at this address all the time. The system seems to only care about address, not name. The mail never arrives (possibly due to forwarding?) but I can read the first page of about half of it. It does seem to have gotten slightly better but I just checked my last few emails from USPS and I can still make out words through the envelope. I'm sure with a small bit of image manipulation I would be able to read them clear as day.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#69

Post by wild_preference »

TazeTSchnitzel wrote: post #3

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify res…

A scary reminder of how we're only at the very tip of the social engineering / identity faking problem. An incredible amount of our systems are just based on an honor system, yet targeted attacks are so, well, targeted that these systems are slow to change.

Like how I reset my Bank of America 2FA three years ago with just my name and billing address of my card.

It's kind of like internet abuse and DDoS in a way: I see HNers recommending something like CloudFront. Yet after being on the receiving end of a dedicated attacker that was able to bleed my financials, I would never use it again. And since it's not a widespread problem by nature of being a targeted attack, people continually have to learn the hard way on an individual basis, if they even get unlucky to begin with. So there's no real widespread need to change.

Or, how many HNers unknowingly use a webhost that null routes them under attack yet never experienced that?

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#70

Post by kenneth »

TazeTSchnitzel wrote: post #3

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify res…

It only scans the outside of the letter, not the contents. I'm not sure I follow how that's enough to steal a credit card number or other sensitive information in the mail.
Post reply on HN