Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

krebsonsecurity.com

Post reply on HN
Print view View original

71–80 of 135 posts

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#71

Post by sfont »

TazeTSchnitzel wrote: post #3

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify res…

I signed up for it for my P.O. Box a few months ago. It had those credit history style questions such as have you owned property in such and such a county or what month did you make this purchase. But none were relevant to me or my business so I had to verify in person.

The in person verification consisted of showing them my id.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#72

Post by moonka »

kenneth wrote: post #70
TazeTSchnitzel wrote: post #3

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify res…

It only scans the outside of the letter, not the contents. I'm not sure I follow how that's enough to steal a credit card number or other sensitive information in the mail.

It lets you know when something is coming that's worth stealing. Cuts down on your chances of being caught for a bunch of junk mail down quite a bit.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#73

Post by Shivetya »

kenneth wrote: post #70
TazeTSchnitzel wrote: post #3

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify res…

It only scans the outside of the letter, not the contents. I'm not sure I follow how that's enough to steal a credit card number or other sensitive information in the mail.

Validation of the full name of the person living there?

Regardless, it is a great service to sign up for. You do get it automatically if you have other accounts or used too. I had a few people sign up for it at work.

the reason I started was we had a disappearing mail issue in my neighborhood that was eventually solved. plus its good to know when stuff you are expecting actually arrived. since I order a bit online having the packages listed is a great feature but they do not photo scan those. you can set delivery instructions for some

its free, its useful, and while it does have a security issue along with nearly every service the post office offers it hurts you not for using it.

in a day an age where we have privacy issues one of the biggest is proving who you are to agencies that have a real effect on your life and others. so we need to solve the ID issue as well.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#74

Post by SilasX »

GavinMcG wrote: post #14
vxxzy wrote: post #10

Security Concerns aside. The informed delivery service is great. I've been using it for a little over a year now. They began inserting ads into the Informed Delivery Email. Senders must place some sort of barcode that is then read by the USPS scanner. It's nice to see our postal service trying to close the gap on their (net) loss.

It would be nicer for Congress to not impose capricious retirement funding requirements, artificially making them look unprofitable.

Requiring that pensions and other future benefits be funded at their present discounted value is majestically reasonable. The opposite is how you get pension crises.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#75

Post by nonce725 »

SilasX wrote: post #62
tinus_hn wrote: post #27

Earlier quoted context omitted.

Note that tampering with the mail, even if there are little technical limitations, is a federal crime that carries pretty severe penalties.

Observing someone else's mail wouldn't count as tampering with it. Some other category might apply though.

IANAL but the impression I get is that loosely defined terms like "tamper" can be interpreted in many different contexts depending on how eager the prosecutor is.

Falsifying your identity to a federal postal service to gain access to someone else's mail? That breaks a wide range of laws

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#76

Post by SilasX »

nonce725 wrote: post #75
SilasX wrote: post #62

Earlier quoted context omitted.

Observing someone else's mail wouldn't count as tampering with it. Some other category might apply though.

IANAL but the impression I get is that loosely defined terms like "tamper" can be interpreted in many different contexts depending on how eager the prosecutor is. Falsifying your identity to a federal postal service to gain access to someone else's mail? That breaks a wide range of laws

Right -- falsifying identity to get postal resources would be a relevant category of crime. I don't see how mere non-destructive observation of the external packaging would count as tampering though.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#77

Post by ukyrgf »

LeftTurnSignal wrote: post #20
TazeTSchnitzel wrote: post #3

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify res…

I use this service, and when I signed up there was nothing to verify I was who I was. I just put in my address, created an account, and within a day or so could get scans of mail sent to my e-mail. This is pretty great too. I moved about two months ago, and switched addresses in Informed Delivery. I got a letter saying I switched, but I never put their code into Informed Delivery, and I still get scans of my mail at…

I just signed up, and this is what you see after you create an account: https://i.imgur.com/uHponvi.png

Verify online, verify by mail, or... skip. When I hit skip it just sent me to a dashboard that says I'm not enrolled because I'm not verified. I'm gonna let this sit for a few days and see if I start getting the emails.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#78

Post by twothamendment »

LeftTurnSignal wrote: post #20
TazeTSchnitzel wrote: post #3

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify res…

I use this service, and when I signed up there was nothing to verify I was who I was. I just put in my address, created an account, and within a day or so could get scans of mail sent to my e-mail. This is pretty great too. I moved about two months ago, and switched addresses in Informed Delivery. I got a letter saying I switched, but I never put their code into Informed Delivery, and I still get scans of my mail at…

Yes, it is that easy. I did it and told my parents about it. They signed up to be notified when my grandparents received mail so they could make sure bills were taken care of. Not a case of abuse, but they didn't have to validate anything to start receiving notifications of other people's mail.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#80

Post by bargl »

I didn't see it in the article, but these scans also show the first page of the letter on top. I thought I was crazy when I first saw it, but I can actually read account info etc from inside the letter!!!! If someone got my account they'd actually be able to tell part of what I'm getting not just from who.
Post reply on HN