Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

krebsonsecurity.com

Post reply on HN
Print view View original

121–130 of 135 posts

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#121

Post by bubblethink »

TazeTSchnitzel wrote: post #3

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify res…

I vaguely remember that at least some USPS service (could have been forwarding) asks for ID verification questions that would be in your credit profile or other databases. UPS also does something similar for their own equivalent, but UPS does send a physical letter if it cannot confirm that the address belongs to you.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#122

Post by bubblethink »

beckler wrote: post #56
TazeTSchnitzel wrote: post #3

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify res…

We had Informed Delivery at our old house, and now we have it at our new house... except we don't know how to stop receiving emails from the old house, so we know what the homeowner of our old house gets every day.

Did you setup a different email account for your new house ? I think they have some very simple check (not that secure obviously) that a single email can only sign up for informed delivery for one address.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#123

Post by dgzl »

TazeTSchnitzel wrote: post #3

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify res…

I'll second this. Recently I moved back to my home state and decided to have my more serious mail sent to my grandparent's permanent home address instead of my temporary new address. I signed up for this Informed Delivery service, and now I get a scanned image of every piece of mail entering my grandparent's mailbox. It's a security nightmare.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#124

Post by Wistar »

LeftTurnSignal wrote: post #20
TazeTSchnitzel wrote: post #3

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify res…

I use this service, and when I signed up there was nothing to verify I was who I was. I just put in my address, created an account, and within a day or so could get scans of mail sent to my e-mail. This is pretty great too. I moved about two months ago, and switched addresses in Informed Delivery. I got a letter saying I switched, but I never put their code into Informed Delivery, and I still get scans of my mail at…

I just tried to sign up with my business address. It told me that the address is not available for Informed Delivery but rather than it just ending there, it allowed to go ahead and create an account for that address any way. I'll have to wait and see if they later reject the account somehow.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#125

Post by crooked-v »

sizzle wrote: post #118
3pt14159 wrote: post #110

Earlier quoted context omitted.

I mean it isn't that interesting of a story, really.[-1] And I want to stress I'm not a full time government contractor. I just did a couple short contracts for a department and it made me wtf so hard I signed up for one of those conferences where they set the ticket price so high it keeps out the curious[0], but it isn't classified or even protected. But I'll share anyway because you asked. I walk into the room titl…

There are some interesting social pressure group dynamics at play (e.g. go out in public and start staring at the sky and a people will start trying to see what you are looking at and glance at the sky-- literally monkey see monkey do?)

If somebody's staring at the sky, either there's something interesting to look at or they're nuts, and I like to give people the benefit of the doubt by not assuming the latter.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#126

Post by ams6110 »

ghaff wrote: post #109
ams6110 wrote: post #87

Earlier quoted context omitted.

Last time I got social security cards, they were printed on cardstock with absolutely no security features. They would be trivial to counterfeit, if you had the number to begin with. It's amazing that they are accepted as a form of ID to get e.g. a passport.

They may be one form of ID required. (And I'm not sure that's even the case.) They are certainly not sufficient. You need proof of citizenship. You need some form of government-issued ID. I haven't personally had a social security card in many decades. For the first time in I don't know how long, I do need to provide some form of proof of SSN to get a RealID drivers license renewal but last year's W2 is sufficient fo…

Yeah not required, but accepted. And not sufficient by itself. Birth certificate is good to prove citizenship and those appear to be easily forgeable also, at least the ones I've seen.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#127

Post by analogmemory »

eigenvector wrote: post #112
ams6110 wrote: post #11

Earlier quoted context omitted.

You can forward someone else's mail too. Just go to the post office, fill out the form, and drop it in the mailbox. There's no verification, though there is notification at both the old and the new address. Not to mention it's a crime to do that.

The thing that stunned me about mail forwarding in the US is that it's free. There's as little verification here in Canada as in the US, but it's a pretty pricey service (minimum ~$60 depending on length of time) which naturally rate-limits fraud attempts.

Oh it's "Free" in the normal way. In that they sell your new address to marketers. I stopped using it years ago when I moved and then started getting catalogs for what felt like every business out there.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#128

Post by ghaff »

ams6110 wrote: post #126
ghaff wrote: post #109

Earlier quoted context omitted.

They may be one form of ID required. (And I'm not sure that's even the case.) They are certainly not sufficient. You need proof of citizenship. You need some form of government-issued ID. I haven't personally had a social security card in many decades. For the first time in I don't know how long, I do need to provide some form of proof of SSN to get a RealID drivers license renewal but last year's W2 is sufficient fo…

Yeah not required, but accepted. And not sufficient by itself. Birth certificate is good to prove citizenship and those appear to be easily forgeable also, at least the ones I've seen.

It's all a tradeoff. As a passport holder, a homeowner, and an employed person who gets a W-2, it only took me a few minutes to round up suitable documents to get a RealID-compliant drivers license renewal. But I'm sure it's more difficult for many. Some level of fraud is probably an acceptable cost for not making identity hard to prove for a significant slice of the population.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#129

Post by what_ever »

TazeTSchnitzel wrote: post #3

So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right? But then I got to this bit: > KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify res…

You need to verify. Either with some questions related to your credit check (like previous addresses, employment history) or physically getting a mail to that address.

A version of this was already possible to do using address forwarding which included same way of verification.

Re: U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service

#130

Post by danso »

fibers wrote: post #105
danso wrote: post #92

Earlier quoted context omitted.

People love stating this fact because it's likely most people are surprised the law allows for such severe serious penalties for what might seem like a petty infraction. What you've said about underfunded enforcement and rare investigations could be said about almost every other type of non-violent crime.

Uh kyc banking laws used to fund terrorism (eg hawalas) have been extensively ramped up over the past 20 yrs. Theres certain non violent crimes that law enforcement has carte blanche to investigate.

That's good to know.

> "about almost every other type of non-violent crime."

Post reply on HN