Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thanks FedEx, this is why we keep getting phished

troyhunt.com

Post reply on HN
Print view View original

271–280 of 576 posts

Re: Thanks FedEx, this is why we keep getting phished

#271

Post by crazygringo »

ryandrake wrote: post #253
eropple wrote: post #224

Earlier quoted context omitted.

UPS is up there, too. I still get text messages about an old address on an account I can't log into for...reasons. (Special characters sound plausible! And of course the password reset flow doesn't work.) Wonder if they share a vendor.

I can’t believe it’s 2024 and we are still seeing bugs with handling “special” characters. Unicode has been here for how long? Robust string handling is supported in every language. There is no such thing as a special character. My name should be able to contain Chinese characters. My password should be able to contain emojis. What is this Stone Age shit still running on companies’ backends?

> My password should be able to contain emojis.

It's probably better if it shouldn't. It's generally better to prevent passwords from containing characters that can't be entered on a decent proportion of devices you may encounter.

Emojis are particularly problematic because new ones keep being added which require OS upgrades, and you might find yourself needing to log in from another device that just doesn't support those emojis yet.

Also it's not like Unicode makes everything easy. For example, you have to remember to normalize the password before hashing. Otherwise something as simple as "ñ" may be a totally different byte sequence depending on which device you're using.

Re: Thanks FedEx, this is why we keep getting phished

#272

Post by bradley13 »

hugoromano wrote: post #49

DHL, FedEx, and UPS are experts in overcharging to process a form and not caring about customers. Duty and VAT are usually low compared to this processing fee, and shipping has already been paid. Here is the catch in the EU, this simple duty form can be processed by the receiver, an agent (some related to the carrier), or an attorney-in-fact of the receiver. The big three carriers (and many others) threaten you if yo…

This. They have been paid to ship an international package. Billing the recipient for delivery is just dishonest. I assume they do it, to make their price for the shipper look artificially low.

For this reason, whenever possible, I choose delivery through the post office.

Re: Thanks FedEx, this is why we keep getting phished

#273

Post by evandale »

Denvercoder9 wrote: post #180
actionfromafar wrote: post #58

Earlier quoted context omitted.

For some things, you must use paper (or as it turns out, USB). Why the bank decided to use USB for this purpose, instead of paper, is very strange.

> For some things, you must use paper Do you have a source backing that up? Aside from the local tax collector, which insists on snailmailing me a copy of all correspondence even though they also sent everything to me digitally, I can't even remember the last time I received any documents on paper, and I'm in the EU.

5 words: Google search eu durable medium.

https://www.fca.org.uk/firms/durable-medium

https://www.lexology.com/library/detail.aspx?g=788714a1-d7b6...

Why did you need a source for this?

Re: Thanks FedEx, this is why we keep getting phished

#274

Post by ryandrake »

gjsman-1000 wrote: post #264
ryandrake wrote: post #263

Earlier quoted context omitted.

A software that can't accept a % as part of your password is absolutely, positively broken--in any industry or application. In many companies, this would be a P0 "don't go home until it's fixed" production emergency if a bug like this crept in to the software. We need to stop excusing long-standing bugs in horrible legacy software just because they are long-standing.

> In many companies, this would be a P0 "don't go home until it's fixed" production emergency if a bug like this crept in to the software. Would it, really? P0 would probably be "10% of our customers can't submit an order." Or "20% of our vendors are experiencing 404s."

If 10% of customers have passwords that now can't log in and submit orders, that would be an emergency.

We're taking OP's word for it that FedEx doesn't allow certain characters as passwords (actually, from the description, it seems more like FedEx only allows specific characters which is even worse). If either of those are true, it is most certainly a defect. Whether FedEx treats that defect as an emergency is up to them I guess. I'm saying many modern companies would.

You originally said "Weird password issues don't count as broke." I think this might just be a case where we have to "agree to disagree".

Re: Thanks FedEx, this is why we keep getting phished

#275

Post by throwway120385 »

n0us wrote: post #243
habosa wrote: post #219

FedEx may have the worst and least secure digital platform for a major company. Some examples I’ve noticed: 1. I moved into a 10-unit apartment building and wanted to set up FedEx Delivery Manager. I just put in my new address, no verification whatsoever, and I was immediately given access to the previous tenant’s delivery instructions which included the buildings private garage code. Any thief could have done the sa…

Is it impressive though? They have about a 50% success rate delivering things to me across multiple addresses and I know other people who have had similar long term issues.

At one of my addresses FedEx will happily sell anyone overnight shipping and then just keep the parcel at the depot for a week until they have a driver who can actually make the trip. I have had like 6 very urgent packages delayed like this. Once my wife ordered something perishable and they pulled this then told her she had to drive into town and pick it up at the airport.

I've also been nearly run off the road by FedEx drivers on the highway before. One guy was so angry that I was only going 10 over that he tailgated me within a foot and then punish passed me.

They're also the only service that still corrects my other address to the wrong address. I tried for a whole month to get ahold of anyone there who even knows what address correction is and then just stopped using them for anything important.

They doubled down on "digital" during the pandemic and fired a bunch of CSRs and stuff. It doesn't look like it's working out very well for them.

Re: Thanks FedEx, this is why we keep getting phished

#276

Post by mondobe »

withinboredom wrote: post #242
homeyKrogerSage wrote: post #227

Earlier quoted context omitted.

It is. I work as an IT tech at a military defense contractor and they require regular recycling passwords, with a decent number of passwords remembered. They at least have complexity requirements applied so not 100% bad, but still archaic

Heh. I just increased a number in my password for my passwords. Then just repeat. So “CompanyName[00]” meets almost all complexity requirements and all I have to do is increment the numbers. Note: I only do this when I have these requirements and I can’t use a password manager.

Sounds like a certain BOFH story... have you ever thought about just adding another "s" to the end of your password instead?

Re: Thanks FedEx, this is why we keep getting phished

#277

Post by 01HNNWZ0MV43FF »

bombcar wrote: post #267
philsnow wrote: post #118

Earlier quoted context omitted.

I’m supposed to pay my semi-annual property taxes (on the order of ~thousands of USD) on a site that ends in .org instead of .gov, and nobody apparently sees anything weird or wrong with it.

Now that I think of it, I'm not sure I've ever seen a government payment site hosted on .gov; usually .com.

You can tell it's legit if they charge you $2 extra for a credit card instead of a bank transfer lol

Re: Thanks FedEx, this is why we keep getting phished

#278

Post by throwway120385 »

marcosdumay wrote: post #216
swozey wrote: post #147

Earlier quoted context omitted.

I forget who puts that stuff out NIST/STIG(?) but IIRC in the recent few years they determined that rotating passwords like that was basically security theater and wasn't worth the damage to the staffs productivity

They decided it was useless security theater decades ago. What happened recently is that they discovered that they rule they used to actively push causes severe harm to security. Now there's a positive rule about not doing it.

Yeah when I was a shipping clerk, we had a pile of usernames and passwords for the Census Bureau's Automated Export System on sticky notes next to the shared computer because the password rotation and complexity requirements made it impossible to remember our passwords.

Re: Thanks FedEx, this is why we keep getting phished

#279

Post by toss1 »

habosa wrote: post #219

FedEx may have the worst and least secure digital platform for a major company. Some examples I’ve noticed: 1. I moved into a 10-unit apartment building and wanted to set up FedEx Delivery Manager. I just put in my new address, no verification whatsoever, and I was immediately given access to the previous tenant’s delivery instructions which included the buildings private garage code. Any thief could have done the sa…

Re password reset workflow issues: I had an account at a bank where password reset always failed. I had to go through a VERY convoluted process with customer website support to get it fixed. It turned out that the problem was that my registered email address was just two characters (my initials) to the left of the "@", e.g., ab@mydomain.com. They allowed me to enter and use it throughout the system without any error flagging whatsoever, but it completely broke the password system. They claim to have raised it as a bug, but never fixed in 3 years+ (moving away from them now).

Re: Thanks FedEx, this is why we keep getting phished

#280

Post by malfist »

cesarb wrote: post #124
__jonas wrote: post #36

Earlier quoted context omitted.

Clearly the safer option is sending the terms via CD https://t3n.de/news/sparkasse-digital-strategie-cds-per-post... Since no-one has a CD drive in their computer anymore, the security risk is negligible

And even if you do have a CD drive in your computer, the risk is still lower than a USB stick. A CD contains only data, it cannot do things like emulating a keyboard. The worst it can do is shatter when your high-speed DVD-ripping drive spins it up a bit too fast.

A USB stick only contains data too.
Post reply on HN