Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself

akamai.com

Post reply on HN
Print view View original

61–70 of 75 posts

Re: Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself

#61

Post by labcomputer »

tristor wrote: post #49
lukeschlather wrote: post #42

Earlier quoted context omitted.

That's like suggesting people don't need to know what the zip code is because it's often redundant and omitted. People are often lazy, but it's immediately obvious to anyone that omitting the full 9-digit zip code could result in the letter being misdelivered, even if I don't understand what the last 4 digits are even for.

The Zip+4 last four digits align to delivery zones. It can be trivially constructed from the complete address now that we have reliable digital mapping systems, and in fact this is what happens internally in the postal system. It is not required and will likely never be required to provide a 9 digit ZIP for reliable delivery. It may, and does sometimes, impact speed of delivery due to sorting/distribution rounds.

> It is not required and will likely never be required to provide a 9 digit ZIP for reliable delivery.

That depends on who you are.

If you are a regular person, then yes, 5 digits is sufficient. But if you are a sender of presorted commercial bulk mail (which is discounted from first class), you may actually be required to provide a 5 + 4 + 2 = 11 digit ZIP.

That little barcode the post office prints on your letters is actually just the 11 digit zip. The final two digits are the last two digits of the house number. So "123 Any Street, Anytown FL, 45678" the final two digits of the zip would be 23.

Re: Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself

#62

Post by wongarsu »

mr_mitm wrote: post #32
bombcar wrote: post #24

USPS.gov redirecting to USPS.com certainly doesn't help matters. Things like this should use one of the few TLDs that actually has policies and procedures in place; then it's a simple "if it's not .gov, it's not real."

You're right that it doesn't help, but looking at regular non-technical people like my retired parents for example, I really wonder if it's a realistic expectation that people know what the important part of a URL are. They need to parse slashes, dots, colons and ats (remember URLs can contain credentials, even though I believe browser issue warnings these days), identifiy the TLD and the domain and then know what is…

Browsers have gotten better at highlighting the important part. On this URL Firefox highlights the "ycombinator.com" part of the URL (by writing the rest in muted gray), and edge at least highlights "news.ycombinator.com". Chrome curiously doesn't, and neither do any of my mobile browsers

Re: Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself

#63

Post by compuguy »

qsymmachus wrote: post #27
cozzyd wrote: post #25

Earlier quoted context omitted.

I wonder if the .com TLD is part of the GOP campaign to kill the USPS

USPS purchased the usps.com domain a long time ago specifically so they could control it and prevent phishing. The decision to replace usps.gov with the .com domain came later, with the tenure of Trump appointee Louis DeJoy. Right wingers believe that USPS should operate as a business, not a public service, so "rebranding" their website to be .com is definitely a part of that narrative.

I'm honestly not a fan of what Louis DeJoy has done to USPS, but I'm pretty sure they've used the dot com domain for as long as I can remember, way before DeJoy became Postmaster General....

Re: Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself

#64

Post by compuguy »

qsymmachus wrote: post #35
toomuchtodo wrote: post #33

Earlier quoted context omitted.

So the ask should be to have .gov be canonical, and usps.com directing to .gov it sounds like?

Yep, but for ideological reasons they reversed it.

No, as I and others have commented, this wasn't changed by the current Postmaster DeJoy (not ignoring all the other wonderful stuff he's changed). They've been using the dot com domain for decades at least?

Re: Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself

#65

Post by acdha »

acomjean wrote: post #50
acdha wrote: post #22

Earlier quoted context omitted.

I periodically wonder how quickly this would end if the costs shifted to the telcos who currently see it as a profit center. Imagine if reporting a message got you an immediate $1 credit and they had to recover it from the network which originated the spam: how quickly would they be able to turn on egress filtering?

The fact that telcos are really party to these scams and for some reason aren't held accountable is amazing to me.

I think about that every time I just a call with a forged number. I remember when VoIP was coming on the market and people were warning about spoofing but telco executives apparently just blew that off because it’d slow sales.

Re: Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself

#67

Post by gowld »

tylervigen wrote: post #26

> We have found that the USPS is under attack from text scams The core challenge of phishing attacks is that USPS is not, in fact, the primary victim of these attacks. The victims are distributed citizens who fall for the scam. USPS doesn't have very many levers available to them to address the attacks (besides a warning on their site, which they have), but also doesn't 'feel' the impact so would have a hard time jus…

The USPS is empowered with a law enforcement branch to defend against attacks on the mail system.

The problem is usually that domestic law enforcement is powerless against international crime, which gets laundered by international utilities like DNA and IP routing/peering.

Re: Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself

#68

Post by kevincox »

mr_mitm wrote: post #32
bombcar wrote: post #24

USPS.gov redirecting to USPS.com certainly doesn't help matters. Things like this should use one of the few TLDs that actually has policies and procedures in place; then it's a simple "if it's not .gov, it's not real."

You're right that it doesn't help, but looking at regular non-technical people like my retired parents for example, I really wonder if it's a realistic expectation that people know what the important part of a URL are. They need to parse slashes, dots, colons and ats (remember URLs can contain credentials, even though I believe browser issue warnings these days), identifiy the TLD and the domain and then know what is…

I wonder if it would have helped to sort URLs in order of importance. For example com.microsoft.login/reset-password. Then the rule is "does it start with `com.microsoft.`" It would still require people reading URLs and only work well if companies don't spray important stuff across domains (Microsoft is particularly bad here) but at least it is way better than "The stuff in front of the first slash that comes after the protocol slashes." which is pretty hard to explain to someone.

Re: Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself

#69

Post by kevincox »

BobaFloutist wrote: post #46
mr_mitm wrote: post #32

Earlier quoted context omitted.

You're right that it doesn't help, but looking at regular non-technical people like my retired parents for example, I really wonder if it's a realistic expectation that people know what the important part of a URL are. They need to parse slashes, dots, colons and ats (remember URLs can contain credentials, even though I believe browser issue warnings these days), identifiy the TLD and the domain and then know what is…

If nothing else, their browser could know that.

The problem is that the browser knows that myups.com is not ups.com. But it doesn't know that you don't have an account at myups.com and think you are logging into ups.com.

The best solution to this is using your browsers built-in password manager (or your favourite browser-integrated password manager) then your randomly-generated password for ups.com won't auto-fill for myups.com and you at least have to think about it and wonder why you need to fish the password out of the password manager.

Post reply on HN