This is pretty great too. I moved about two months ago, and switched addresses in Informed Delivery. I got a letter saying I switched, but I never put their code into Informed Delivery, and I still get scans of my mail at the new place. I got the scans before the validation letter, so I could easily have stolen that, and no one would know I'm seeing their mail....
*Edit to make things clearer.
I have not validated anything. The letter says I won't get emails unless I put the code in the letter in Informed Delivery. I did not do that ever and I still get the emails.
Verify online, verify by mail, or... skip. When I hit skip it just sent me to a dashboard that says I'm not enrolled because I'm not verified. I'm gonna let this sit for a few days and see if I start getting the emails.
Realistically if you tamper with mail nothing at all will happen to you, until your fraud raises to a headline figure and could get someone a promotion.
Several years ago a couple people in the community noticed problems with their mail (mail seemingly missing, receiving wrongly addressed items, etc..). They called the postal service and an investigator was out in days. Within two weeks there were hidden cameras mounted in various locations around town pointed at mailboxes. A few more weeks and they apprehended an individual going through mailboxes based on the photos from those cameras. I don't know the final outcome, but the total turnaround from notification to arrest was less than 3 months.
Even underfunded agencies can prioritize. A call notifying them of a problem is a world of difference than them identifying and pursuing issues on their own.
Just like how an underfunded police department may not patrol all the areas they should, but if you call them to notify them of a crime, an officer will likely show up at some point. Even if the officer shows up quite a bit later, the relative difference to when an officer might stumble across that area, much less evidence of the crime, is probably somewhat comparable.
> "about almost every other type of non-violent crime."
This is all my own mail. When I switched ID to the new address, I no longer received emails of mail going to my old address automatically. So there's that.
Falsifying your identity to a federal postal service to gain access to someone else's mail? That breaks a wide range of laws
You think "surely X" but no. Almost never X. Almost always some lazy Y or nothing at all.
After a couple consulting contracts / vuln disclosures I updated my priors of how competent the government was. I'm actually getting worried now that everything is going cyber-physical and corporations can pull the wool over their eyes. The government is great at offense, but defence is boring. Especially at non-fancy agencies / departments. And the salaries are low.
But it doesn't even matter really. Basically so many things are broken and offense gets better over time while defence gets worse. I'm fighting for regulations, etc. But this stuff is so ill-defined that the government has trouble understanding it.
I have come to blame the universities. The CompSci department should have gone to the Civil or Nuclear Engineering department and said "ok, how do we think about time frames over 100 years?" and built out courses out of that. But other than a handful of rare exceptions, right now most grads come out not understanding the true gravity of their decisions.
The one nice thing is that offense is usually incompetent too. I've been on projects dealing with real crime[0]. The number of people nailed with just getting an IP is lolsy. Most criminals are stupid. I partly want to relay what the smartest 2%ile did just to show how low the bar is, but I fear educating the lower 98%.
[0] Not stupid drug war stuff.
When you're talking about basic attacks to steal some money, this is a substantial but not world-changing effect. On the other hand, a government or cartel willing to invest significant resources in cyber offense can really move the needle. What we've seen Russia, North Korea, Israel, and others achieve is probably only a fraction of what they've actually achieved.
Have you read the Snowden leaks? The actual raw content?
It's pretty tame shit. My main takeaway was ahh, yes the world is as insecure as I thought it was not oh, these guys are using space laser technology hacks.
They've got crack teams to break into some harder gear, and they've got some crazy awesome cryptanalyses going on, but for most of it it's just what you were I would do if someone asked us to get into a bank or whatever. Most stuff is easy to hack anyway unless it's a fully patched iPhone or patched / stripped / locked down Windows server.
Plus you can see the codebases these guys have put out anyway. There was that peodophile CIA coder that had some of his personal codebase match his internal work and there are a bunch of current and former NSA / CSE guys floating around conferences.
I sat with a whole table of them and watched them fall for a simple social engineering attack one minute after being told they were going to fall for the attack.
They're not gods shimon.
Story time?
And I want to stress I'm not a full time government contractor. I just did a couple short contracts for a department and it made me wtf so hard I signed up for one of those conferences where they set the ticket price so high it keeps out the curious[0], but it isn't classified or even protected.
But I'll share anyway because you asked.
I walk into the room titled "something something Social Engineering Attacks" because the other one was on something I couldn't care less about. Fiddling with AWS settings probably.
Look around. Mostly tired, overworked looking sysadmins from different government departments and the occasional consulting company or bank.
Walk further into the room and there it is, a table full of my people. Dungeons and dragons (D&D) looking types of both genders that looked like they were born in or around 1984.
Sit down. "Hi." They're friendly; I forget what we talk about, but they all have sigint department name tags. Most were slated to give talks later in the conference.
Talk starts. Guy on stage.
Guy: "Within one minute of explaining what I'm going to socially engineer you to do you will do it."
Me: Internal monologue; The fuck you will.
D&D: Look kinda intrigued, kinda befuddled.
Guy: "Ok so first thing we need to do is to get you to stand up. Don't worry the clock hasn't started yet. We're just standing."
Me: Squints skeptically. Stands. Internal monologue: Where the hell is this going?
D&D: Stands up like the rest of the room, faces guy.
Guy: "Ok here is the game I'm going to get you to flip your hands like this."
Guy: Flips hands from palms down to palms up.
Me: Internal monologue: The fuck you are.
Me: Crosses arms.
D&D & Room: Chuckle.
Guy: "Ok, you ready? Go. Oh; one last thing..."
Me: Internal monologue: Ha! Good fucking luck buddy you already said "go" and I'm already crossed.
Guy: "...otherwise there is no game at all you'll just cross your arms and stand there. So you have to put your arms in front of you like this..."
Guy: Begins to slowly raise his arms.
D&D & Room: Begin to raise their arms so their palms are face down to the ground.
Guy: "... like this."
Guy: Shows arms out in-front of him with the palms face up.
Me (Quietly, to my table of future elf and dwarven partisans.): "Nooo. Don't do it."
D&D & Room: Flip their hands over to match guy.[2]
D&D: Look away from guy to me.
Guy: Does the TA-DA gesture.
Room: Laughs.
D&D: "How did you know?"
Me: "I know how these people think."
Rest of the conference people were convinced I was a Canadian spy or something. It's ok though. I got too drunk and made a fool of myself because a convo I had with a cyberwarfare guy (essentially) confirmed my fears that self-driving cars were WMDs due to class-attack (bad server update ala notPetya, say).
Gunna be feeling the burning shame on that one for at least another year.
Whatever.
At least all that foolishness is over. I thought I was losing my mind. Now that Schneier's book is out and it's been almost a year I'm back to being able to trust my own mind again. The cybersec scene is kinda stressful, but it's nothing compared to the kind of stress where you can't trust your own mind.
[-1] Well it wasn't going to be, so I spiced it up a bit by expanding into my failings as a human.
[0] Well most of the time, anyway. Can't stop me from lolsing into a conference to get a better read on where things are at.
[1] Memory isn't perfect, but you get the idea.
[2] Room of 100 people and I'm almost certain I was the only one that didn't get tricked.
Personally I have this turned on, because I'm conscious that every piece of information you'd need to send a fake address change notification for me is either public or easily obtainable with a call to the Tax Agency, which is far from reassuring.
It's not great for privacy though, so I understand the resistance of the US and the UK to it. Mind you, the US wouldn't have to make the whole thing public like Sweden does for… reasons.
*Asylum seekers and various types of temporary residents and such are not technically considered to be in the population register, though they are usually still in fact in the database, just with less information and a flag saying they don't count
Cue the fever dreams whenever anyone merely suggests we harmonize, normalize the details. As if predictable standards for signature verification will inevitably lead to a military coup.
I haven't personally had a social security card in many decades. For the first time in I don't know how long, I do need to provide some form of proof of SSN to get a RealID drivers license renewal but last year's W2 is sufficient for that.
That's my experience after hand delivering the form to the SS office so it would be quick.
I also received a postcard confirming that Informed Delivery had been activated for my postal address.
Maybe it would be good to also add in a postcard check where they send you a code to verify you have access to mail for the address anyway. Sure, a thief could too, but in that case there isn't much of an extra risk to informed delivery since you'd be compromised already.
I guess asking about credit report info is inadequate if people are managing to abuse this. One problem with that kind of thing is it's essentially security by obscurity, it's not deliberately created secret knowledge that can be trusted, it's stuff which happens to not be public and which only you should know, but there's no guarantee and you can't easily change it, right?
I definitely received the postcard though.
So anyone would've had a 1/16 chance of just guessing it right.
Like how I reset my Bank of America 2FA three years ago with just my name and billing address of my card.
It's kind of like internet abuse and DDoS in a way: I see HNers recommending something like CloudFront. Yet after being on the receiving end of a dedicated attacker that was able to bleed my financials, I would never use it again. And since it's not a widespread problem by nature of being a targeted attack, people continually have to learn the hard way on an individual basis, if they even get unlucky to begin with. So there's no real widespread need to change.
Or, how many HNers unknowingly use a webhost that null routes them under attack yet never experienced that?
Thus, they didn't see a need for tight security regarding who can get access to such images.
Most residential mailboxes at older homes face sidewalks and are trivial to steal from anyway. I thought my current setup in a new neighborhood would be ideal: individual locking boxes. And then one day mail got jammed in my side of the lock and I couldn't open it, so I waited for the mail carrier who promptly opened their side and handed me the contents with no verification at all.
It's just a shitshow all-round. There's virtually no thought for security or intrgrity of the system at any level.
I signed up for Informed Delivery a couple weeks ago, and it did ask for additional verification information. It was similar to questions asked by financial institutions when opening accounts online: "which of these 4 addresses have you lived at in the past?", "What was the name of your first pet?", etc. All presumably information that has been collected by companies such as Experian.
They always been smoking something.
When they released their "forward your mail to your new home online" feature where they charge your credit card $1 to verify your new ZIP code, I read it somewhere on dark web that a gift card works as well. I was actually purchasing new house, so I figured I give it a try! I bought a $20 gift card Visa Vanilla (with cash) and registered it online (during my visit in Starbucks using their WiFi) with my new ZIP code (you can provide any ZIP code while you register your gift card - its only for further verification) and sure it worked out like a charm! I figure I am not the only one that succeed with this. Then I read few months later at the same forum someone answer that USPS is blocking gift and prepaid cards at the moment. But for few months at least a hell broke out loose when you could load $20 gift card and pretty much forward mail of 20 strangers to your desired location, at $1 per pop.
The in person verification consisted of showing them my id.
Regardless, it is a great service to sign up for. You do get it automatically if you have other accounts or used too. I had a few people sign up for it at work.
the reason I started was we had a disappearing mail issue in my neighborhood that was eventually solved. plus its good to know when stuff you are expecting actually arrived. since I order a bit online having the packages listed is a great feature but they do not photo scan those. you can set delivery instructions for some
its free, its useful, and while it does have a security issue along with nearly every service the post office offers it hurts you not for using it.
in a day an age where we have privacy issues one of the biggest is proving who you are to agencies that have a real effect on your life and others. so we need to solve the ID issue as well.
A version of this was already possible to do using address forwarding which included same way of verification.
It’s a great service otherwise.
Whatever it is, there is a lot of it about.
But then I got to this bit:
> KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify residents when someone at their address signs up for Informed Delivery. The USPS addressed that shortcoming earlier this year, announcing it had started alerting all households by mail whenever anyone signs up to receive scanned notifications of mail delivered to their address.
> However, it appears that ID thieves have figured out ways to hijack identities and order new credit cards in victims’ names before the USPS can send their notification
What the actual hell? You can sign up online to get mail scanned… without any physical verification you're at the address, with only a physical notification being sent after-the-fact?
What the hell are USPS smoking?
It makes me wonder what you need to do to sign up for this. I wonder…
goes to website
it seems like the only thing they do is ask for the address, and you check a box to accept the T&Cs. I don't know if there's actual verification beyond that step, but it doesn't sound like there is…