News for hackers. Stuff that matters.
Re:The "email is authentication" pattern by terribleperson on Saturday September 07, 2024 @11:07PM (#41477919)
Is a fake ID going to fly at the post office, where they can scan them? Also, I was imagining they'd want more than just an ID.

edit: Also also, they have to go into a physical post office and be observed trying to steal your account. Given how it's quite possible to steal accounts via social engineering, this seems like an improvement in security, not a reduction.

Re:The "email is authentication" pattern by kmoser on Sunday September 08, 2024 @01:09PM (#41481566)
I don't want a government entity, or really any entity I'm not paying directly for their services, to be the gatekeeper between me and my accounts.

The social engineering attack surface of my account currently consists of a handful of support contacts at my ISP, who have been trained to deal with computer security. If you allow any USPS employee to access your account, you've suddenly increased the potential attack surface by several orders of magnitude.

Re:The "email is authentication" pattern by nine_k on Sunday September 08, 2024 @08:58PM (#41484585)
(1) Your USPS-provided email should neither be mandatory nor the only acceptable email. It could be an extra convenience, and a low-friction way to get a reasonably secure email for first-time / technically unsavvy users.

(2) An entity you're directly paying to may go out of business, sometimes due to circumstances beyond their control. At least state-sponsored entities don't do it so abruptly in most of the "civilized world".

Re:The "email is authentication" pattern by bouncing on Tuesday September 10, 2024 @04:59PM (#41505487)
The account recovery process for commercial email providers usually involves you photographing your ID. Presumably the post office, in person, would be far less likely to be fooled.