How does the security of BufferBox/Amazon Locker compare to Packstation?

To get your packet out of a Packstation, you need both the (magnetic strip) card that they send you on signup and a one-time PIN they send via SMS (not email). This might not sound "easy", but there has been a lot of abuse in the past years so that DHL was forced to step up security.

How do the US systems compare? Have there been reports on abuse?

For Bufferbox, when the package is delivered to the box, they send you an email with an access code, and you have to enter the access code. As far as build quality and strength, they seem pretty solid, and I haven't heard of any abuse stories from the Bufferbox guys.

For Packstation they had some serious problems with phishing. At first you only needed your Packstation User Number and the PIN. They then disallowed logins with user number and required the membership card. But it seems they started skimming those, so starting from last month they send you a TAN to your cellphone when the package arrives and you need card+TAN.

From what I see Bufferbox right now only has a few locations, for Packstation its over 2500 locations and a wide userbase, as with software: the wider the user-base the bigger the profit for bad guys.

Amazon and Bufferbox did the sensible thing from the start: one time use access codes.

Via email. Not very hard to hack.

If you email is hacked you likely have bigger problems than a package or two going missing.

Email transport is done in plaintext on the public internet -- it provides no confidentiality or integrity.

Most e-mail users are using browser-based e-mail clients over HTTPS so in order to access the plaintext email one needs to tap the senders local network which would only work if the sender is not using an HTTPS webmail. Plaintext public internet attacks for email were more common when people used unsecured POP3 and IMAP.

How long is the code? What happens if I approach a bufferbox in the middle of the night and try to brute force a TAN?

Wouldn't be much of a problem with exponential backoff time and even a 6-digit pin.

I wouldn't call it solid: All that the 'bad guy' needs to go shopping with a stolen CC is control over an email box of a BufferBox customer. DHL had to learn it the hard way, and I'm sure they didn't come up with two factor authentication (card+pin knowledge) and out-of-band (SMS) PIN transmission without a reason. We'll see how it works out in the US..

I'm surprised no one has tried NFC for security.

With Germany being notorious for its copycats, it's funny to see this in reverse.

Who would have thought that an idea that exists in Germany for almost 10 years would still be great for a startup in the US/Canada.

Funny that you would say that. There are a lot of us start ups (even yc ones!) that copy companyies/ideas that are proven and established here in Germany. The package stuff s just one example. All the ride sharing start ups that were hyped some time ago basically copy "mitfahrgelegenheit.de" ( now the company s known as carpooling) wh have been dong this for nearly ten years now. Public bike sharing is another example.

It's easy to just blame rocket Internet and pretend like that's all of German innovation/startp scene. Packaging and bike sharing weren't even pioneered by startups but by huge formerly state owned companies who are Slow and boring n the Public eye

I agree that Germany is not all about copycats. Thanks to the Samwers and others this perception was created. If you visit places like Silicon Valley and say you're from Germany you can be sure to find someone who will "make a joke" about Germany and startup copycats.

What irritates me is that nobody seems to point out these reverse cases, where others copy German innovation/ideas.

Also I'm wondering why these positive German examples didn't really scale internationally? Why didn't DHL roll out Packstation in the US? (Big company policies and lack of innovation?) Why has Mitfahrgelegenheit/Carpooling needed almost 8 years to launch in Europe? Why hasn't it launched in the US?

Just really wondering about the different perception and mindsets of US and German startups...

Germans are pretty conservative. There was a successful German startup that I looked at, that bragged about how cash flow positive they were. I said FFS, why? In the US in a high growth startup land grab type business, you would put all the cash back into the business to grow it as fast as possible, including internationally, instead of hoarding it and bragging about how solid and conservative you are.

Different values? Maybe they're happy with what they've got and don't need to risk it all for a very small improvement in their already fantastic lifestyle? I'm not criticizing founders who decide to go for it all, but I definitely wouldn't look down on a small but successful business like their clueless.

I personally find the profitable and sustainable business model way more attractive than the grow for the sake of growth model.

Sometimes the only defensible market position is #1. it's a natural winner-take-all market with strong network effects.

You could end up #1 in Germany against a #2 who is #1 in the rest of the EU - when by moving faster you could have been #1 in the entire EU.

Sure, this makes sense some times. Other times it may turn a profitable business into a spectacular and over-hyped failure.

In my limited experience, DHL in the US (formerly Airborne Express) doesn't know its ass from its elbow, and is a shambling testament to union sloth and inefficiency. Perhaps things are different in DE?

The Germans are the leading industrial nation of the world, so it's not surprising that for a startup in this field US is the copy-cat.

P.S. I'm defining industrial as 'the manipulation and enrichment of physical goods' for the purpose of this comment.

Really? You might enjoy reading this article: http://www.businessweek.com/articles/2012-02-29/the-germany-...

That's why I explicitly mentioned "manipulation and enrichment of physical goods"

Notorious for its copycats? Can you explain this? I don't know what you are referring to.

I don't get it, this is just one example.

But a huge one.

The big difference between Rocket & BufferBox/Amazon is the implementation of the idea. Rocket doesn't just take an awesome idea and bring it home, they CLONE the initial product, usually copying layout and look & feel. It's this cloning action that draws the ire of the tech world, not the fact that they take international ideas and implement them locally.

DHL "Packstation" started 10 years ago here in Germany, now those boxes are everywhere in populated areas. I was somewhat surprised that it isn't popular in the US.

Yes, well, P.O. boxes have been around since time immemorial too. In this case, the hard part isn't the idea of "a place where people can have stuff shipped that isn't their home address". It's handling the logistics, interfacing with online retailers, etc. It would be a lot more interesting if you could show BufferBox copying some specific, non-obvious technique.

A German packstation is not a PO box. It is exactly like a buffer box.

Yes, I understand that well. That doesn't conflict with anything I said unless you think that the crucial insight of the German packstation was to share boxes.

in japan, it is even more prevalent to some extend than in germany. e.g., amazon will ship to any convenience store for you to pick your parcel up. raktuen etc. as well! and there are way, way more convenience stores in japan than anything else (apart from vendin machines :))!

...and it seems an amazingly efficient service: no real infrastructure required (packages are on a shelf behind the counter), last-mile shipping done on the same trucks that restock the stores, uses the existing store computer systems, etc.

The "locker model" might be better for high-value goods and an untrustworthy workforce, but it seems to require a pretty huge investment to get any significant coverage...

Yes, DHL already did this. But, its market is huge and it will grow. Even, I would say still there is space for new arrivals in this field.

I see Amazon Lockers at parking garages near me while walking around in New York.

The same was launched and failed in the same place (Toronto) in the year 2000, with locations at Go and Subway stations. I think Google will want to change the business model radically in some way.

Do you mean Empori? I think those guys failed because their business model was also in online retailing itself ... http://www.dodgycoder.net/2012/08/empori-original-amazon-loc...

They actually aren't even in the US yet. They're only located in Southern Ontario.

And select private locations in Mountain View (ex: YC, Google).