Hacker News Reader

Comment by gregmac | Hacker News Reader

I signed up for a service from UPS a few years ago that notifies me of impending shipments and lets me do a few limited things like 'Hold for pickup'.

The authentication for it was simple and reasonably secure: they physically mailed me a card with a verification number I had to type in. It took a few days of course, but only someone with access to my mailbox can get the card (and my mailbox requires a key to open).

This "knowledge-based authentication" system USPS is using is most definitely less secure, and I can't fathom how it wouldn't be immensely more complex to build and maintain.

View on HN

Nextdoor takes this approach too to verify that you live in a neighborhood. However, the vulnerability I see in this is that there’s nothing that actually validates I live at an address just because I can receive mail that was sent there. E.g., someone could take it out of my mailbox without living there to verify that they “live” there; or I could send it to a work address.

Nextdoor does something that makes the postcard completely useless -- if you don't respond to the postcard, they'll put you in a queue for your "neighborhood leads" to approve:

https://help.nextdoor.com/customer/en/portal/articles/990082...

The problem is this is your neighbor confirming that a person by that name lives near them. They have no way of confirming that person is the actual owner of the account being verified, unless they go over, knock on their door, and ask "hey, did you sign up for Nextdoor."

So someone could sign up as Nextdoor as me. I throw away the postcard, because I don't know why I got it and I don't want anything to do with Nextdoor. Meanwhile a well-meaning neighbor of mine can just go and approves the account.

If you move, would UPS catch that and automatically turn it off?

Hm, I am not sure. The program is called UPS My Choice, one of the items in their FAQ [1] has:

"There are some common reasons why you’re currently unable to enroll in UPS My Choice, including:"

"You recently moved to a new home. There may be little or no public record information about your move. Unfortunately, until updated information about your move becomes part of the public record through mortgages, deeds, utility bills, etc., you won't be able to enroll."

It does sound like they do more verification, but it's not clear if they check this regularly to deactivate accounts.

It also makes me wonder if they verify by the name the shipment is going to (matching last name). I've never had something shipped to my house that didn't have my last name on it so I'm not sure.

[1] https://www.ups.com/us/en/help-center/tracking-support/valid...

They do verify names. I have had packages shipped to my house on behalf of friends, or in a hobby business name, and don't get notified like I get for my packages.

I'll say that UPS will only send you automatic updates for packages that match your full address, including your name. I'm signed up for the service, and I receive uncannily perfect notifications every time a UPS label is generated with my street address and name, however I've received exactly zero notifications about my girlfriend's packages to the same address. In fact, she's independently signed up for UPS MyChoice under her name and now gets those notifications herself. It's a great service.

So, when you move, you don't really have to deactivate it so long as you don't send any more packages to that address with your name.

Thanks for verifying this. I'll add that I get notifications for my wife's packages so it's likely only based on last name.

This also means in the case you move and the next resident has the same last name as you, you'll get their package notifications (and can redirect their packages). Presumably the next resident would have to call UPS support to figure this out, but the danger is it would not be obvious someone else has control until they use it, or you attempt to sign up yourself.

Unfortunately, I'm receiving scans of everything that comes to my mailbox, including mail destined for the previous tenant that is still addressed to my apartment.

Reply on news.ycombinator.com