Hacker News Reader

Comment by cschneid | Hacker News Reader

The underlying problem seems to be that companies confuse identification with authentication.

A drivers license number is a unique ID. The physical card with security features and a photo is the authentication that it belongs to me, holding it.

Same thing with social security numbers. That can be treated as an identifier, so the bank can talk about an individual. But not as authentication and authorization to open new accounts.

Data breaches would be so much less scary if banks and similar didn't keep screwing this up.

View on HN

>if banks and similar didn't keep screwing this up

They aren't "screwing it up". They eliminate the problem from their perspective via forcing people into binding arbitration and forbidding class actions, and also through promoting the concept of "identity theft" which eliminates the sense that they have any agency when there are compromises.

Every user agreement I see goes on and on about how you the consumer are responsible for any compromises on your end, so there's no question that the concept of being responsible for security is widely understood. It simply is not applied to corporations because they are able to reject it where individuals have no bargaining power.

They also sent me unsolicited junk mail at a new address and I don't know how they got that address. As such I would never use Geico for violating my privacy. I will only use companies that DON'T try to extract my personal info without me giving it to them explicitly.

This only doubly confirms that they suck at privacy.

If you submit a change of address to the USPS, they sell that data to marketing companies. One workaround is to submit a 'temporary' address change for 6 months at a time instead.

I don't submit change of address to USPS for this reason. I hate the USPS with a passion for doing that to people.

The purpose of the function is to update any entity that legitimately has your name/address as to your new address. It's used by Magazine publishers to automatically update your subscription addresses. It's also used by companies you've done business with but might not have updated your address info such as a specialist doctor you visited once or your old insurance company.

I personally think that's of more value than stopping junk mailers from sending me personalized junk mail. You're going to get the junk mail either way.

No, screw that. 99% of people who get updated address via USPS are illegitimate.

If they think they're doing me a service, they're not.

Specialist doctors can just e-mail me. This is 2021. My physical address has changed at least 8 times in the past 2 decades. My e-mail address hasn't changed in that whole time.

I don't subscribe to magazines, and even if I did, you'd be sure as hell that I would update my address if I was paying for something.

> 99% of people who get updated address via USPS are illegitimate.

Is there any evidence to back that up or is that one of those "Feel Facts"?

So it's not beneficial to you but many people change their email address with greater frequency than they do their mailing address so your solution wouldn't work either.

In my case it's 100%. I change my address with anyone who needs it. Anyone who doesn't get contacted by me doesn't need to know.

It's my personal information and before they try to do me a "service" by giving it away, they should ASK me.

What next, give away my address to stalkers who knew where I lived before? Fuck that.

So no then?

> they try to do me a "service" by giving it away, they should ASK me.

You realize this is a voluntary service you sign up for? They make it clear the reasons for doing it.

I agree it's voluntary, which is why I don't do it.

But no, they don't make it clear that they will GIVE my new address to people. It's FAR from clear.

They should have a service that does mail forwarding without handing out new address to people.

It explains exactly what the information is used for at the bottom of the first step in the Privacy Act Statement.

They even provide a link to the NCOALink page explaining how the COA DB program works.

https://moversguide.usps.com/mgo/move-combined

Yeah, I don't like the way it works.

Hate the politicians who cut USPS' funding to such an extent that this is necessary.

USPS wasted huge money and the Union demands even bigger pensions, while USPS is losing market to commercial carriers at the same time in the open market.. no one is clean in that fight

I thought there was a (perhaps non-obvious) opt-out for that? Am I misremembering?

>They also sent me unsolicited junk mail at a new address and I don't know how they got that address

They got it from your credit report. You may opt out of these types of offers:

https://www.consumer.ftc.gov/articles/0148-prescreened-credi...

Good luck. Privacy is an illusion. If you use your address for any sort of billing (utilities, cell phone, whatever) or government / public service (license, voter, real estate records) it is going to be sold, and resold...

Use a UPS box for billing addresses. Don't register to vote until THEY commit to stop handing out addresses. Or register to vote without your address. That should be possible. Homeless people can register to vote, so I should be able to as well.

Utilities still know your physical service address. Generally banks and some other financial accounts require a physical address, in addition to a PO box / mailing address if you use one. This will be shared. There is no escape.

I refuse to think there is no escape. How do billionaires and domestic violence victims do it?

For financial accounts, many private mailbox services give you a real street address, so it doesn't look like a PO Box.

They probably think of it as "something you have" as in TOTP, without considering or caring that it's pretty easy for other people to "have" it too.

Reply on news.ycombinator.com