Hacker News Reader

Comment by eik3_de | Hacker News Reader

How does the security of BufferBox/Amazon Locker compare to Packstation?

To get your packet out of a Packstation, you need both the (magnetic strip) card that they send you on signup and a one-time PIN they send via SMS (not email). This might not sound "easy", but there has been a lot of abuse in the past years so that DHL was forced to step up security.

How do the US systems compare? Have there been reports on abuse?

View on HN

For Bufferbox, when the package is delivered to the box, they send you an email with an access code, and you have to enter the access code. As far as build quality and strength, they seem pretty solid, and I haven't heard of any abuse stories from the Bufferbox guys.

For Packstation they had some serious problems with phishing. At first you only needed your Packstation User Number and the PIN. They then disallowed logins with user number and required the membership card. But it seems they started skimming those, so starting from last month they send you a TAN to your cellphone when the package arrives and you need card+TAN.

From what I see Bufferbox right now only has a few locations, for Packstation its over 2500 locations and a wide userbase, as with software: the wider the user-base the bigger the profit for bad guys.

Amazon and Bufferbox did the sensible thing from the start: one time use access codes.

Via email. Not very hard to hack.

If you email is hacked you likely have bigger problems than a package or two going missing.

Email transport is done in plaintext on the public internet -- it provides no confidentiality or integrity.

Most e-mail users are using browser-based e-mail clients over HTTPS so in order to access the plaintext email one needs to tap the senders local network which would only work if the sender is not using an HTTPS webmail. Plaintext public internet attacks for email were more common when people used unsecured POP3 and IMAP.

How long is the code? What happens if I approach a bufferbox in the middle of the night and try to brute force a TAN?

Wouldn't be much of a problem with exponential backoff time and even a 6-digit pin.

I wouldn't call it solid: All that the 'bad guy' needs to go shopping with a stolen CC is control over an email box of a BufferBox customer. DHL had to learn it the hard way, and I'm sure they didn't come up with two factor authentication (card+pin knowledge) and out-of-band (SMS) PIN transmission without a reason. We'll see how it works out in the US..

I'm surprised no one has tried NFC for security.

Reply on news.ycombinator.com