Hacker News Reader

Comment by hndhyc0bdt | Hacker News Reader

Ran an LE request desk for a while and the whole thing was PDFs from .gov-ish email addresses. Only real control we had was calling the agency back on a number we looked up ourselves, not the one on the letterhead.

View on HN

Is it uncommon/impossible to ask for the federally-brokered in-person procedure in the US?

(The way I know it: Local court or police officer shows up at our office later that day and hands over a printout matching the request that we had been unable to confirm, on request of federal authority, in turn on request of the authority demanding we hand over some customers data. Those two requests utilizing government agency-internal auth mechanisms we do not need to know or care about.)

> Those two requests utilizing government agency-internal auth mechanisms we do not need to know or care about.

Most likely:

> and the whole thing was PDFs from .gov-ish email addresses

But I guess this moves the liability for answering fake requests to the local branch.

You'd still want to verify that with the court or authority? I've been served before and sometimes it's just a person in street clothes who hands you an envelope. And even if it's a court bailiff or officer or something like that, would you be able to distinguish a real uniform, ID and badge from a fake one?

The uniformed woman with the pistol is whatever the stitching on the chest pocket say she is. Is that not true just the same even in places where other people may routinely open-carry?

You say .gov-ish, does this mean compromised gov email accounts, spoofed email addresses or domains that look like government domains?

.gov is a US thing, and not even all US agencies use .gov ending emails.

You do not need to compromise anything, you can put any address in the "from" field. Email has no universal verification for sender address.

I would sincerely hope .gov addresses use SPF/DKIM/DMARC. That makes spoofing impossible. In Revolut's case, the sender's email system had been compromised.

And what about the rest of the world?

What is LE? Let’s Encrypt?

Guessing Law Enforcement

Law enforcement.

Swing and a miss.

how would you come to that conclusion based on the context here?

Uh, not knowing otherwise? Which is why they were asking?

> Only real control we had was calling the agency back on a number we looked up ourselves

Way to difficult for Revolut, evidently.

I've done that as well and this is what most of those do look like.

Reply on news.ycombinator.com