Clickbait title: USPS did not share anything intentionally. They negligently allowed tracking pixels from certain companies on their Informed Delivery page.
Of course, it's terrible from a privacy point of view, but let's be honest and call things as they are.
> They negligently allowed tracking pixels from certain companies on their Informed Delivery page.
I had to work on a feature like that, where individual client-companies wanted to sprinkle arbitrary pixel-trackers across different steps in our website's workflow for their users... Even today, I still worry I wasn't paranoid enough.
_______
For the curious/critiquing: When conditions are met, the main page JS creates a temporary <iframe src="..." sandbox="allow-scripts allow-same-origin">, and the destination URL (signed, time-limited) instructs a different subdomain to host up the icky arbitrary markup.
Yes, I know about the srcdoc attribute, and that would have been much easier except it breaks some tracker-code. In particular, Google Tag Manager silently stopped working, and it was because it contained some logic looking for "real site" aspects. This affected both `srcdoc` and also confused things when testing with `file://` URLs.
Why on earth is a government website linking anything from Facebook, Snapchat, etc? USPS isn't a trendy coffee shop or a designer brand, they're a federal agency of the United States government and should be held to a higher trust and privacy standard.
> Clickbait title: USPS did not share anything intentionally. They negligently allowed tracking pixels from certain companies on their Informed Delivery page.
You needed to read through to the end of the article. TechCrunch did its own testing and confirmed that the mentioned sites were scraping data from the USPS, including but not limited to the postal addresses. The negligence that allowed USPS to leak such information in the name of analytics or whatever it is they were gaining from Facebook et al. is unconscionable, and USPS are very much responsible, just as they would be for a trivial hack with the same effect.
I got an email from a co-worker today, and noticed at the bottom of his signature a "Create your own email signature" link, which led to wisestamp.com. Turns out they sell an email signature service to companies.
I pointed out to him that advertising an unrelated company in his corporate emails was tacky, but even worse there was a tracking pixel in the email, clearly specific to him. So, any time someone opened one of his emails, WiseStamp would know.
We don't actually know that. What we know is that they said they didn't share anything intentionally. But there is almost no penalty for lying about such things and the USPS is desperate for money, so I don't think it's impossible that some USPS person made an under-the-table deal with Meta or another company to add this stuff to its website in exchange for a kickback. Only a detailed audit would be able to find out the truth, and that seems unlikely to happen unless Congress gets upset about the issue.
Title could be misleading but only if the reader jumps to conclusions; it does say anything about intent. It only says data was shared. That's 100% accurate.
USPS customers have no recourse so arguably intent is irrelevent anyway.
I have trouble accepting that as mere negligence (vs. gross negligence). Anyone hosting a website should be familiar with the trackers and other cruft that comes from third parties they utilize. This is why I'm incredibly choosy about what libraries I use and which third parties I allow to put content on my site (directly or indirectly). If you don't have good insight on this you have no business including their assets/snippets. I use open-source analytics tools that run entirely on my infrastructure, not the junk from Meta etc.
"Everyone else does it" is not a palatable excuse.
These companies are known for having user-hostile, privacy-invasive reputations, so as developers we should by default be wary of them.
E.g. Including a Facebook "Like" snippet on your page lets them siphon all sorts of data from your visitors, particularly if the user hasn't logged out of their Facebook account. It's not how users expect the web to work, and it's an insidious technique (they're deliberately taking advantage of thousands of unwitting webmasters who don't understand the baggage that snippet comes with).
More examples here: https://www.consumerreports.org/electronics-computers/privac...
Frankly, even if USPS was unaware, the data still ended up in those third party hands via their services so as far as I'm concerned, yes, they did facilitate the sharing of said data. At least they plugged the hole once it was pointed out to them.
This just highlights the pervasive privacy issues in adtech. Many platforms today even support server-side events tracking which bypasses client-side detection & prevention like an adblocker would do to a tracking pixel. The true scope is alarming: way beyond clicks and views, they track events like "MakeAnAppointment", "AddPaymentInfo", "LoanApplication", etc.
This is the real reason why TikTok is a national security risk. Their ad platform, widely used by Shopify, Adobe, Segment, WooCommerce, etc., collects intimate data on non-TikTok users: prescriptions, medical appointments, loan applications, credit card details. Millions who'll never use TikTok, Facebook, etc. are still subject to this data collection in the name of "converting users to customers".
At the policy level, we urgently need a national data privacy act to address these types of systemic issues. At the technology level, things like zero-knowledge advertising could mitigate a lot of the user privacy risk.
> When reached for comment, Facebook spokesperson Emil Vazquez provided a statement: “We’ve been clear in our policies that advertisers should not send sensitive information about people through our Business Tools. Doing so is against our policies, and we educate advertisers on properly setting up Business Tools to prevent this from occurring. […]
Seems pretty convenient to blame the people using the tool.
> Our system is designed to filter out potentially sensitive data it is able to detect.”
And just how much attention is spent making that work well? Or is that really just an afterthought with no ongoing improvements so that they can say they tried?
Tangentially related, the government publishing my address whatsoever really upsets me. Voter records, property records, the DMV, and the USPS all in some way publish or sell citizens' addresses to private companies. I do not know why this is legal. I do not want anyone outside of the government knowing my address.
Sure, but the USPS is not a government-owned corporation (like Amtrak), it was made an "independent agency" of the US executive branch back in July 1971, over half a century ago; under Nixon [0].
The head of the USPS (Postmaster General, currently Trump appointee Louis DeJoy) reports to the Board of Governors [1] (9 governors + PG + Deputy PG) who are nominated by the President; the PG can be removed by an absolute majority of the board. The USPS is overseen by the Office of Inspector General (USPS-OIG), current head Tammy Hull [2] and has a "hotline" (actually a web form) for reporting complaints [3] which fall under its focus areas, which includes fraud, computer crime and employee misconduct. Seems like one place to start.
For previous 2022 discussion of controversies involving Postmaster General DeJoy and what it would take to remove the PG, see [4].
The PG has no term limit but most recent PGs averaged ~5 years. Historically it wasn't seen as a partisan appointment and wasn't replaced when an incoming President changed to the other party.
Because we have failed to adapt our laws sufficiently to keep up with modern networked computing realities. And it is more profitable in the short term (the short term is ending, right about now, in my opinion) to continue to not update our laws.
We are going to start to see productivity drop at some point (now) from all of the corruption and inefficiencies that are stacking up to pay for said short-term profits.
Lots of places have the ad/tracker code in paths that can't handle the error correctly. Like, they always think the object they need is there (window.google.tag or whatever).
We need to educate the Journeymen in the game to use try/catch and other methods so the hot-path don't die.
Not sure about the illegal part but, for sure a failure in test cases.
Tracking pixels are just insane. I can't imagine a non-regulatory/legislative solution when the biggest companies on the planet will pay you money just to put a script on your page. How does that get outcompeted? Someone richer pays you to not sell out your users? Just ban this shit.
I don’t get it. Thought tracking pixels were just for unsophisticated websites and those who wanted to track people across different sites.
USPS has an authenticated page where they know their customers. Why wouldn’t they just analyze THEIR OWN logs instead of relying on third-party advertising companies?
Pixels aren't pixels, oddly enough, it's marketing jargon for cross-site tracking, which way back when was accomplished by pixels. So even relatively sophisticated analytics platforms are still "pixels". I don't like it either.
The USPS wants to know which of their ad campaigns is successful, and want to be able to target advertising, so they embed their advertising platforms' Javascript in their site. That part seems reasonable for a government agency that's required to self-fund. The problem is either that the tracking was on pages that shouldn't have had it, or that it wasn't restricted in what it could send to the analytics platforms.
This may sound hyperbolic but I think the US is a failed state. Humanity is facing a mess because the hegemony is falling apart in the hands of extremely incompetent leadership. Generations of nepo-babies have led to incompetency. In very simple terms: today's rich are stupid.
When I moved a year ago, I didn't file an address change. I only gave it to my bank and a few others I needed to keep informed of my address. Almost none of the junk from my old address has followed me to my new address. One annoying exception has been the DMV in my new state informing the Secretary of State in my old state that I surrendered my old state's license for one in my new state. The SoS sent me a letter asking if the move was permanent or not because if so, they wanted to remove me from my old state's voting roll. I understand the desire to keep voting rolls clean but I'm not happy that this happened behind my back. Plus before I moved, I went to the SoS's site for my old state and informed them that I was moving and should be removed. I'm guessing they get a feed from other states and just mail everyone without checking if you've already been removed. Given the general incompetence of the SoS in my old state, it's probably just a matter of time before they leak out my new address to interested parties. I haven't registered to vote in my new state and unregistered in my old state so it's not like I'm trying to double vote or even vote at all.
Wait until you hear that the USPS scans the front and back of every piece of mail that passes through its high-speed scanners, stores it for an unknown period of time, and makes those records available to law enforcement.
Those images are part of their 'informed delivery' service which you can sign up for.
I've noticed on a number of occasions that the contents of the envelope were noticeable without enhancement and legible with simple contrast/level adjustment.
[+] [-] vzaliva|1 year ago|reply
Of course, it's terrible from a privacy point of view, but let's be honest and call things as they are.
[+] [-] Terr_|1 year ago|reply
I had to work on a feature like that, where individual client-companies wanted to sprinkle arbitrary pixel-trackers across different steps in our website's workflow for their users... Even today, I still worry I wasn't paranoid enough.
_______
For the curious/critiquing: When conditions are met, the main page JS creates a temporary <iframe src="..." sandbox="allow-scripts allow-same-origin">, and the destination URL (signed, time-limited) instructs a different subdomain to host up the icky arbitrary markup.
Yes, I know about the srcdoc attribute, and that would have been much easier except it breaks some tracker-code. In particular, Google Tag Manager silently stopped working, and it was because it contained some logic looking for "real site" aspects. This affected both `srcdoc` and also confused things when testing with `file://` URLs.
[+] [-] segasaturn|1 year ago|reply
[+] [-] gwerbret|1 year ago|reply
You needed to read through to the end of the article. TechCrunch did its own testing and confirmed that the mentioned sites were scraping data from the USPS, including but not limited to the postal addresses. The negligence that allowed USPS to leak such information in the name of analytics or whatever it is they were gaining from Facebook et al. is unconscionable, and USPS are very much responsible, just as they would be for a trivial hack with the same effect.
[+] [-] ysacfanboi|1 year ago|reply
[+] [-] dtgriscom|1 year ago|reply
I pointed out to him that advertising an unrelated company in his corporate emails was tacky, but even worse there was a tracking pixel in the email, clearly specific to him. So, any time someone opened one of his emails, WiseStamp would know.
He removed it immediately.
[+] [-] dreamcompiler|1 year ago|reply
We don't actually know that. What we know is that they said they didn't share anything intentionally. But there is almost no penalty for lying about such things and the USPS is desperate for money, so I don't think it's impossible that some USPS person made an under-the-table deal with Meta or another company to add this stuff to its website in exchange for a kickback. Only a detailed audit would be able to find out the truth, and that seems unlikely to happen unless Congress gets upset about the issue.
[+] [-] not_wyoming|1 year ago|reply
Top post: Title is clickbait, driver didn't kill pedestrian on purpose.
Pedestrian: <is dead>
[+] [-] DevKoala|1 year ago|reply
[+] [-] 1vuio0pswjnm7|1 year ago|reply
USPS customers have no recourse so arguably intent is irrelevent anyway.
[+] [-] rahimnathwani|1 year ago|reply
[+] [-] g15jv2dp|1 year ago|reply
[+] [-] YeBanKo|1 year ago|reply
[+] [-] nkrisc|1 year ago|reply
Doesn’t really seem like clickbait to me.
[+] [-] muteh|1 year ago|reply
[+] [-] rkagerer|1 year ago|reply
"Everyone else does it" is not a palatable excuse.
These companies are known for having user-hostile, privacy-invasive reputations, so as developers we should by default be wary of them.
E.g. Including a Facebook "Like" snippet on your page lets them siphon all sorts of data from your visitors, particularly if the user hasn't logged out of their Facebook account. It's not how users expect the web to work, and it's an insidious technique (they're deliberately taking advantage of thousands of unwitting webmasters who don't understand the baggage that snippet comes with). More examples here: https://www.consumerreports.org/electronics-computers/privac...
Frankly, even if USPS was unaware, the data still ended up in those third party hands via their services so as far as I'm concerned, yes, they did facilitate the sharing of said data. At least they plugged the hole once it was pointed out to them.
[+] [-] username135|1 year ago|reply
[+] [-] colinstone|1 year ago|reply
[deleted]
[+] [-] throawayonthe|1 year ago|reply
[deleted]
[+] [-] AustinDizzy|1 year ago|reply
This is the real reason why TikTok is a national security risk. Their ad platform, widely used by Shopify, Adobe, Segment, WooCommerce, etc., collects intimate data on non-TikTok users: prescriptions, medical appointments, loan applications, credit card details. Millions who'll never use TikTok, Facebook, etc. are still subject to this data collection in the name of "converting users to customers".
https://abs.codes/blog/2024/03/tiktoks-all-seeing-eye-survei...
At the policy level, we urgently need a national data privacy act to address these types of systemic issues. At the technology level, things like zero-knowledge advertising could mitigate a lot of the user privacy risk.
[+] [-] alsetmusic|1 year ago|reply
Seems pretty convenient to blame the people using the tool.
> Our system is designed to filter out potentially sensitive data it is able to detect.”
And just how much attention is spent making that work well? Or is that really just an afterthought with no ongoing improvements so that they can say they tried?
[+] [-] tqi|1 year ago|reply
[+] [-] unknown|1 year ago|reply
[deleted]
[+] [-] zelphirkalt|1 year ago|reply
[+] [-] carom|1 year ago|reply
[+] [-] smcin|1 year ago|reply
The head of the USPS (Postmaster General, currently Trump appointee Louis DeJoy) reports to the Board of Governors [1] (9 governors + PG + Deputy PG) who are nominated by the President; the PG can be removed by an absolute majority of the board. The USPS is overseen by the Office of Inspector General (USPS-OIG), current head Tammy Hull [2] and has a "hotline" (actually a web form) for reporting complaints [3] which fall under its focus areas, which includes fraud, computer crime and employee misconduct. Seems like one place to start.
For previous 2022 discussion of controversies involving Postmaster General DeJoy and what it would take to remove the PG, see [4].
The PG has no term limit but most recent PGs averaged ~5 years. Historically it wasn't seen as a partisan appointment and wasn't replaced when an incoming President changed to the other party.
[0]: https://en.wikipedia.org/wiki/United_States_Post_Office_Depa...
[1]: https://about.usps.com/who/leadership/board-governors/
[2]: https://www.uspsoig.gov/
[3]: https://www.uspsoig.gov/hotline
[4]: "Can Biden fire US Postmaster General Louis DeJoy?" https://www.federaltimes.com/federal-oversight/2022/08/24/ca...
[+] [-] russianbandit|1 year ago|reply
[+] [-] ysacfanboi|1 year ago|reply
[+] [-] jondwillis|1 year ago|reply
We are going to start to see productivity drop at some point (now) from all of the corruption and inefficiencies that are stacking up to pay for said short-term profits.
[+] [-] bredren|1 year ago|reply
They sell that information. Or license it. Or whatever they call it when they are holding booths at advertising and marketing trade shows.
You want to fill out a temporary change of address, renew it the one allowable time and then ghost USPS.
By then you should have updated your personal and business contact info with any group you care about.
USPS is one of the largest distributors of spam in the United States.
[+] [-] djbusby|1 year ago|reply
We need to educate the Journeymen in the game to use try/catch and other methods so the hot-path don't die.
Not sure about the illegal part but, for sure a failure in test cases.
[+] [-] nullc|1 year ago|reply
[+] [-] digging|1 year ago|reply
[+] [-] falqun|1 year ago|reply
[+] [-] BobbyTables2|1 year ago|reply
USPS has an authenticated page where they know their customers. Why wouldn’t they just analyze THEIR OWN logs instead of relying on third-party advertising companies?
Was this really an accident?
[+] [-] wlonkly|1 year ago|reply
The USPS wants to know which of their ad campaigns is successful, and want to be able to target advertising, so they embed their advertising platforms' Javascript in their site. That part seems reasonable for a government agency that's required to self-fund. The problem is either that the tracking was on pages that shouldn't have had it, or that it wasn't restricted in what it could send to the analytics platforms.
[+] [-] smolder|1 year ago|reply
[+] [-] XCSme|1 year ago|reply
When you order, you enter their own address and name, so neither the delivery company, nor the web shop, have your details.
[+] [-] grendelt|1 year ago|reply
[+] [-] kvetching|1 year ago|reply
[+] [-] troupo|1 year ago|reply
Shit like this is the only "uncertainty"
[+] [-] moomoo11|1 year ago|reply
I didn’t do it once when I had a short stint and that addrsss isn’t leaked…
[+] [-] tbyehl|1 year ago|reply
https://postalpro.usps.com/mailing-and-shipping-services/NCO...
[+] [-] Mountain_Skies|1 year ago|reply
[+] [-] bobmcnamara|1 year ago|reply
[+] [-] soygem|1 year ago|reply
[+] [-] KennyBlanken|1 year ago|reply
Those images are part of their 'informed delivery' service which you can sign up for.
I've noticed on a number of occasions that the contents of the envelope were noticeable without enhancement and legible with simple contrast/level adjustment.
[+] [-] xyst|1 year ago|reply
Still it’s a major oversight on their part. I wonder if the tracking pixel is loaded as part of “social login” or “social media integration”.
Yet another reason I don’t use that shit, and heavily block them across all sites.
[+] [-] ranger_danger|1 year ago|reply
[+] [-] unknown|1 year ago|reply
[deleted]