Hacker News Reader

Comment by FredFS456 | Hacker News Reader

Mullvad accepts cash in an envelope with no return address, good luck tracing that

Postal mail has non-zero metadata, e.g. origin can be traced at least to departure postal code.

Departure postal code could be an area with like 1 million people. And if it is a nation state I am sure they could send the mail from another country.

Most populous US zip code is less than 150K people, https://worldpopulationreview.com/zips

I mean, even if I live in Manhattan, I can easily take a subway train to an area with a different zip code and mail it there. And that's almost the easiest thing you could do -- if you want to hide where the mail is from, it is trivial.

Dense urban areas are often blanketed by a range of spectrum sensors for the purpose of retroactive correlation (e.g Palantir) with other metadata sources.

You seem to assume Mullvad stores something that allows correlating a Mullvad account to a specific incoming envelope.

Or that they store something that allows correlating an IP+time to a Mullvad account.

Correlation is about combining metadata to incrementally narrow datasets.

When a VPN provider isn't cooperative, metadata can be sought upstream.

Mullvad deserves much credit for accepting non-digital payments, which increases the cost of deanonymization.

There's... actually very little that stops you from sending mail from a non-local postal code.

I've occasionally sent packages postmarked as being from one zipcode from another; as long as it's in the same region, much of the postal processing doesn't care so much.

There's also remailers and forwarders.

How do you do that? Walk up to the postal counter, ask them to postmark it, then ask for it back, drive to another post office and slip it in their outgoing pile?

Semi-Presorted post can be acquired pretty easily. Places like Shippo and PirateShip offer it. As long as you put enough money into the postage paid, the post office doesn't really give a shit if it comes out of somewhere weird. There is no requirement that "return address" and "sent from" area are the same so long as they're within the same postal zone.

This is why AMZN packages have a return address in Vegas or similar sometimes.

Reply on news.ycombinator.com