back to article NeoPost: This is how you DON'T do PIN security

There is something very proper about the Royal Mail. It has the word “Royal” in it after all, reassuring users of the postal service's integrity. You particularly wouldn’t want anyone stealing postage, so a franking machine has to be super secure – which is perhaps why my shiny new machine from NeoPost needs three PINs. …

COMMENTS

This topic is closed for new posts.
  1. Lee D Silver badge

    Frankly (haha!), most franking machines are a pain in the butt. Everywhere I've used one it still dials up over PPP to top-up and you can happily top-up hundreds of pounds each time (I believe it just gets invoiced, but I don't really care).

    The ink-cost alone is probably wiping out a lot of the savings of franking mail, not to mention the hassle of keeping analogue lines around, or buying the start-of-the-art Ethernet ones and supplying power/sockets/Internet to them.

    To be honest, the largest use of them I see if to print pretty postmarks, not to save any money. And it's one hell of an expensive post-mark when the inks are nothing but an old HP deskjet cartridge with some knobs on to stop you cloning them (literally, I recognise the casing / head layout).

    If I ran my own company, I'd say sod it and go to CostCo and bulk-buy stamps and stick them on. By the time you pee about weighing the item, feeding it through, correcting paper jams, replacing inks, topping up, etc. you might as well just lick a stamp.

    And if urban myth is correct, bulk-buying of stamps is a good way to beat inflation...

  2. Phil W

    Errors

    While I can tell from the article that clearly this device, it's manual and the supplier are a bunch of useless idiots, there are some flaws in your complaints.

    Media is a perfectly common term for a physical data connection between devices, it certainly is used in a variety of areas of networking for instance Cisco switches differentiate between RJ45 and fibre interfaces with a property called "media-type". Obviously this device isn't intended for use by network technicians so more care could have been taken in the wording, but it is a perfectly valid term.

    As for the credit charges of 3%, this is no surprise many many companies charge 3% on credit cards and I beleive the larger companies that don't are absorbing the cost rather than getting a better deal from their payment handler. You may find that there is a lesser or no charge for debit cards as opposed to credit cards, as the handling charges from payment providers tend to be lower and are often a fixed fee per transaction as opposed to a percentage of each transaction.

    1. Tom Wood

      Re: Errors

      No, 3% is steep. Paypal's publicly-listed fee for the highest volume customers is 1.4%+20p. I expect that (1) you can get cheaper than Paypal and (2) even bigger customers can negotiate lower rates.

  3. Anonymous Coward
    Anonymous Coward

    Ink is expensive

    So have one Neopost cartridge to put in the machine when the maintenance engineer calls, and use significantly cheaper compatibles that you buy off other suppliers.

    To be honest, the engineer probably isn't that bothered if there is a refilled cartridge in there, and the refillers know they will only get repeat orders if the quality of the refills is adequate. There is a lot of ink in one of the cartridges (we're not talking Canon or HP here) so the cartridge cost is probably a small element of your postal costs compared to the franking machine itself or the franked amount.

    1. Anonymous Coward
      Anonymous Coward

      Re: Ink is expensive

      Can you use another's ink? I thought that the cartridges contain a digital signature.

  4. William Donelson

    No no no. You don't understand.

    The purpose of this nightmare is to secure the JOB of the neoPost tech staff

  5. Simon Rockman

    Using other cartridges

    When I gave Neopost the right of reply on the piece it hinted that there was no issue with third party ink but stopped (just) short of recommending it.

    As an exercise I worked out that if I filled the fuel tank of a £300,000 Lamborghini Aventador with printer ink bought at Neopost's prices the ink would cost more than the car.

    The Neopost jargon for a printer cartridge is "headset". Neither the word "media" or "headset" are used in the knowledgebase.

  6. davidp231

    Security by obscurity?

  7. Anonymous Coward
    Anonymous Coward

    Why?

    Couldn't you just get some software that'd print a frank in the correct position, and let you feed your envelopes through a printer? And like, manage all the accounting for you at the same time? Why the need for a custom machine and the complete clusterfuck attempt at security?

    1. Anonymous Coward
      Anonymous Coward

      Re: Why?

      "Why the need for a custom machine and the complete clusterfuck attempt at security?"

      Because this is the Post Office. The same people who think that having a retail outlet closed for 75% of the weekend is just fine, the same people who moved away from weight as a means of pricing to complex user unfriendly mix of weight and various combinations of all dimensions so that nobody has a ****ing clue about the cost of postage until they get to the post office, the same people who charged so much that Amazon now use any crummy fourth rate courier they can find because the post office are uncompetitive, the same people who like to have ever expanding lists of things that are supposedly too dangerous for them to carry, the same people who slashed their already derisory standard levels of compensation for lost or damaged post, the same people who seem to put all parcels marked fragile in the drum of a cement mixer for four days before (maybe) delivering it. And the same ****s who now charge over twelve shillings to post a small letter first class.

      1. graeme leggett Silver badge

        Re: Why?

        No, it's the Royal Mail. The Post Office is a significantly different entity.

        And the "complexity" of the postal charges is why you get a franking machine if you have a large enough volume. And if you do have a franking machine you pay only 10 shillings for a 1st class letter.

      2. Shoot Them Later

        Re: Why?

        I'm absolutely with you Ledswinger, bar one detail... The basket case that you describe is now Royal Mail. The Post Office is the branch network, the bit that Gideon and Vince didn't flog off at well below market value to their banker mates.

        You can tell what level priority 'Mail' has now for the Post Office by the fact that it appears at item 5 on the tabbed list on their home page, sandwiched between 'Broadband' and 'Driving'.

      3. Alex McDonald 1

        Restricted Items

        According to the nice letter the Royal Mail put into the bag that contained a present from my sister, aftershave is considered "restricted goods". The parcel went from Westmisnter to Stanstead, got flown to a sorting office in Belfast(!), was opened (including the card in an envelope), was declared safe, got flown back(!), sent to Edinburgh and arrived with me 2 weeks later with one of these attached; http://www.postoffice.co.uk/sites/default/files/Example-ID8000-Label.pdf

        What for? Can anyone enlighten me?

        Nice smells though.

    2. graeme leggett Silver badge

      Re: Why?

      There is Royal Mail "Online Postage" for doing it through the web.

    3. jonathanb Silver badge

      Re: Why?

      Yes, it is called "SmartStamp", however they are not currently accepting new customers.

  8. Gene Cash Silver badge

    Errr....

    You could just send the bloody thing back. Cheaper than throwing an expensive piece of equipment against the wall and the end result is the same.

    Me, I just got $300 worth of "forever" stamps a couple years back.

    1. Skoorb

      Re: Errr....

      Yup. And then go use someone like TNT Post or one of the other 11 large postal operators, now that we live with a fully deregulated postal market.

      If you are too small for you to be worth their while, Hybrid Mail and couriers like CollectPlus and MyHermes for the parcels are worth looking into.

  9. Anonymous Coward
    Anonymous Coward

    Have you tried setting up favourites for your most common postage options yet? If so enjoy - it's an exercise in pulling teeth, which next time time rates change inevitably stop working - but rather than helpfully saying "this postal rate is no longer valid" they just decide to display the wrong amount. Wouldn't be so bad if you could connect via the ip address and change them in a web UI (like most printers have allowed you to do for a decade) but no you've to use it's awful, non backlight but very reflective display....

  10. Terry 6 Silver badge

    insecurity by complexity

    And on top of all that, there's still the matter that if you make security too complex for ordinary users they will undermine it for the sake of getting on with the job.

    (I bet there are still plenty of offices with passwords by Post-it. And of course the shared password that everyone uses 'cos only one person knows one - he's probably the guy with the Post-it notes)

  11. Androgynous Cupboard Silver badge

    Hooray

    When you're done with this article, perhaps you could ask my bank why a password to protect the "one time pad" that is my phone is necessary when I'm already entering a perfectly good password on their website? Or ask my other bank why, after entering my password, it now wants me to choose a second password which I can use "when you don't have your bank token". What's wrong with the password I just entered?

    If one password is good, two must be better, and three better still! It's the Gilette/Schick razor blade race all over again.

  12. Darryl

    All I can say is it's good to see that Canada Post isn't the only post office in the world that seems to go out of their way to make things as difficult as possible.

  13. Alex Brett

    I'm not sure how the pricing compares (if it's more I don't see any reason for it since presumably the mail is handled in the same way within RM), but there's always Smart Stamp - couple it either with a decent label printer or a printer that can feed envelopes (not sure if such a thing exists?), and that's probably a lot simpler than most franking machines...

    1. graeme leggett Silver badge

      Franking for a 1st class "letter" is 50p, large letter is 76p, SmartStamp is 62p and 93p respectively

      For a 2nd class letter its 37p against 53p

      1st class small parcel (up to 1kg) is £2.90 franked and £3.20 by SmartStamp

      One other advantage of a franking machine is the rate it can stamp/frank the post. With an IS350 you can 30 or more letters through a minute. Now if you could buy stamps on reels, you could probably make some sort of "pricing gun" device and get a similar speed.......

      1. jonathanb Silver badge

        We do practically everything by email now. I've only sent one dead-tree letter in the last three months, and sticking a stamp on it was probably easier than remembering how to use a franking machine that has been sitting idle for ages.

        1. Simon Rockman

          Use email

          My target customers are older users. They send cheques and often don't have email.

          Even when I can sell from the website and they do have email I'm selling mobile phones so at some stage something has to be posted.

          Simon

      2. Chris G

        Post Office regression

        I am sure when I worked at Moody's Services in the '60s the franking machine was churning out at least one a second. We used to send out share yield and return information by 4-o-clock on the day it was released, to subscribers numbering in their hundreds, I remember the envelopes flying out of the machine in the post room.

        Something else I remember, the price you quote for franking a large letter is how much I used to earn for a week's work doing a paper round 15/- !

        Scary ain't it?

  14. Tom 13

    I mean, you wouldn’t be doing this just before the post has to go, would you?

    Not if you've been employed in the workforce for more than 6 months you wouldn't. These are exactly the sorts of issues you'd EXPECT to encounter. And yes, I do think the people who make these things are frustrated wanna be Zork game designers.

  15. Simon B
    Mushroom

    Thank your lucky stars you didn't choose PITNEY BOWES !!

    Putting account on stop for non payment (ummm, you remember that direct debit you filled in? we chose not to use it),

    Charging the incorrect amount for topping up, EVERY time after a constant YEAR of telling us OVER and OVER and telling you OOPS sorry we'll fix that, EVERY time (yawn),

    Charging £59.95 EVERY time royal mail changes their rates (it's expensive downloading a small file down the phone line containing a few humbers you know!).

    Low battery on your machine? How to change the battery ... Here, have a REFURBISHED MACHINE, now box and drag the old machine to the post office so we can have it back. Changing a battery is extremely difficult and requires great expertise, a simple coin battery holder in a slide out drawer was not designed into the machine to save the user this extremely complicated task .... oh dear, we're billing the incorrect amount for topping up since you have a machine with a different serial number now, silly us!! (yes, really!!)

    Make sure you have the right account number, is it the one for the monthly DD, the one for topping up, or the purcashe power one? We have 3 account numbers because ... well, because we're clever! Be silly to hsve one account number related to your one account.

    I'll end it there, safe to say PITney bowes ARE the PITs. Roll on renewal time!

    1. Fatman

      RE: Thank your lucky stars you didn't choose PITNEY BOWES !!

      I used to call them

      PITNEY BLOWS,

      and that was me being nice about it.

  16. James Howat

    Why are they called PINs at all?

    I know this isn't the point of the article - but if one number is the same for all machines, and the other two might be the same for all machines, but are certainly for the machine only, and one-time at that, they're not Personal Identification Numbers at all, are they?

    They don't confirm the identity of an individual at all.

    1. chris lively

      Re: Why are they called PINs at all?

      I guess you simply aren't aware of just how many words and acronyms are constantly misused in the English language. The following was written over 60 years ago, and is still very much appropriate: https://www.mtholyoke.edu/acad/intrel/orwell46.htm

This topic is closed for new posts.

Other stories you might like