Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Get a list of your Amazon purchases and see what you can sell them for

shelfflip.com

Post reply on HN
Print view View original

81–90 of 108 posts

Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for

#81

Post by jngreenlee »

schrodinger wrote: post #76
jngreenlee wrote: post #73

Earlier quoted context omitted.

Can you briefly explain how to analyze for that, using non-dev tools like Chrome Inspector? I used 'Inspect Element', but found 'Post' on the popup form:

http://i.imgur.com/06580e9.png This is from chrome developer tools, network tab

So its POST to their server, then GET is generated to AMZ, if I understand correctly?

Also, would you say chrome developer tools is the lightest/most accessible way for the general public to inspect for such a thing?

EDIT: TY, schrodinger. That turned out to be a tab in Dev Tools that I just hadn't dug into before. No need to install anything!

Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for

#82

Post by StephanKletzl »

schrodinger wrote: post #79
ChristianKletzl wrote: post #72

---UPDATE--- @everyone: Want us to email you as soon as we have a password-free way to import your purchases? (for example through csv import) Shoot me an email to christian@shelfflip.com (subject: "shelfflip passwordfree")

You should really do the right thing and takes this down until then.

We offered a password-free option but it was too complicated (and thus, the users preferred the current option). We'll likely add the other option in the future (but only as an addition to the current option).

Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for

#83

Post by schrodinger »

jngreenlee wrote: post #81
schrodinger wrote: post #76

Earlier quoted context omitted.

http://i.imgur.com/06580e9.png This is from chrome developer tools, network tab

So its POST to their server, then GET is generated to AMZ, if I understand correctly? Also, would you say chrome developer tools is the lightest/most accessible way for the general public to inspect for such a thing? EDIT: TY, schrodinger. That turned out to be a tab in Dev Tools that I just hadn't dug into before. No need to install anything!

It seems the form submit is being cancelled by the "return false" in the onsubmit, meaning that the form won't be posted normally and that method="post" irrelevant.

The connect_amazon2() must be making the GET request.

Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for

#84

Post by martingordon »

jngreenlee wrote: post #81
schrodinger wrote: post #76

Earlier quoted context omitted.

http://i.imgur.com/06580e9.png This is from chrome developer tools, network tab

So its POST to their server, then GET is generated to AMZ, if I understand correctly? Also, would you say chrome developer tools is the lightest/most accessible way for the general public to inspect for such a thing? EDIT: TY, schrodinger. That turned out to be a tab in Dev Tools that I just hadn't dug into before. No need to install anything!

Using the Chrome Dev Tools, you can record the network requests that occur using the Timeline tab.

It's actually using GET to their server and something unknown to Amazon (that would most likely be server to server and not accessible over Javascript).

Although the method on the form is POST, it has an onsubmit handler which calls the connect_amazon2() JS function (which makes a GET AJAX request on line 311) and then returns false, preventing the form from being submitted.

Yes, the Chrome Dev Tools are probably the easiest way to take a look at this type of information. I actually used Safari, but Chrome's tools are much easier to use.

Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for

#86

Post by schrodinger »

StephanKletzl wrote: post #82
schrodinger wrote: post #79

Earlier quoted context omitted.

You should really do the right thing and takes this down until then.

We offered a password-free option but it was too complicated (and thus, the users preferred the current option). We'll likely add the other option in the future (but only as an addition to the current option).

You should be prepared for Amazon to block requests from your servers. (And I think this would be the right thing for them to do)

Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for

#87

Post by pdabbadabba »

schrodinger wrote: post #71
pdabbadabba wrote: post #10

Earlier quoted context omitted.

Agreed. My understanding is that having your password does not necessarily allow someone to see your CC number or order things on your behalf through Amazon, but it definitely does not seem like a best practice to go around handing out one's Amazon password. This sort of thing sounds like a good argument, though, for Amazon's implementing the sort of fine-grained permissions (in conjunction with a federated authentic…

How could having your password not allow someone to order things on your behalf? All I need to get into my account is my password, and then I can order anything I want.

Fair point. They can order things on your behalf, but cannot easily order things for THEMSELVES on your behalf since they can't enter a new shipping address without reentering the card number. But that doesn't totally eliminate the risk. They could be prepared to swipe the stuff off your porch when it's delivered (since they could predict when this would be) or they could use their power to simply harass you.

Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for

#88

Post by MichaelGG »

ChristianKletzl wrote: post #12
balor123 wrote: post #8

Maybe get the purchase history another way? Use the new Gmail API to search for the Amazon emails. Could easily extend to other stores as well.

Great idea. We have that actually implemented, but are currently not displaying it. Unfortunately people are even less likely to give a website access to their emails, since this often means giving access to pretty much everything (through "I forgot my password" emails)

Amazon has order reports, do they not? Why not just allow importing of that?

Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for

#90

Post by galvan »

epaladin wrote: post #51
georgemcbay wrote: post #44

Earlier quoted context omitted.

The second one is possible with nothing other than an Amazon order number and some human social engineering; earlier this summer I got hit with someone who gained access to my Amazon order number for an Xbox One (I assume this happened because I was recycling my physical Amazon pack-in invoices [which included the order number] without shredding them), that person chatted with an Amazon CSR and got them to send a rep…

Thanks for the tip on that attack vector- guess I should be shredding those invoices then.

It gets worse: attackers don't even need the paper invoices - at least in 2012, they were social engineering them directly out of Amazon CSRs [0].

[0] http://www.htmlist.com/rants/two-for-one-amazon-coms-sociall...

Post reply on HN