Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon's customer service backdoor

medium.com

Post reply on HN
Print view View original

251–260 of 366 posts

Re: Amazon's customer service backdoor

#251

Post by noja »

andrewaylett wrote: post #243
iopq wrote: post #185

Earlier quoted context omitted.

Passwords are also security by obscurity.

Not really -- security by obscurity is a re-statement of the idea that the security mechanism shouldn't need to be secret for the security to have meaning. You're allowed to have secret data, just not secret mechanism. And relying on what looks like secret data (changing the SSH port) where the number of bits of entropy is low enough that it's plausible to try them all (16) probably still counts as security by obscur…

> but it's not enough to make you secure.

That's not why you change the ssh port at all.

You change the ssh port to filter out false positives, if someone is attacking you on your weirdo ssh port, it's likely an actual attack that you need to pay attention to. You still need to do the rest of the security stuff.

Re: Amazon's customer service backdoor

#252

Post by jcrawfordor »

Anechoic wrote: post #199
Pyxl101 wrote: post #161

Earlier quoted context omitted.

USPS now supports a feature called "street addressing". Basically, instead of writing "PO Box #" as the address, you may write the actual street address of the same facility followed by your box number, something like "123 Main St #456". Private mailbox providers also often accept addresses like "123 Main St Apt 456", where 456 is the number of your mailbox as well.

USPS now supports a feature called "street addressing". Keep in mind that street addressing doesn't work at all USPS locations, although it does work at most of them. You have to fill out a form with USPS or any mail addressed to that location will be returned as undeliverable.

I've found private mailbox providers to be preferable in most every way to post-office PO boxes. Private providers are "street addressed" to begin with, virtually always accept from all couriers, usually have longer hours, often can call or email you when you receive a package, etc. In most cities, there are also more of them than post offices, I suspect because it's such an easy business to start. Look around your neighborhood: copy/print shops, shipping stores, and small business supply stores probably also rent mail boxes.

I wish this was an industry with a bit more visibility. When you think about renting a "PO Box", there's a good chance that you'd be better off with a box rental from a private mail service.

Re: Amazon's customer service backdoor

#253

Post by fanf2 »

bigiain wrote: post #101
detaro wrote: post #93

Earlier quoted context omitted.

Sadly, you can't even use PO boxes for all domains, some registries require a "full" address.

"The street finds its own uses for things." Where I am (Australia) theres a whole bunch of places that'll provide "non Post Office PO boxes" who're perfectly happy for you to address things to "Suite 306" or "Apartment 306" as well as "PO Box 306" at whatever address the box is located. Fools _most_ of the "must be a real address, not a PO Box" restrictions. (Interestingly StartSSL failed me on that once when I gave…

"Mailboxes etc." in the UK is a fairly widespread commercial PO box provider. I didn't realise that was their business until I found out about a local spammer using their Cambridge branch for their address :-)

Re: Amazon's customer service backdoor

#254

Post by richardwhiuk »

MertsA wrote: post #202
andrepd wrote: post #197

Earlier quoted context omitted.

Ssh ports are brute forceable, passwords have a much much larger search space.

At this point, 16 bits of entropy is more than the entropy of a lot of the passwords that I've seen.

You have 10 bits of entropy at best, unless you put it above 1024, at which point if it dies, any none privileged user on the box can sniff passwords.

Re: Amazon's customer service backdoor

#255

Post by imron »

D-Coder wrote: post #60
mdavidn wrote: post #46

Earlier quoted context omitted.

Fastmail and Gmail support a local suffix of the form yourname+amazon@gmail.com. That's a plus character between the local name and local suffix. If you use a password manager, you can replace a predictable suffix like "amazon" with random hex value. Unfortunately, many sites borked their e-mail address validation and do not accept the plus character. (Amazon permits it.) Also, you'll ocassionally find a customer ser…

Panix.com supports this, plus an alternate that works almost everywhere. You can use "whatever@yourname.users.panix.com", and it ends up in your inbox, filterable by the "To:" address. I create a new email address for every company I sign up with. (Satisfied Panix customer.)

Fastmail also supports something similar, with whatever@yourname.fastmail.com mapping to yourname+whatever@fastmail.com

Re: Amazon's customer service backdoor

#256

Post by breakingcups »

jdmichal wrote: post #179
rhblake wrote: post #145

Earlier quoted context omitted.

Ah... if you're a resident of Sweden, anybody can get your full name, address, date of birth, civil status, list of company engagements (e.g., board member, owner of a firm, etc.) and the make and year of any cars registered by going to one of several websites - http://www.ratsit.se/ being one of the most popular ones. No login needed. This information is public data straight from the government. (Exceptions: people…

Though, I would wager that very few Swedish companies consider any of that information as a "password", as seen in the article...

Overseas companies would though

Re: Amazon's customer service backdoor

#258

Post by simoncion »

mbrutsch wrote: post #175
danneu wrote: post #17

Whois is great for social engineering attackers. You get a name, email, address, and the first service to attack. Meanwhile, the ICANN is working around the clock to make it illegal for us to protect our personal information, and whois protection is becoming an increasingly niche service for registrars. For example, gandi.net (and thus Amazon) doesn't hide your name when you have it turned on. By the time you find th…

> For example, gandi.net (and thus Amazon) doesn't hide your name when you have it turned on. Well, yeah, I've been with Gandi for years, that's their published policy: https://www.gandi.net/domain/whois/ > By the time you find this out You realize you should have done your homework and read your registrar's policies beforehand? I understand your overall point, but don't make it sound like Gandi did anything wrong he…

I would have left this very comment if you hadn't beaten me to it. :)

Gandi is very up-front about every aspect of their services. I found out that Gandi's whois privacy doesn't hide the name you provide as the registrant long before I entered my credit card details to provide payment information.

Their whois privacy is structured in this way because for many (all?) TLDs ICANN requires that the entity listed as the registrant be the actual owner of the registered domain.

Re: Amazon's customer service backdoor

#259

Post by TeMPOraL »

VeilEm wrote: post #28
fps wrote: post #20

Earlier quoted context omitted.

I think the bigger problem is that public information like your name and address is sufficient for proving your identity. If we make whois information private, what about phone books, property records, direct mail databases, etc. etc.

If someone has your public name and address you're already at significant risk if you ever say anything controversial that gets attention. You're liable to being swatted, getting fake pizza orders, having people show up at your house, harassing you and much more. See Zoe Quinn, Brian Krebs, lots of less well known individuals, etc.

As a counterpoint, see billions of people every day.

This is getting to the point of paranoia at this point. You're already at significant risk if you ever say anything that gets attention by virtue of living in a society. But it comes with benefits, too...

Re: Amazon's customer service backdoor

#260

Post by [deleted] »

bigiain wrote: post #66
thephyber wrote: post #49

Earlier quoted context omitted.

Which only proves your comment's parent's point even more. {SWAT, pizza orders, etc} assume that the phone number that shows up on caller ID is authentication of the identity of the phone line on the other end. They could call back the number on caller ID to verify the original caller matched the person who picked up, but they don't. Having knowledge of a Social Security number was assumed to be authentication, but i…

Keep in mind too that Caller ID is trivially blockable (and blocked caller id isn't remarkable enough to be super suspicious), and it's also easily within the capability of many of the 4chan/gg griefers to spoof "correct" Caller ID numbers as well.

[deleted]
Post reply on HN