Amazon's customer service backdoor

Post by [deleted] » Mon, Jan 25, 2016, 9:55 AM UTC

bigiain wrote: post #66

thephyber wrote: post #49

Earlier quoted context omitted.

Which only proves your comment's parent's point even more. {SWAT, pizza orders, etc} assume that the phone number that shows up on caller ID is authentication of the identity of the phone line on the other end. They could call back the number on caller ID to verify the original caller matched the person who picked up, but they don't. Having knowledge of a Social Security number was assumed to be authentication, but i…

Keep in mind too that Caller ID is trivially blockable (and blocked caller id isn't remarkable enough to be super suspicious), and it's also easily within the capability of many of the 4chan/gg griefers to spoof "correct" Caller ID numbers as well.

Post by thecopy » Mon, Jan 25, 2016, 10:09 AM UTC

mappu wrote: post #212

steve-howard wrote: post #167

Earlier quoted context omitted.

My school's student addresses ended in @u.northwestern.edu. You can imagine this was annoying sometimes when email addresses ending in .edu were used to verify student status.

>My school's student addresses ended in @u.northwestern.edu. You can imagine this was annoying sometimes when email addresses ending in .edu were used to verify student status. Sorry, could you repeat that? yourname@u.northwestern.edu certainly matches \.edu$. Unless you're worried about the false-positive for a non-student with a different subdomain?

Post by 0x01 » Mon, Jan 25, 2016, 10:13 AM UTC

TheOtherHobbes wrote: post #30

danneu wrote: post #17

Whois is great for social engineering attackers. You get a name, email, address, and the first service to attack. Meanwhile, the ICANN is working around the clock to make it illegal for us to protect our personal information, and whois protection is becoming an increasingly niche service for registrars. For example, gandi.net (and thus Amazon) doesn't hide your name when you have it turned on. By the time you find th…

A related word of warning: Namecheap updated their registration page last year. Now, when you register a domain it tells you free Whoisguard is included, but it doesn't make it clear that it's disabled by default." Previously it just worked. Now you have to check another box to turn it on. This change makes no sense to me. (If you want free Whoisguard, why would you not want it turned on?) I was white-hot furious* wh…

Post by rplnt » Mon, Jan 25, 2016, 10:15 AM UTC

thephyber wrote: post #49

VeilEm wrote: post #28

Earlier quoted context omitted.

If someone has your public name and address you're already at significant risk if you ever say anything controversial that gets attention. You're liable to being swatted, getting fake pizza orders, having people show up at your house, harassing you and much more. See Zoe Quinn, Brian Krebs, lots of less well known individuals, etc.

Which only proves your comment's parent's point even more. {SWAT, pizza orders, etc} assume that the phone number that shows up on caller ID is authentication of the identity of the phone line on the other end. They could call back the number on caller ID to verify the original caller matched the person who picked up, but they don't. Having knowledge of a Social Security number was assumed to be authentication, but i…

Post by kuschku » Mon, Jan 25, 2016, 10:16 AM UTC

_Codemonkeyism wrote: post #233

Amazon does not care. A fraudster used our startup bank account to pay at Amazon. We told them, they did not blacklist the user to use our account or take any actions beside removing the bank account (ours) from his Amazon account. The fraudster did this at least 3 times with increasing amounts of money. Amazon did not care. Only when we went to the police did this stop. Amazon sold me a phone, the box arrived empty…