Live data from Hacker News

Amazon admits it exposed customer email addresses, but refuses to give details

techcrunch.com

51–60 of 160 posts

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#51
post #2

This is one of the less appreciated clauses of the GDPR: That companies are required to disclose data breaches within a reasonable time-frame, and users have the right to know about any exposure of their data.

> This is one of the less appreciated clauses of the GDPR One wonders if this clause should have instead been its own, separate, narrowly focused legislation and enforced specifically as such.

Any particular reason? Seems like a reasonable thing for the GDPR to have.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#54

Earlier quoted context omitted.

> This is one of the less appreciated clauses of the GDPR One wonders if this clause should have instead been its own, separate, narrowly focused legislation and enforced specifically as such.

Any particular reason? Seems like a reasonable thing for the GDPR to have.

Same reason you might do a gradual refractor instead of a large software rewrite. The more narrowly scoped a piece of legislation, the more feedback and implementation/enforcement can be tailored to the satisfaction of all before increasing scope (or not if ineffective). In the GDPR's case, it superseded existing data protection legislation because of a somewhat opposite mindset: the scope/consequences/enforcement weren't large enough. Also, such size potentially dilutes differing priorities by lumping several goals together thereby marrying its implementation success/failure to the general success/failure of the overall legislation.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#55
post #9
post #6

Earlier quoted context omitted.

They intentionally provide this information to marketplace sellers. It's arguably poor design but it's definitely not an unintentional security flaw. Marketplace/FBA sellers have talked about strategies for utilizing customer email address for years [1] [1] https://sellercentral.amazon.com/forums/t/how-to-access-all-...

Also, your Amazon profile is public by default, especially any wishlists.

Wow. That's incredible. I would say this is completely against what I would assume the expected behavior would be.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#56
post #43

An email address isn't secret, is it? It's sent back and forth in clear text through any number of relay servers. I consider my name and email address to be basically public information. Along with (unfortunately) my Social Security number. If Amazon exposed any data fields more sensitive than email address, I would call that stonewalling/covering up as TC seems to be implying. But otherwise it kind of just sounds li…

[deleted]

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#57
post #43

An email address isn't secret, is it? It's sent back and forth in clear text through any number of relay servers. I consider my name and email address to be basically public information. Along with (unfortunately) my Social Security number. If Amazon exposed any data fields more sensitive than email address, I would call that stonewalling/covering up as TC seems to be implying. But otherwise it kind of just sounds li…

[deleted]

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#58
post #12

When I started selling the first gadget I ever made on Amazon I was so excited and was only getting a couple sales a month. If you were one of my customers I looked at your house, judged your grass, found you on LinkedIn and Facebook, Instagram, mortgages, mugshots, everything lol. The sellers also get your full name and address even on fulfilled by Amazon. If you have been on the net long enough this will creep you…

The Amazon store I ran when I worked for a VAR was the best lead generation tool the company I worked for had ever found. I sold a part that if you bought indicated to us that your annual IT spend was minimum 150K a year, and I sold dozens of these parts a week. Most companies have a customer acquisition cost, we got paid to get new customers.

It's super against Amazon's TOS for resellers to contact customers outside of Amazon controlled channels, but I never lost a lot of sleep over it, and dont think people were buying much 3PAR storage off amazon anyway.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#59
post #15
post #12

When I started selling the first gadget I ever made on Amazon I was so excited and was only getting a couple sales a month. If you were one of my customers I looked at your house, judged your grass, found you on LinkedIn and Facebook, Instagram, mortgages, mugshots, everything lol. The sellers also get your full name and address even on fulfilled by Amazon. If you have been on the net long enough this will creep you…

I can also confirm, I can still see names and addresses, but not emails. Honestly any online retailer has to be trusted with this information, and in the fulfillment by Amazon (FBA) case, there are 3rd party sellers that have some unnecessary access to it. I personally don't actually need access to it since I do FBA exclusively.

There used to be custom report you could run from one of the advanced dashboards that would still give you the email, it was called something unintuitive in the logistics category.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#60
post #37
post #20

Earlier quoted context omitted.

Might not be best idea to use exact word amazon, have gotten this email before - > use of Amazon trademarked words, images, or reviews which may include variations or misspellings and this is a violation of our Trademark Guidelines > [...] > An example of the above violation can be found here: amazon@[mydomain]

I would be surprised if that was enforceable, it sounds more like an effort to ensure they're proactive about their trademark.

Well it's certainly enforceable in that you won't be able to use it for your Amazon account. They are free to reject any email address they like.
Post reply on HN