Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon admits it exposed customer email addresses, but refuses to give details

techcrunch.com

Post reply on HN
Print view View original

111–120 of 160 posts

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#111

Post by a_imho »

edoo wrote: post #12

When I started selling the first gadget I ever made on Amazon I was so excited and was only getting a couple sales a month. If you were one of my customers I looked at your house, judged your grass, found you on LinkedIn and Facebook, Instagram, mortgages, mugshots, everything lol. The sellers also get your full name and address even on fulfilled by Amazon. If you have been on the net long enough this will creep you…

If you have been on the net long enough this will creep you out: https://haveibeenpwned.com/

Checked with lol@gmail.com, you have to add 14 other 'l's (lolllllllllllllll@gmail.com) in order to result in a green good news. How can I validate the claims? I'm a bit skeptical seeing it doubles as a sales front for 1password.com.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#112

Post by edoo »

a_imho wrote: post #111
edoo wrote: post #12

When I started selling the first gadget I ever made on Amazon I was so excited and was only getting a couple sales a month. If you were one of my customers I looked at your house, judged your grass, found you on LinkedIn and Facebook, Instagram, mortgages, mugshots, everything lol. The sellers also get your full name and address even on fulfilled by Amazon. If you have been on the net long enough this will creep you…

If you have been on the net long enough this will creep you out: https://haveibeenpwned.com/ Checked with lol@gmail.com, you have to add 14 other 'l's (lolllllllllllllll@gmail.com) in order to result in a green good news. How can I validate the claims? I'm a bit skeptical seeing it doubles as a sales front for 1password.com.

It just cross references emails with public hack dumps. I have 7 listed breaches on sites with the email I've had forever. Those accounts didn't compromise my opsec in any way but it is interesting to see. The average person using the net for a while has some on there. It is an interesting tool. If someone is trying to hack you they might start there and see what your old passwords looked like.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#113

Post by eps »

edoo wrote: post #12

When I started selling the first gadget I ever made on Amazon I was so excited and was only getting a couple sales a month. If you were one of my customers I looked at your house, judged your grass, found you on LinkedIn and Facebook, Instagram, mortgages, mugshots, everything lol. The sellers also get your full name and address even on fulfilled by Amazon. If you have been on the net long enough this will creep you…

The exact same goes for PayPal.

We were routinely getting emails saying "I'm not comfortable sharing my CC info with you" (even though it goes through a processor), so ended up adding PP as an alternative. Guess what - now we get to see their full name and physical address, neither of which we need, because we sell software licenses. I'm guessing that people are more concerned with needing to deal with compromised cards than they are worried about over-sharing of sensitive personal details.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#114

Post by PuffinBlue »

kull wrote: post #103
kull wrote: post #62

This is how it looked for me: I few days ago I was shopping on Amazon and they showed me a message, you already purchased this product. See order details. I was surprised since I did not buy it before. After clicking the link, I was shown details of not my order, including name, address and email where a product was shipped to.

One thing I wanted to add is that I wanted to report this issue to Amazon right away, it was very concerning to me. So, I clicked Ctrl+F to search for "contact" then "support", I went quickly through a few drop downs on the navbar, and I found nowhere any indication I can easily contact Amazon support to report it. I moved on and forgotten about this. So many companies make it super hard to contact their support.

There's no big blaring 'contact us' button but it's not that hard to find.

In the footer is a link to 'help'. On the help page you just click 'need more help' and there's the contact us link.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#115

Post by buboard »

cyphar wrote: post #92
buboard wrote: post #64

Earlier quoted context omitted.

amazon doesn't have european headquarters

They do, so they can avoid taxes all over the world. Not only do they have an EU incorporated company, if you believe their tax filings their primary business is based in Luxembourg. This is obviously bullshit, and is done to avoid taxes, but they have structured their company in a way that makes them very much an EU company. If they weren't an EU company they couldn't take advantage of Luxembourg's tax laws. So it f…

you re right. The idea here is that luxembourg (or any country) would have to weigh any violations against their interests to keep amazon in their territory.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#116

Post by ionised »

kodablah wrote: post #48
danielor wrote: post #47

Hmm... it seems this drip of bad news in big tech is setting up for some heated debates on regulation. It will be interesting how proactive the Europeans are with GDPR.

"Goal accomplished" - traditional media and anti-big-web-tech

Change the record.

Old media might have an axe to grind with big tech making them obsolete, but the cavalier attitudes of big tech companies are pissing off a LOT of people.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#118

Post by superflyguy »

eps wrote: post #113
edoo wrote: post #12

When I started selling the first gadget I ever made on Amazon I was so excited and was only getting a couple sales a month. If you were one of my customers I looked at your house, judged your grass, found you on LinkedIn and Facebook, Instagram, mortgages, mugshots, everything lol. The sellers also get your full name and address even on fulfilled by Amazon. If you have been on the net long enough this will creep you…

The exact same goes for PayPal. We were routinely getting emails saying "I'm not comfortable sharing my CC info with you" (even though it goes through a processor), so ended up adding PP as an alternative. Guess what - now we get to see their full name and physical address, neither of which we need, because we sell software licenses. I'm guessing that people are more concerned with needing to deal with compromised ca…

Why would anyone care if you had their address, or email address? Why would Amazon be interested in going into details about an email address leak? Outside of a handful of people who get excited by every leak no matter what, nobody cares. It's an email address. You get some more spam maybe? Big deal.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#119

Post by krageon »

a_imho wrote: post #111
edoo wrote: post #12

When I started selling the first gadget I ever made on Amazon I was so excited and was only getting a couple sales a month. If you were one of my customers I looked at your house, judged your grass, found you on LinkedIn and Facebook, Instagram, mortgages, mugshots, everything lol. The sellers also get your full name and address even on fulfilled by Amazon. If you have been on the net long enough this will creep you…

If you have been on the net long enough this will creep you out: https://haveibeenpwned.com/ Checked with lol@gmail.com, you have to add 14 other 'l's (lolllllllllllllll@gmail.com) in order to result in a green good news. How can I validate the claims? I'm a bit skeptical seeing it doubles as a sales front for 1password.com.

I've verified some of the reported breaches myself (from publicly available password dumps). It's not a 100% given that those matching means it's all good, but it's a pretty solid indication.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#120

Post by speedplane »

superflyguy wrote: post #118
eps wrote: post #113

Earlier quoted context omitted.

The exact same goes for PayPal. We were routinely getting emails saying "I'm not comfortable sharing my CC info with you" (even though it goes through a processor), so ended up adding PP as an alternative. Guess what - now we get to see their full name and physical address, neither of which we need, because we sell software licenses. I'm guessing that people are more concerned with needing to deal with compromised ca…

Why would anyone care if you had their address, or email address? Why would Amazon be interested in going into details about an email address leak? Outside of a handful of people who get excited by every leak no matter what, nobody cares. It's an email address. You get some more spam maybe? Big deal.

People care because it begs more questions. Why is Amazon leaking email addresses? What part of their system is unsecure? Can we trust Amazon at all?
Post reply on HN