Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon admits it exposed customer email addresses, but refuses to give details

techcrunch.com

Post reply on HN
Print view View original

131–140 of 160 posts

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#131

Post by rocqua »

CobrastanJorji wrote: post #110
aidenn0 wrote: post #82

Earlier quoted context omitted.

4. the machine that executes the code is ill-defined and will change far before the code you write is retired.

An program written in an ill-defined language being run by a malicious interpreter with an agenda would be a really interesting project in seeing how far you could twist the meaning of the original program.

I mean, snarky people might refer to 'optimizing compilers' using 'undefined behavior' in C.

There are some known issues of compilers eliding the zero-ing out of secret data. There is no portable way of enforcing this.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#132

Post by rocqua »

pmart123 wrote: post #55
ben509 wrote: post #9

Earlier quoted context omitted.

Also, your Amazon profile is public by default, especially any wishlists.

Wow. That's incredible. I would say this is completely against what I would assume the expected behavior would be.

It kind of makes sense for wishlists.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#133

Post by bhnmmhmd »

Raphmedia wrote: post #38
ProAm wrote: post #28

Earlier quoted context omitted.

> any online retailer has to be trusted Well that is down right crazy. Most sellers are people in their garages drop shipping 3PL. I'd trust them if they were background checked....maybe

The internet is based on trust. There is nothing stopping anyone that has an e-commerce website from recording a clear version of your passwords along with all of your billing address and credit card informations. There's no audits or anything.

> The internet is based on trust.

Maybe that's why we need to move towards blockchain-based networks since trust is not required on blockchain, only proof.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#134

Post by Kye »

bhnmmhmd wrote: post #133
Raphmedia wrote: post #38

Earlier quoted context omitted.

The internet is based on trust. There is nothing stopping anyone that has an e-commerce website from recording a clear version of your passwords along with all of your billing address and credit card informations. There's no audits or anything.

> The internet is based on trust. Maybe that's why we need to move towards blockchain-based networks since trust is not required on blockchain, only proof.

Then people have to trust the people with the time, energy, and interest to know how to develop the stuff behind it. All it does is shift the trust to people who are even less accountable.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#135

Post by curiousfab »

pluma wrote: post #130
ben509 wrote: post #73

Earlier quoted context omitted.

I can confirm that names and email addresses are classified as saltysugar states, and the security reviews. So they do have to pass all those requirements for secure storage and transmission, but then names and emails are made visible by default through mechanisms like reviews, profile, wishlists, and that passes the review because it is the user's choice. I don't even think this is anything nefarious by Amazon. It's…

> saltysugar Can you elaborate? I've never heard this phrase before and google results aren't very helpful.

It's not a policy, it's the username of the parent's poster.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#136

Post by GiuseppaAcciaio »

superflyguy wrote: post #118
eps wrote: post #113

Earlier quoted context omitted.

The exact same goes for PayPal. We were routinely getting emails saying "I'm not comfortable sharing my CC info with you" (even though it goes through a processor), so ended up adding PP as an alternative. Guess what - now we get to see their full name and physical address, neither of which we need, because we sell software licenses. I'm guessing that people are more concerned with needing to deal with compromised ca…

Why would anyone care if you had their address, or email address? Why would Amazon be interested in going into details about an email address leak? Outside of a handful of people who get excited by every leak no matter what, nobody cares. It's an email address. You get some more spam maybe? Big deal.

Because Amazon leaking your email address means you are registered on Amazon; there is a high likelihood that you actually purchased stuff there, and therefore they have your address on file, and maybe even your credit card.

Since a lot of people re-use passwords, if your email is also contained in one of the countless breaches that we've seen cropping out in the last few years, there's a good chance that your Amazon account is using one of the pwned passwords: therefore Amazon's statement that people should not change their Amazon password is potentially harmful advice.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#137

Post by GiuseppaAcciaio »

a_imho wrote: post #111
edoo wrote: post #12

When I started selling the first gadget I ever made on Amazon I was so excited and was only getting a couple sales a month. If you were one of my customers I looked at your house, judged your grass, found you on LinkedIn and Facebook, Instagram, mortgages, mugshots, everything lol. The sellers also get your full name and address even on fulfilled by Amazon. If you have been on the net long enough this will creep you…

If you have been on the net long enough this will creep you out: https://haveibeenpwned.com/ Checked with lol@gmail.com, you have to add 14 other 'l's (lolllllllllllllll@gmail.com) in order to result in a green good news. How can I validate the claims? I'm a bit skeptical seeing it doubles as a sales front for 1password.com.

Do a bit more research: you'll find that Troy (the guy who runs the service) has been working on this for several years before any involvement with 1password, and so far he's been very transparent about what he does with breach data and also about his relationship with 1password. Whenever he gets access to an unverified dump he first tries to verify its authenticity with the company or service that was pwned, then gets in touch with people whose details are in the dump to verify if the data is real.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#138

Post by [deleted] »

edoo wrote: post #12

When I started selling the first gadget I ever made on Amazon I was so excited and was only getting a couple sales a month. If you were one of my customers I looked at your house, judged your grass, found you on LinkedIn and Facebook, Instagram, mortgages, mugshots, everything lol. The sellers also get your full name and address even on fulfilled by Amazon. If you have been on the net long enough this will creep you…

[deleted]

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#139

Post by [deleted] »

edoo wrote: post #12

When I started selling the first gadget I ever made on Amazon I was so excited and was only getting a couple sales a month. If you were one of my customers I looked at your house, judged your grass, found you on LinkedIn and Facebook, Instagram, mortgages, mugshots, everything lol. The sellers also get your full name and address even on fulfilled by Amazon. If you have been on the net long enough this will creep you…

[deleted]

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#140

Post by hnaj »

edoo wrote: post #12

When I started selling the first gadget I ever made on Amazon I was so excited and was only getting a couple sales a month. If you were one of my customers I looked at your house, judged your grass, found you on LinkedIn and Facebook, Instagram, mortgages, mugshots, everything lol. The sellers also get your full name and address even on fulfilled by Amazon. If you have been on the net long enough this will creep you…

Mortgages and mugshots only if you live in the U S of A.
Post reply on HN