Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Request your personal information

amazon.com

Post reply on HN
Print view View original

51–60 of 89 posts

Re: Request your personal information

#51

Post by piaste »

svennek wrote: post #48
riedel wrote: post #15

Earlier quoted context omitted.

I would encourage people to do so for the exact reason. Personal data should be managed in a way that such requests can be processed. It is OK if it hurts a bit. It is the idea of the GDPR that companies establish scalable processes that allow things like requests, migration and deletion. The only thing you need to do is to verify that to the best of your knowledge it is complete. What should not happen is that compa…

Do you also check your grocery stores preparedness for fire for the same reason? Or your local banks preparedness for robbery? Hopefully not. In business all decisions are made based on a risk tradeoff. Like people it never has enough money to do everything it wants. Not all companies are started 12 months ago and hence cannot (by definition) do this right "from the beginning". Also some businesses have a requirement…

My relationship with my neighbourhood grocer is vastly different from the one I have with Jeffrey Preston Bezos and the unfathomably wealthy AMZN shareholders.

I would never burden a small family-owned shop by ordering five things that I may or may not need for the weekend, then leaving four of them un-picked up to get a free refund when it rains. It would be a dick move.

But to Amazon (or Ikea, or Mediamarkt, or what have you), I will glady do that without batting an eye. They're an unfeeling legal entity that thrives by exploiting every letter and loophole of the rules. It is absolutely fair to treat them the same way in return.

Re: Request your personal information

#52

Post by svennek »

rmetzler wrote: post #19
svennek wrote: post #10

Please notice, at all companies (I don't know about AWS) that I have worked for each GDPR request eats up a few man-days of work internally. Some companies getting hit a lot by GDPR have likely automated it, but even a big company (that I know of) with 100k+ private customers (that all have the right) only receives a few requests a quarter, usually by angry customers.. This AWS thingy might not be GDPR, but it might…

It doesn't cost much when you allow your customers to do this from the start. And it helps QA to be able to see raw data.

What if the company was started three or four decades ago? That makes "from the start" quite hard...

Not all data is necessarily allowable to show to the customer (in the EU at least some data is illegal to show to the customer by law).

Re: Request your personal information

#53

Post by svennek »

todd3834 wrote: post #13
svennek wrote: post #10

Please notice, at all companies (I don't know about AWS) that I have worked for each GDPR request eats up a few man-days of work internally. Some companies getting hit a lot by GDPR have likely automated it, but even a big company (that I know of) with 100k+ private customers (that all have the right) only receives a few requests a quarter, usually by angry customers.. This AWS thingy might not be GDPR, but it might…

Please don’t feel guilty asking what information a company like Amazon knows about you. They have the engineering, human and computing resources to make this as scalable as it needs to be. If anything you’ll be creating more jobs for people who need it. I say this as a stock holder and someone who believes this information should be available. [edit: very small amount of stock but relevant I suppose]

I agree about Amazon (and the other FAANGs) but not necessarily about any other business..

Re: Request your personal information

#54

Post by Dave3of5 »

rsync wrote: post #22

I can't do this because amazon does not have my personal information. Amazon has a pseudonym with a dedicated Twilio number that delivers to a private postal box. I burn the pseudonym every few years. Which reminds me ... This is simple because VISA/MC do not validate cardholder name. Everyone thinks they do and most merchants believe that they do but ... they do not. You can use your card with "Mickey Mouse" and it…

Is this real?

Re: Request your personal information

#55

Post by vinay427 »

rsync wrote: post #22

I can't do this because amazon does not have my personal information. Amazon has a pseudonym with a dedicated Twilio number that delivers to a private postal box. I burn the pseudonym every few years. Which reminds me ... This is simple because VISA/MC do not validate cardholder name. Everyone thinks they do and most merchants believe that they do but ... they do not. You can use your card with "Mickey Mouse" and it…

Many do validate the address or at least postal code, however, although American Express doesn’t appear to in my experience. I assume it also depends on the issuer for Visa/Mastercard considering many have their own two-factor verification portal.

Re: Request your personal information

#56

Post by piaste »

svennek wrote: post #49
antris wrote: post #16

Earlier quoted context omitted.

> Just because it is free and your right, please consider if you wanna to be a resource hog.. Oh poor Amazon and Bezos... They must be struggling on the resources. Please think twice about exercising your legal right, as it might affect the profit margins of a monopolistic megacorp.

Rather, poor other customers, as companies always shifts added costs to the customer base..

That argument proves too much [0]. If you accept that reasoning, it's impossible to truly tax or fine Jeff Bezos, he's only going to make his customers pay more, so we should give him a 0% tax rate, shouldn't we?

(I actually sort of like the occasionally-suggested idea of abolishing all taxations on legal entity and collecting taxations only on individual profits, i.e. don't tax Amazon Inc., only tax its shareholders' dividends and capital gains. But that would be a radical restructuring of the economy and very far from what we're talking about.)

[0] https://en.wikipedia.org/wiki/Proving_too_much

Re: Request your personal information

#57

Post by Dave3of5 »

sol_invictus wrote: post #50
joshSzep wrote: post #47

Earlier quoted context omitted.

It makes a difference if it's just humans doing the job. Given the long window I would assume that this lacks automation

Yes, but "having a human in the system" isn't answering the original question: what does Amazon benefit from introducing excess cost into this equation? Surely there should be nothing clandestine in your own usage data, search queries etc.

> Yes, but "having a human in the system" isn't answering the original question

It does. There is a human manually running queries to copy your data into an Excel spreadsheet (or equivalent) then passing that onto the next part in the chain. This is done quite a few times and stalls the process.

> what does Amazon benefit from introducing excess cost into this equation?

It's cheaper to have the already existing employees do this. They haven't hire a new team to do this.

> Surely there should be nothing clandestine in your own usage data, search queries etc.

I suspect there's more than you own personal data mixed into these systems. Your personal data is mixed in with Amazon's company confidential data so they need to separate these out before sending you only what's required by law.

Re: Request your personal information

#58

Post by lillecarl »

captn3m0 wrote: post #45
WA wrote: post #41

Earlier quoted context omitted.

Fun fact (from 2012): some credit cards had more than one CCV. You could find out by simply trying all 1000 combinations on some web shops. Back then, I did security consulting and we knew a shop or two where it was possible to enumerate the CCVs without submitting an order and without being blocked. Not sure if this is still valid nowadays, but it blew my mind as well.

Even better fun fact: There’s some issuers that won’t validate your CVV at all, so any of the 999 options work for those cards.

As a Swede, with both my CC and direct debit I'm transfered to the Swedish "Bank ID" service to do mfa with my phone using a 6+ digit code before any online purchase goes through. Kinda privacy invasive, but it's also impossible to steal money from me without these things: my card, my cvv, my phone, my phone unlock code, my bank ID code.

Re: Request your personal information

#59

Post by some_furry »

rsync wrote: post #22

I can't do this because amazon does not have my personal information. Amazon has a pseudonym with a dedicated Twilio number that delivers to a private postal box. I burn the pseudonym every few years. Which reminds me ... This is simple because VISA/MC do not validate cardholder name. Everyone thinks they do and most merchants believe that they do but ... they do not. You can use your card with "Mickey Mouse" and it…

I discovered this when I accidentally left an autofilled "Soatok Dreamseeker" instead of [redacted legal name] and it... just worked.

Re: Request your personal information

#60

Post by dotancohen »

omgitsabird wrote: post #7

I lost an AWS account many years ago to losing an MFA device during an adventure that I will avoid documenting here. What is really weird is that AWS account is tied to a very old (1998?) Amazon account. I wonder what this request will reveal.

Stories like this are what keep me using strong passwords (in Keepass) instead of MFA. I'd love to hear more details as I'm finding more and more services push the MFA aspect, and I don't use a smartphone. Thanks.
Post reply on HN