Clicking on the author's byline, it says the author is a 'security researcher focusing on privacy issues revolving around source protection, counter-forensics, and privacy assurance.' I would assume, therefore, the author would have at least passing knowledge of security and web applications.
> Amazon at this point makes some intonations about how this email verification step is necessary because your privacy and security are the company’s top priority, though considering that when your data is available you’ll need to check your email anyway, it’s not clear how checking your email twice adds any security.
People can argue about whether email should be used for authentication purposes. But what is the alternate model suggested? From the formulation of the complaint, the author seems to suggest that it'd be better if Amazon did not decouple authentication and payload delivery.
Sending the payload (in this case, a load of personal data) to an email address without first checking whether the requestor is in control of the address is a horrendously terrible idea. I'm starting to wonder about the author's security chops.
> Though Amazon says that it will “provide your information to you as soon as we can,” “soon” is apparently meant to be interpreted on a monthly time scale, as the page further states that “usually, this should not take more than a month.” Though of course, “in exceptional cases, for example if a request is more complex or if we are processing a high volume of requests, it might take longer.” This protracted time frame forms an intriguing juxtaposition to the otherwise universal emphasis on speed that facilitates shopping on Amazon.
It's much easier to put information into various databases than it is to determine what databases contain information about a particular user, and present that data to the user in a secure, auditable manner.
For example, you have to make sure that the user gets all the information they asked for (which means you have to determine whether the information exists, and if it doesn't you have to log the nonexistance of the data, lest you be audited). And you need to make sure user doesn't get information about someone else (which has happened in the past).
Distributed systems are hard. It takes time to determine where all possible information could live. And you have to make sure you're providing the correct information. And do this flawlessly, every single time lest you open yourself up to bad press and potential fines. This all takes time in systems as large and distributed as Amazon.
---
If the author is as knowledgeable in the security space as their byline suggests, I'm left to think that their incurious write-up is just trying to throw red meat at the 'We hate anything associated with Amazon' crowd.
For what it's worth, my team at AWS processes GDPR requests within 3-or-so business days. But we can only do that because there is a single data warehouse for our product/service.