[deleted]
Show HN: Get a list of your Amazon purchases and see what you can sell them for
41–50 of 108 posts
Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for
#42This seems like a cool idea, but I don't feel comfortable giving out my Amazon credentials with no guarantee of how they are used.
Is there anything we could do to make you (and many more with the same sentiment) more comfortable? We are thinking of writing a blog post of what happens in the background would that help? Any other ideas?
Make this a project I can download and run entirely on my local machine.
Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for
#43Earlier quoted context omitted.
Agreed. My understanding is that having your password does not necessarily allow someone to see your CC number or order things on your behalf through Amazon, but it definitely does not seem like a best practice to go around handing out one's Amazon password. This sort of thing sounds like a good argument, though, for Amazon's implementing the sort of fine-grained permissions (in conjunction with a federated authentic…
Also highly risky is AWS. Maybe an attacker can't order diamond rings for themselves, but they certainly could spin up a million EC2 instances to mine bitcoin. The cost efficiency is terrible of course, but what do they care.
We haven't tested that, but I highly recommend (regardless of using ShelfFlip) to use "Multi-Factor Authentication" for AWS.
Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for
#44Earlier quoted context omitted.
There is absolutely nothing you could say or do that would make me give you my password. Also, I assume, you need to store it in the clear to use it. You claim to not have access to credit card information or being able to order something, but I already have to trust you to believe that claim. Also, Amazon could change their policies at any time -- after all you have credentials, Amazon could decide to trust you.
You could definitely verify that claim: 1) Try to extract your credit card from your account 2) Order something to a new address without having to verify your credit card. You will find that both are not possible
The second one is possible with nothing other than an Amazon order number and some human social engineering; earlier this summer I got hit with someone who gained access to my Amazon order number for an Xbox One (I assume this happened because I was recycling my physical Amazon pack-in invoices [which included the order number] without shredding them), that person chatted with an Amazon CSR and got them to send a replacement order (saying the first never came) and even convinced them to send the replacement to another address that had never been associated with my account (which was a remailer service in Oregon). Even worse, they did this twice (two replacement orders for the same item sent to the same place staggered over 2 days).
I can imagine it would be much, much easier for such social-engineering replacement fraud to happen if someone actually had access to your account with all of its order number data in the clear.
They would be restricted to just reordering things you've already ordered in the past, but I imagine that it doesn't take too many incidents on your account (especially if they figure out you've given your password away freely to a third party) before Amazon shuts you down, with all of the pain associated with that if you're a prime/kindle/etc user.
This seems like a cool service, but there's no way in hell I'm giving anyone my Amazon password for any purpose.
Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for
#45This seems like a cool idea, but I don't feel comfortable giving out my Amazon credentials with no guarantee of how they are used.
Is there anything we could do to make you (and many more with the same sentiment) more comfortable? We are thinking of writing a blog post of what happens in the background would that help? Any other ideas?
> Is there anything we could do to make you (and many more with the same sentiment) more comfortable?
No. Asking people to give out their passwords is fucking horrific. You can't do anything with Amazon, but bad_guy could do something with $other_service and you're just encouraging people to be lazy with passwords.
It's hard enough to get people to choose good passwords and not store them in stupid ways.
Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for
#46Awesome business model and setup.
Thanks for your comment, I am glad you like it. (PS: No, the parent comment was not a self-promotion by us - I swear)
Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for
#47This seems like a cool idea, but I don't feel comfortable giving out my Amazon credentials with no guarantee of how they are used.
Would it help you to know that Shelflip is secured by Norton secured and ex-Google Engineers?
Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for
#48This seems like a cool idea, but I don't feel comfortable giving out my Amazon credentials with no guarantee of how they are used.
Would it help you to know that Shelflip is secured by Norton secured and ex-Google Engineers?
No. You can put anything you want in text or graphics on the screen. You need to send people to a secure amazon.com login page and pass an OAuth token.
Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for
#49For what it's worth, I did this and it prompted Amazon to reset my password due to suspected phishing attempts.
Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for
#50Earlier quoted context omitted.
There is absolutely nothing you could say or do that would make me give you my password. Also, I assume, you need to store it in the clear to use it. You claim to not have access to credit card information or being able to order something, but I already have to trust you to believe that claim. Also, Amazon could change their policies at any time -- after all you have credentials, Amazon could decide to trust you.
You could definitely verify that claim: 1) Try to extract your credit card from your account 2) Order something to a new address without having to verify your credit card. You will find that both are not possible
How about ordering a high-cost item from an attacker who sells on Amazon? How about AWS? How about Amazon Payments to order a service from
the attacker's site?
In order to trust you with credentials, it is necessary that you show you have thought everything through. The user needs to know that you will not leak credentials. It's a very high bar. You have simply failed to clear the bar.