Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Get a list of your Amazon purchases and see what you can sell them for

shelfflip.com

Post reply on HN
Print view View original

71–80 of 108 posts

Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for

#71

Post by schrodinger »

pdabbadabba wrote: post #10
bearbin wrote: post #4

This seems like a cool idea, but I don't feel comfortable giving out my Amazon credentials with no guarantee of how they are used.

Agreed. My understanding is that having your password does not necessarily allow someone to see your CC number or order things on your behalf through Amazon, but it definitely does not seem like a best practice to go around handing out one's Amazon password. This sort of thing sounds like a good argument, though, for Amazon's implementing the sort of fine-grained permissions (in conjunction with a federated authentic…

How could having your password not allow someone to order things on your behalf? All I need to get into my account is my password, and then I can order anything I want.

Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for

#73

Post by jngreenlee »

martingordon wrote: post #53

When you sign up, your Amazon email and password are sent to server using GET and so are visible in the URL. While the request is done over HTTPS (and traffic snoopers can't see it), it is very likely that there are a ton of Amazon credentials lying around unencrypted in a log somewhere on their server. For some reason, the "Norton Secured" badge makes me less likely to trust the site and looking at the inline, not v…

Can you briefly explain how to analyze for that, using non-dev tools like Chrome Inspector? I used 'Inspect Element', but found 'Post' on the popup form:

Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for

#74

Post by schrodinger »

Honestly, this is unethical.

You should not be collecting peoples' usernames and passwords, being a software engineer aware of the consequences, regardless of whether users are willing to give them up.

There are so many things that can go wrong, even if you've got the best of intentions.

Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for

#75

Post by bambax »

martingordon wrote: post #53

When you sign up, your Amazon email and password are sent to server using GET and so are visible in the URL. While the request is done over HTTPS (and traffic snoopers can't see it), it is very likely that there are a ton of Amazon credentials lying around unencrypted in a log somewhere on their server. For some reason, the "Norton Secured" badge makes me less likely to trust the site and looking at the inline, not v…

> in a log somewhere on their server

As well as on Amazon's logs, which aren't meant to hold customers' passwords. This is bad, bad, bad (interesting idea though).

Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for

#76

Post by schrodinger »

jngreenlee wrote: post #73
martingordon wrote: post #53

When you sign up, your Amazon email and password are sent to server using GET and so are visible in the URL. While the request is done over HTTPS (and traffic snoopers can't see it), it is very likely that there are a ton of Amazon credentials lying around unencrypted in a log somewhere on their server. For some reason, the "Norton Secured" badge makes me less likely to trust the site and looking at the inline, not v…

Can you briefly explain how to analyze for that, using non-dev tools like Chrome Inspector? I used 'Inspect Element', but found 'Post' on the popup form:

http://i.imgur.com/06580e9.png

This is from chrome developer tools, network tab

Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for

#78

Post by zyxley »

pdabbadabba wrote: post #13
ChristianKletzl wrote: post #6

Earlier quoted context omitted.

Is there anything we could do to make you (and many more with the same sentiment) more comfortable? We are thinking of writing a blog post of what happens in the background would that help? Any other ideas?

I'm not sure, but Mint.com seems like a good place to look for ideas. They have somehow persuaded me and millions of others to hand over all our banking passwords. Gaining this trust, though, will probably not be easy. One advantage a site like Mint has is that they have so much content and so many partnerships that it is clear they are not a scam, have enough at stake to not misuse my information, and probably have…

It helps at this point that Mint itself and its corporate owner Intuit have a long history of reasonably good online security (certainly better than some banks I've used), plus the whole "owned by Intuit" thing gives a solid paper-trail to keep anyone from recourselessly running away in the night with my information.

Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for

#79

Post by schrodinger »

ChristianKletzl wrote: post #72

---UPDATE--- @everyone: Want us to email you as soon as we have a password-free way to import your purchases? (for example through csv import) Shoot me an email to christian@shelfflip.com (subject: "shelfflip passwordfree")

You should really do the right thing and takes this down until then.

Re: Show HN: Get a list of your Amazon purchases and see what you can sell them for

#80

Post by cylinder »

schrodinger wrote: post #71
pdabbadabba wrote: post #10

Earlier quoted context omitted.

Agreed. My understanding is that having your password does not necessarily allow someone to see your CC number or order things on your behalf through Amazon, but it definitely does not seem like a best practice to go around handing out one's Amazon password. This sort of thing sounds like a good argument, though, for Amazon's implementing the sort of fine-grained permissions (in conjunction with a federated authentic…

How could having your password not allow someone to order things on your behalf? All I need to get into my account is my password, and then I can order anything I want.

If you want to ship to a new address (not in your address book), Amazon requires you to re-input your card number.
Post reply on HN