Live data from Hacker News

Getting my personal data from Amazon was weeks of confusion and tedium

theintercept.com

31–40 of 193 posts

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#31

The full, complete set of tedium the author describes is: * Navigate through a handful of pages. * Scroll to the bottom of a menu. * Click an email confirmation link. * Wait 19 days. * Click 74 download links. That last part is pretty dumb! But it's also the only thing that seems remotely tedious, and I'm not sure where at any point he'd be confused. The author implies some sort of issue with the 19 day waiting perio…

Distributed systems store information in different databases and warehouses. You don't want your Amazon.com retail data co-mingled with Alexa data for multiple reasons. Two of the preeminent security concepts is least privilege and data segregation.

Your data exists in different files and databases. That's why you get multiple files containing your data. And let's ignore that the zip archives contain files of different types.

If all the files were of the same type, what would you prefer, that Amazon edit these files and combine them into a single file? How could you prove that Amazon didn't edit out any files maliciously?

The typical way to verify file integrity is by checking hash sums. But here you don't have access to the original hashes (because they're internal Amazon files). Even if you had access to the hashes, we know the hashes wouldn't match because we're presupposing that the files have been modified to combine them.

If they were to combine all the files together, there would be no way for Amazon to document that nothing was changed. Which means the process isn't auditable, and people will come up with conspiracies about how big bad Amazon is sanitizing files before sending them out.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#32

The multiple download buttons is not a dark pattern to prevent you from downloading your data, it’s just bad UX, it’s a feature you add to check a legal box and it doesn’t get priority for usability. Probably someone just shrugged, this is good enough and moved on. They should definitely give you it all in one zip file but “Never attribute to malice that which is adequately explained by a developer rushing to get som…

Is the ridiculously annoying process for ending your Prime subscription also just accidental, bad UX?

It miraculously uses very similar patterns.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#33
post #21

It's not very often that each and every point in an article just feels "fabricated" or over the top. It starts with finding the page: Amazon -> Customer Service -> Search for "personal data" -> Search result #1 is "Request Your Personal Information" which nicely explains what to do and links directly to that page. The need to verify or activate a data request via clicking a link? Of course required so some third part…

Agreed, I have successfully downloaded my order history from the beginning of my account, very interesting to look through. Though I'm not sure why I was buying solaris books in 1999 :) Others like enders game I still remember.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#34
post #30

Clicking on the author's byline, it says the author is a 'security researcher focusing on privacy issues revolving around source protection, counter-forensics, and privacy assurance.' I would assume, therefore, the author would have at least passing knowledge of security and web applications. > Amazon at this point makes some intonations about how this email verification step is necessary because your privacy and sec…

> Distributed systems are hard. It takes time to determine where all possible information could live. And you have to make sure you're providing the correct information. And do this flawlessly, every single time lest you open yourself up to bad press and potential fines. This all takes time in systems as large and distributed as Amazon. This implies that Amazon is serving GDPR data requests manually, rather than the…

GDPR requests are handled, at least in part, manually. I have direct knowledge of how GDPR is handled within the product/service I support. And yes, it's manual.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#36

When you buy from Amazon, you are supporting their various awful practices. Yes, you

I will never be able to reconcile humans simultaneous need for everything to be good and pure but you know also cheap shit. Accept and embrace the gray area we all live in.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#37
I run a part of the data request process at our company. This article is an example where people expect anything technology related to be magic.

We have to go through EVERY tech stack we own and look for that person's data. It's amazingly manual and tedious and takes about 6 people about an hour per request.

We're working to automate it, but needless to say we try not to broadcast it too broadly.

I hate that everyone jumps on any bad experience as a "dark pattern" when there's plenty of incompetence to share the blame.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#38
post #30

Clicking on the author's byline, it says the author is a 'security researcher focusing on privacy issues revolving around source protection, counter-forensics, and privacy assurance.' I would assume, therefore, the author would have at least passing knowledge of security and web applications. > Amazon at this point makes some intonations about how this email verification step is necessary because your privacy and sec…

> Distributed systems are hard. It takes time to determine where all possible information could live. And you have to make sure you're providing the correct information. And do this flawlessly, every single time lest you open yourself up to bad press and potential fines. This all takes time in systems as large and distributed as Amazon. This implies that Amazon is serving GDPR data requests manually, rather than the…

To create a script/bot/application/whatever that can access all potential data, you have to give something read privileges to possibly hundreds of backend systems and products. This is horrendously bad idea security wise. If that service account gets compromised (either from an external or internal threat), you have a single account that has access to everything Amazon stores. This is bad for the company and bad for its customers.

There necessarily have to be multiple workflows to maintain the data segregation necessary to protect data at the scale we're talking with Amazon.

And assuming you could securely create this automated workflow, you'd still need a person manually verifying the end result to ensure that all the data scraped is in fact owned by the person who made the request. Within the past couple of years, there was a news story where someone got a different person's Alexa data after asking Amazon for their own data. That can't happen again.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#40

The multiple download buttons is not a dark pattern to prevent you from downloading your data, it’s just bad UX, it’s a feature you add to check a legal box and it doesn’t get priority for usability. Probably someone just shrugged, this is good enough and moved on. They should definitely give you it all in one zip file but “Never attribute to malice that which is adequately explained by a developer rushing to get som…

Is the ridiculously annoying process for ending your Prime subscription also just accidental, bad UX? It miraculously uses very similar patterns.

True, and the ridiculously easy process to accidentally sign up for a subscription to each of your smallest of purchases.
Post reply on HN