Show HN: Get a list of your Amazon purchases and see what you can sell them for

Post by epaladin » Tue, Jul 22, 2014, 6:09 PM UTC

georgemcbay wrote: post #44

ChristianKletzl wrote: post #21

Earlier quoted context omitted.

You could definitely verify that claim: 1) Try to extract your credit card from your account 2) Order something to a new address without having to verify your credit card. You will find that both are not possible

The second one is possible with nothing other than an Amazon order number and some human social engineering; earlier this summer I got hit with someone who gained access to my Amazon order number for an Xbox One (I assume this happened because I was recycling my physical Amazon pack-in invoices [which included the order number] without shredding them), that person chatted with an Amazon CSR and got them to send a rep…

Post by martingordon » Tue, Jul 22, 2014, 6:17 PM UTC

Post by martingordon » Tue, Jul 22, 2014, 6:28 PM UTC

jggonz wrote: post #54

martingordon wrote: post #53

When you sign up, your Amazon email and password are sent to server using GET and so are visible in the URL. While the request is done over HTTPS (and traffic snoopers can't see it), it is very likely that there are a ton of Amazon credentials lying around unencrypted in a log somewhere on their server. For some reason, the "Norton Secured" badge makes me less likely to trust the site and looking at the inline, not v…

I agree. The use of the Norton Secured badge made me quickly leave the site. A possible solution: There's a "Login with Amazon" service that may be what the developer needs to be using: http://login.amazon.com/

Post by jflowers45 » Tue, Jul 22, 2014, 6:31 PM UTC

martingordon wrote: post #53

When you sign up, your Amazon email and password are sent to server using GET and so are visible in the URL. While the request is done over HTTPS (and traffic snoopers can't see it), it is very likely that there are a ton of Amazon credentials lying around unencrypted in a log somewhere on their server. For some reason, the "Norton Secured" badge makes me less likely to trust the site and looking at the inline, not v…

Post by JustSomeNobody » Tue, Jul 22, 2014, 6:34 PM UTC

ChristianKletzl wrote: post #38

silentbob46 wrote: post #31

After giving this a try, I got an email from Amazon saying they've reset my password because I "may have been subject to a 'phishing' scam".

I am really sorry to hear that. We've experienced that once or twice before. This happens when the phone number associated with the account doesn't match the one you entered. Unfortunately, Amazon sometimes asks for an old phone number, as long as that number has at one point been associated with your account. ShelfFlip definitely doesn't do anything scammy.