4 ms·

On your Amazon home page, go to: Your Account › Change Account Settings › Advanced Security Settings Turn on 2-step Verification. It won't completely solve s

by ronyeh 11y ago

On your Amazon home page, go to: Your Account › Change Account Settings › Advanced Security Settings Turn on 2-step Verification. It won't completely solve social engineering, but it can't hurt.

UnoriginalGuy 11y ago
If you had read the article you would know that they already had 2F turned on before the first intrusion and throughout the subsequent intrusions.
- ronyeh 11y ago
  Sorry, I did skim it but must have missed it! :-} In any case, I will leave my comment so that folks who come across this thread have a handy reference for turning on 2FA on their Amazon accounts.
- asymptotic 11y ago
  I might be being pedantic, but the only mention of 2FA in the OP is: "As a security conscious user who follows the best practices like: using unique passwords, 2FA, only using a secure computer and being able to spot phishing attacks from a mile away, I would have thought my accounts and details would be be pretty safe? Wrong." Are you sure the author enabled 2FA on his Amazon retail account, or was it only enabled on his AWS account? The two systems do not share the same 2FA. FYI I enabled 2FA on my Amazon retail account and when I called customer support they verified it. Once the verification failed and they refused to give me support. Anyone else confirm a similar story with 2FA and support? Anyone willing to explicitly test this out?
  - hayd 11y ago
    There's no reason to assume he wasn't using 2FA. The title says "backdoor" and that's the point: they didn't verify identity... they asked for name, email and a nearby address.
    - edderly 11y ago
      > Actually, I do have 2FA enabled on my account. But I don't think I had it enabled at the time for the very first attack. https://news.ycombinator.com/item?id=10965111 https://news.ycombinator.com/item?id=10965111
    - anindyabd 11y ago
      I don't think he was using 2FA; if he was, Amazon CS would not have given him the information (or at least should not have, based on their own policies): https://www.amazon.com/gp/help/customer/display.html?nodeId=201596330 https://www.amazon.com/gp/help/customer/display.html?nodeId=....
jkahn 11y ago
This was probably downvoted as it didn't help OP, however, this is really good advice. I'm doing it now - 2FA is enabled for all my work stuff but I hadn't gotten around to enabling it on Amazon. Didn't know they had it.
robhawkes 11y ago
There's currently no 2FA for Amazon.co.uk and (I assume), other non-.com Amazon domains :(
- ptha 11y ago
  If you login to amazon.com and enable 2FA, then when you login to amazon.co.uk (same username etc.) it will ask you for the 2FA code. It seems if you have an account for one Amazon domain you can login to all with the same credentials.

by ronyeh 11y ago

On your Amazon home page, go to: Your Account › Change Account Settings › Advanced Security Settings Turn on 2-step Verification. It won't completely solve social engineering, but it can't hurt.

UnoriginalGuy 11y ago

If you had read the article you would know that they already had 2F turned on before the first intrusion and throughout the subsequent intrusions.

ronyeh 11y ago
Sorry, I did skim it but must have missed it! :-} In any case, I will leave my comment so that folks who come across this thread have a handy reference for turning on 2FA on their Amazon accounts.
asymptotic 11y ago
I might be being pedantic, but the only mention of 2FA in the OP is: "As a security conscious user who follows the best practices like: using unique passwords, 2FA, only using a secure computer and being able to spot phishing attacks from a mile away, I would have thought my accounts and details would be be pretty safe? Wrong." Are you sure the author enabled 2FA on his Amazon retail account, or was it only enabled on his AWS account? The two systems do not share the same 2FA. FYI I enabled 2FA on my Amazon retail account and when I called customer support they verified it. Once the verification failed and they refused to give me support. Anyone else confirm a similar story with 2FA and support? Anyone willing to explicitly test this out?
- hayd 11y ago
  There's no reason to assume he wasn't using 2FA. The title says "backdoor" and that's the point: they didn't verify identity... they asked for name, email and a nearby address.
  - edderly 11y ago
    > Actually, I do have 2FA enabled on my account. But I don't think I had it enabled at the time for the very first attack. https://news.ycombinator.com/item?id=10965111 https://news.ycombinator.com/item?id=10965111
  - anindyabd 11y ago
    I don't think he was using 2FA; if he was, Amazon CS would not have given him the information (or at least should not have, based on their own policies): https://www.amazon.com/gp/help/customer/display.html?nodeId=201596330 https://www.amazon.com/gp/help/customer/display.html?nodeId=....

jkahn 11y ago

This was probably downvoted as it didn't help OP, however, this is really good advice. I'm doing it now - 2FA is enabled for all my work stuff but I hadn't gotten around to enabling it on Amazon. Didn't know they had it.

robhawkes 11y ago

There's currently no 2FA for Amazon.co.uk and (I assume), other non-.com Amazon domains :(

ptha 11y ago
If you login to amazon.com and enable 2FA, then when you login to amazon.co.uk (same username etc.) it will ask you for the 2FA code. It seems if you have an account for one Amazon domain you can login to all with the same credentials.