7 ms·

Security researcher gets threats over Amazon review

210 points by kw71 10y ago

kiba 10y ago
The job of one employee versus potentially thousand to hundred thousand customers' security being compromised?
dietrichepp 10y ago
Sounds like a classic abusive boyfriend. "You pointed out security flaws? Look what you made me do. You made me fire these workers."
- ddoolin 10y ago
  Or just, you know, abusive partner.
  - criley2 10y ago
    Or just you know, an abusive person.
electic 10y ago
If they just had fixed the flaws I am sure the researcher would have updated his review to highlight the efforts of the manufacturer. Instead, all the manufacturer did here is create a Streisand Effect for their shitty product.
phasmantistes 10y ago
I'm not sure if I'm more scared of a company that makes horridly insecure devices and then tells its employees "do everything you can, be as manipulative as you can, but get this review taken down", or if I'm more scared of a company that actually tells its employees "I will fire you if you don't get this review taken down".
- pmiller2 10y ago
  Aren't those things roughly equivalent to the average worker?
  - phasmantistes 10y ago
    I guess I meant the former in terms of it simply being the worker's job to get the review taken down. No actual threat of being fired at all, but the company has given their implicit (or worse, explicit) 'ok' for using that threat as a manipulation tactic. Both are forms of moral bankruptcy, I was just curious whether the seemingly-desperate employee was a victim or a player.
bitshiffed 10y ago
Previous discussion here: https://news.ycombinator.com/item?id=12012977 https://news.ycombinator.com/item?id=12012977
jswny 10y ago
To me this seems like an odd tactic to use as the manufacturer. Did the boss just pick some random employee and decide that one guy had to get the review taken down other wise he was fired? Also, I'm inclined to believe that this isn't the case because I also don't believe that those "other reviewers" actually complained about his review. Why would anyone else care that he left a truthful review about the product? If anything, they would be glad that he pointed out such glaring flaws with the product that could potentially damage things plugged into this product. I'll say one more thing, I hope that he contacted the company directly. It's great that he left this review for others so that they would know how insecure this device is, but I think it's important that he also contact the company directly so that he can help solve the problem. Leaving a bad Amazon review isn't exactly the best way to report a dangerous security flaw in something if you want it to get fixed. Although, it seems like this company isn't one to fix such things anyway ¯\_(ツ)_/¯
- nostromo 10y ago
  Dollars to donuts, there is no employee. It's the manufacturer writing him and concocting a story.
  - stcredzero 10y ago
    It ought to be criminal, the way it's approaching a found security flaw. The sort of review shenanigans they're pulling should be criminal as well. Company is revealed to be completely incompetent with regards to security. So their reaction is to harangue and pressure the reviewer instead of fixing the problem.
    - nommm-nommm 10y ago
      Sounds like the company is Chinese though.
- ohjeez 10y ago
  I've been a top Amazon reviewer -- at one point I was #84 -- and at no time have I seen any reviewer complaining about someone else's review. At least not if it's an honest review based on hands-on experience. (There can be quite an outcry if it's obvious the review is fake, such as someone who clearly didn't read the book she's writing about.) But if you give an honest opinion -- even one with which I disagree -- I'll never even downvote it, much less report it.
pmyjavec 10y ago
"The result is that the unique network ID of your socket is transported in an unencrypted form to the Chinese server" The use of The word "Chinese" in this article is amusing. Is it really important or necessary? Would it be preferable if the data was sent to a US server ?
- nostromo 10y ago
  If you're a US citizen, you would be a bit better off if it was a US server, because the records from the server would be available to the US court system. This is helpful if a customer ends up suing the company, or if there is a security breach that is investigated by US-based law enforcement. I agree, the inclusion does hint at Sinophobia. But it's also a valid detail for security conscious customers to consider.
  - navbaker 10y ago
    Why is it "Sinophobia" to state a fact about where the server is located?
    - pg_is_a_butt 10y ago
      because race, gender, and borders do not exist in the new world order. those who acknowledge them will be eliminated. just some dumb law a pollack jew lady thought up.
    - Fomite 10y ago
      The suggestion is that the location of the server wouldn't have been reported if it went to say...Germany. Or Ireland.
      - tedunangst 10y ago
        Is there evidence to support that suggestion? Like a similar review about a device that uses a German server but refers to it as a "server in a trustworthy country"?
    - 10y ago
r00fus 10y ago
Of note, from the amazon review: "But before we get to that: I received this product at a discount in return for writing an honest review of it. Onwards!" Could that have anything to do with the manufacturer's attitude?
- maxerickson 10y ago
  I sort of wonder if Amazon is the entity providing the discount. (I spent a minute trying to figure it out and didn't find anything)
  - thesimon 10y ago
    No, because these seem to be clearly marked with a Amazon Vine logo and disclaimer.
    - ukyrgf 10y ago
      Up until just now I assumed Amazon Vine had something to do with Vine.co. I didn't realize Vines were only 8 seconds which would be an impractical format for reviews...
  - mmanfrin 10y ago
    Nope, there's a cottage industry of review-for-discount sites that give people discounts/free items in exchange for reviews, but wink wink don't feel obligated to give it 5 stars.
    - joepvd 10y ago
      Would the rep who claims to be in fear of losing her/his job be employed from that cottage industry? That would make the claim sound a bit more plausible, assuming, of course malice in the review-for-discount corps.
      - daveloyall 10y ago
        I bet you are on to something. But I have never heard of this review-for-discount concept. I have heard of organizations like this: http://revleap.me/ http://revleap.me/ (I'm sure these guys are completely innocent, they just happened to come up in a DDG search for "get positive amazon reviews".) If you search for "work from home" you will find lots of shady organizations paying people (pennies) to post reviews, for example on Google Maps. It's not a huge leap to imagine a service which pays random online workers to contact negative reviewers with sob stories begging for the review to be removed. And it's not hard to imagine that a disposable worker such as that would indeed be fired (simply not offered additional work) if s/he fails to get a review removed. The organization I linked too shows a picture of what appears to be some kind of negative review alert delivered to a smart phone.
davidgerard 10y ago
I'm sure trying that on Matthew Garrett will work out just fine for them.
wai1234 10y ago
How is this a 'threat'?
- int_handler 10y ago
  > The representative then said that she would report Garrett to Amazon if he didn’t take down the review, and that other Amazon reviewers had written in to complain about it.
  - wai1234 10y ago
    Not exactly terrifying.
    - int_handler 10y ago
      That part, I agree with.
mannykannot 10y ago
The threat of being reported to Amazon isn't very threatening, and I was going to chide Techcrunch for being alarmist, but as I began to compose my post, I realized I couldn't come up with a good alternative word in this case, and skimming some online thesauri hasn't helped. Any suggestions? The thing is, if the company had followed through on its threat, the resulting headline would be much less attention-grabbing. I am assuming the employee-gets-fired threat is not plausible.
- StavrosK 10y ago
  I agree with you, I thought they were talking about death threats or similar. What happened was more that he got hassled than threatened.
- ikeboy 10y ago
  Harrassed?
  - mannykannot 10y ago
    Definitely an improvement. I also like Stavrosk's 'hassled'.
- wai1234 10y ago
  The employee fired threat is a threat to the employee, not the reviewer (unless you consider a guilt trip a threat). The whole payload reads more like a tantrum than a 'threat'. Given the state of the world, this headline is more than a bit overblown. I would agree with 'harassed'.
HillaryBriss 10y ago
I will continue to ignore Amazon product reviews.
- pilsetnieks 10y ago
  Unfortunately, you cannot. Unless you're searching for a known product or brand, it's the review scores that will affect what results you'll get.
Magnets 10y ago
Sounds like the classic excuses you get from chinese sellers, they say their boss will punish them if you've left a bad review, aliexpress will punish their store, company will close etc. It's no problem though, they can just keep sending out free review units to get their 4 and 5 star reviews. 2 verified purchases from 11 reviews, and one of those got it for free or heavily discounted "The AuYou Power Socket arrived very fast & was packaged well. I received it for an honest & unbiased review" That is what's really killing Amazon reviews, free products in exchange for 5-star reviews.
- UnoriginalGuy 10y ago
  What is interesting is that Amazon had the "Amazon Vine" Program which clearly listed that people received the product for free (or at a discount). But for whatever reason that has fallen out of fashion, and now manufacturers recruit outside to get unmarked reviews which sometimes don't list the potential conflict of interests. I wonder if this behaviour violates FTC's rules[0], I know it was a big thing on YouTube (YT channels failing to disclose financial incentives/conflicts of interests). [0] https://www.ftc.gov/tips-advice/business-center/guidance/ftcs-endorsement-guides-what-people-are-asking https://www.ftc.gov/tips-advice/business-center/guidance/ftc...
  - kw71 10y ago
    I have purchased many things from China on eBay and am now getting spam offering me free products if I review them. I'm sure that Amazon or any site could detect and cull these reviewers, but would it be in their best interests to do so?
  - tamana 10y ago
    Is Vine discontinued? My buddy still does it, at least until recently
    - bayamos 10y ago
      A lot of participants quit a year ago when Amazon began issuing 1099s so participants would pay tax on goods received.
azinman2 10y ago
The article incorrectly states the risk. If the relay is not solid state, or depending on what is connected to the outlet (I have a 1.7kw espresso machine on my wemo), rapidly switching on and off could easily cause a fire.
Paul_S 10y ago
Clearly I've been very naive but I had no idea people made a living writing fake reviews: https://www.amazon.com/AuYou-Switch-Wireless-Electronics-Anywhere/product-reviews/B01FZ0WP02/ref=cm_cr_arp_d_hist_4?filterByStar=four_star&pageNumber=1 https://www.amazon.com/AuYou-Switch-Wireless-Electronics-Any... What is the point of this? I assume they're after the star rating since anyone who actually reads the review text will know it's bogus. Wouldn't it be in Amazon's interest to shadowban these accounts?
alwaysdownvoted 10y ago
"But if you're not home, your phone sends the command to a server in China,..." Do any "smart" devices not try to connect to remote servers, automatically, without asking the user for permission? Do users care that "smartphones" they carry or other devices they put in their home automatically connect to remote servers so various companies can collect data, ..., turn sockets on/off, etc.? If we do not like this practice and we want to see change for the better, then maybe we should put our comments in Amazon reviews instead on HN, security blogs, etc.
- droopyEyelids 10y ago
  > Do any "smart" devices not try to connect to remote servers, automatically, without asking the user for permission? I believe this is the point of Apple Homekit. And probably whatever Google has in the works will follow the same path. Your IoT devices only talk to your Apple TV, and the Apple TV talks to Apple which provides the cloud-connected app on your phone. That way the million IoT vendors shouldn't have to worry about security as much, becuase their devices are behind your NAT and communicated with through Apple's security.
Girlang 10y ago
If the product functioned, but had a security flaw like that (which doesn't reveal personal information, etc, just could allow someone else to turn your item on or off), I would have given it two stars. It is functional, and for some use-cases it could work (i.e., blocked from the outside Internet). One star would be if it didn't work, or opened a back door from your home network to China. Still, he shouldn't cave in. The 'they'll fire me' story probably isn't true!

210 points by kw71 10y ago

kiba 10y ago

The job of one employee versus potentially thousand to hundred thousand customers' security being compromised?

Sounds like a classic abusive boyfriend. "You pointed out security flaws? Look what you made me do. You made me fire these workers."

ddoolin 10y ago
Or just, you know, abusive partner.
- criley2 10y ago
  Or just you know, an abusive person.

electic 10y ago

If they just had fixed the flaws I am sure the researcher would have updated his review to highlight the efforts of the manufacturer. Instead, all the manufacturer did here is create a Streisand Effect for their shitty product.

phasmantistes 10y ago

I'm not sure if I'm more scared of a company that makes horridly insecure devices and then tells its employees "do everything you can, be as manipulative as you can, but get this review taken down", or if I'm more scared of a company that actually tells its employees "I will fire you if you don't get this review taken down".

pmiller2 10y ago
Aren't those things roughly equivalent to the average worker?
- phasmantistes 10y ago
  I guess I meant the former in terms of it simply being the worker's job to get the review taken down. No actual threat of being fired at all, but the company has given their implicit (or worse, explicit) 'ok' for using that threat as a manipulation tactic. Both are forms of moral bankruptcy, I was just curious whether the seemingly-desperate employee was a victim or a player.

bitshiffed 10y ago

Previous discussion here: https://news.ycombinator.com/item?id=12012977 https://news.ycombinator.com/item?id=12012977

jswny 10y ago

To me this seems like an odd tactic to use as the manufacturer. Did the boss just pick some random employee and decide that one guy had to get the review taken down other wise he was fired? Also, I'm inclined to believe that this isn't the case because I also don't believe that those "other reviewers" actually complained about his review. Why would anyone else care that he left a truthful review about the product? If anything, they would be glad that he pointed out such glaring flaws with the product that could potentially damage things plugged into this product. I'll say one more thing, I hope that he contacted the company directly. It's great that he left this review for others so that they would know how insecure this device is, but I think it's important that he also contact the company directly so that he can help solve the problem. Leaving a bad Amazon review isn't exactly the best way to report a dangerous security flaw in something if you want it to get fixed. Although, it seems like this company isn't one to fix such things anyway ¯\_(ツ)_/¯

nostromo 10y ago
Dollars to donuts, there is no employee. It's the manufacturer writing him and concocting a story.
- stcredzero 10y ago
  It ought to be criminal, the way it's approaching a found security flaw. The sort of review shenanigans they're pulling should be criminal as well. Company is revealed to be completely incompetent with regards to security. So their reaction is to harangue and pressure the reviewer instead of fixing the problem.
  - nommm-nommm 10y ago
    Sounds like the company is Chinese though.
ohjeez 10y ago
I've been a top Amazon reviewer -- at one point I was #84 -- and at no time have I seen any reviewer complaining about someone else's review. At least not if it's an honest review based on hands-on experience. (There can be quite an outcry if it's obvious the review is fake, such as someone who clearly didn't read the book she's writing about.) But if you give an honest opinion -- even one with which I disagree -- I'll never even downvote it, much less report it.

pmyjavec 10y ago

"The result is that the unique network ID of your socket is transported in an unencrypted form to the Chinese server" The use of The word "Chinese" in this article is amusing. Is it really important or necessary? Would it be preferable if the data was sent to a US server ?

nostromo 10y ago
If you're a US citizen, you would be a bit better off if it was a US server, because the records from the server would be available to the US court system. This is helpful if a customer ends up suing the company, or if there is a security breach that is investigated by US-based law enforcement. I agree, the inclusion does hint at Sinophobia. But it's also a valid detail for security conscious customers to consider.
- navbaker 10y ago
  Why is it "Sinophobia" to state a fact about where the server is located?
  - pg_is_a_butt 10y ago
    because race, gender, and borders do not exist in the new world order. those who acknowledge them will be eliminated. just some dumb law a pollack jew lady thought up.
  - Fomite 10y ago
    The suggestion is that the location of the server wouldn't have been reported if it went to say...Germany. Or Ireland.
    - tedunangst 10y ago
      Is there evidence to support that suggestion? Like a similar review about a device that uses a German server but refers to it as a "server in a trustworthy country"?
  - 10y ago

r00fus 10y ago

Of note, from the amazon review: "But before we get to that: I received this product at a discount in return for writing an honest review of it. Onwards!" Could that have anything to do with the manufacturer's attitude?

maxerickson 10y ago
I sort of wonder if Amazon is the entity providing the discount. (I spent a minute trying to figure it out and didn't find anything)
- thesimon 10y ago
  No, because these seem to be clearly marked with a Amazon Vine logo and disclaimer.
  - ukyrgf 10y ago
    Up until just now I assumed Amazon Vine had something to do with Vine.co. I didn't realize Vines were only 8 seconds which would be an impractical format for reviews...
- mmanfrin 10y ago
  Nope, there's a cottage industry of review-for-discount sites that give people discounts/free items in exchange for reviews, but wink wink don't feel obligated to give it 5 stars.
  - joepvd 10y ago
    Would the rep who claims to be in fear of losing her/his job be employed from that cottage industry? That would make the claim sound a bit more plausible, assuming, of course malice in the review-for-discount corps.
    - daveloyall 10y ago
      I bet you are on to something. But I have never heard of this review-for-discount concept. I have heard of organizations like this: http://revleap.me/ http://revleap.me/ (I'm sure these guys are completely innocent, they just happened to come up in a DDG search for "get positive amazon reviews".) If you search for "work from home" you will find lots of shady organizations paying people (pennies) to post reviews, for example on Google Maps. It's not a huge leap to imagine a service which pays random online workers to contact negative reviewers with sob stories begging for the review to be removed. And it's not hard to imagine that a disposable worker such as that would indeed be fired (simply not offered additional work) if s/he fails to get a review removed. The organization I linked too shows a picture of what appears to be some kind of negative review alert delivered to a smart phone.

davidgerard 10y ago

I'm sure trying that on Matthew Garrett will work out just fine for them.

wai1234 10y ago

How is this a 'threat'?

int_handler 10y ago
> The representative then said that she would report Garrett to Amazon if he didn’t take down the review, and that other Amazon reviewers had written in to complain about it.
- wai1234 10y ago
  Not exactly terrifying.
  - int_handler 10y ago
    That part, I agree with.

mannykannot 10y ago

The threat of being reported to Amazon isn't very threatening, and I was going to chide Techcrunch for being alarmist, but as I began to compose my post, I realized I couldn't come up with a good alternative word in this case, and skimming some online thesauri hasn't helped. Any suggestions? The thing is, if the company had followed through on its threat, the resulting headline would be much less attention-grabbing. I am assuming the employee-gets-fired threat is not plausible.

StavrosK 10y ago
I agree with you, I thought they were talking about death threats or similar. What happened was more that he got hassled than threatened.
ikeboy 10y ago
Harrassed?
- mannykannot 10y ago
  Definitely an improvement. I also like Stavrosk's 'hassled'.
wai1234 10y ago
The employee fired threat is a threat to the employee, not the reviewer (unless you consider a guilt trip a threat). The whole payload reads more like a tantrum than a 'threat'. Given the state of the world, this headline is more than a bit overblown. I would agree with 'harassed'.

HillaryBriss 10y ago

I will continue to ignore Amazon product reviews.

pilsetnieks 10y ago
Unfortunately, you cannot. Unless you're searching for a known product or brand, it's the review scores that will affect what results you'll get.

Magnets 10y ago

Sounds like the classic excuses you get from chinese sellers, they say their boss will punish them if you've left a bad review, aliexpress will punish their store, company will close etc. It's no problem though, they can just keep sending out free review units to get their 4 and 5 star reviews. 2 verified purchases from 11 reviews, and one of those got it for free or heavily discounted "The AuYou Power Socket arrived very fast & was packaged well. I received it for an honest & unbiased review" That is what's really killing Amazon reviews, free products in exchange for 5-star reviews.

UnoriginalGuy 10y ago
What is interesting is that Amazon had the "Amazon Vine" Program which clearly listed that people received the product for free (or at a discount). But for whatever reason that has fallen out of fashion, and now manufacturers recruit outside to get unmarked reviews which sometimes don't list the potential conflict of interests. I wonder if this behaviour violates FTC's rules[0], I know it was a big thing on YouTube (YT channels failing to disclose financial incentives/conflicts of interests). [0] https://www.ftc.gov/tips-advice/business-center/guidance/ftcs-endorsement-guides-what-people-are-asking https://www.ftc.gov/tips-advice/business-center/guidance/ftc...
- kw71 10y ago
  I have purchased many things from China on eBay and am now getting spam offering me free products if I review them. I'm sure that Amazon or any site could detect and cull these reviewers, but would it be in their best interests to do so?
- tamana 10y ago
  Is Vine discontinued? My buddy still does it, at least until recently
  - bayamos 10y ago
    A lot of participants quit a year ago when Amazon began issuing 1099s so participants would pay tax on goods received.

azinman2 10y ago

The article incorrectly states the risk. If the relay is not solid state, or depending on what is connected to the outlet (I have a 1.7kw espresso machine on my wemo), rapidly switching on and off could easily cause a fire.

Paul_S 10y ago

Clearly I've been very naive but I had no idea people made a living writing fake reviews: https://www.amazon.com/AuYou-Switch-Wireless-Electronics-Anywhere/product-reviews/B01FZ0WP02/ref=cm_cr_arp_d_hist_4?filterByStar=four_star&pageNumber=1 https://www.amazon.com/AuYou-Switch-Wireless-Electronics-Any... What is the point of this? I assume they're after the star rating since anyone who actually reads the review text will know it's bogus. Wouldn't it be in Amazon's interest to shadowban these accounts?

alwaysdownvoted 10y ago

"But if you're not home, your phone sends the command to a server in China,..." Do any "smart" devices not try to connect to remote servers, automatically, without asking the user for permission? Do users care that "smartphones" they carry or other devices they put in their home automatically connect to remote servers so various companies can collect data, ..., turn sockets on/off, etc.? If we do not like this practice and we want to see change for the better, then maybe we should put our comments in Amazon reviews instead on HN, security blogs, etc.

droopyEyelids 10y ago
> Do any "smart" devices not try to connect to remote servers, automatically, without asking the user for permission? I believe this is the point of Apple Homekit. And probably whatever Google has in the works will follow the same path. Your IoT devices only talk to your Apple TV, and the Apple TV talks to Apple which provides the cloud-connected app on your phone. That way the million IoT vendors shouldn't have to worry about security as much, becuase their devices are behind your NAT and communicated with through Apple's security.

Girlang 10y ago

If the product functioned, but had a security flaw like that (which doesn't reveal personal information, etc, just could allow someone else to turn your item on or off), I would have given it two stars. It is functional, and for some use-cases it could work (i.e., blocked from the outside Internet). One star would be if it didn't work, or opened a back door from your home network to China. Still, he shouldn't cave in. The 'they'll fire me' story probably isn't true!