16 ms·

Still locked out of my AWS account

463 points by colinmeinke 9y ago

colinmeinke 9y ago
8 days ago I tried to log in to my Amazon retail account, and received a password invalid error. As it turned out my account had been closed, as it appeared to Amazon that it had received a suspicious log in. This is the same account that I use for AWS - hosting websites critical to my business. Today it appears I am no closer to gaining access back to my AWS account than I was on day 1, even though I have been billed as normal for my services during this time. This should serve as a warning to anybody else who has an Amazon account that is shared between retail and AWS. Linked is a list of every event and interaction I have had during the last 8 days with Amazon, via Twitter, email, phone and chat.
- btown 9y ago
  Are services offline or are you just locked from accessing the account?
  - deleted 9y ago
    [deleted]
  - colinmeinke 9y ago
    My services are still online, so it's not a total disaster (yet), but I cannot sign in to the AWS control panel.
    - emeraldd 9y ago
      Definitely time to change services ...
- digi_owl 9y ago
  If anything this, along with similar situation(s?) with Google, should stand as a strong warning against single sign on systems across multiple services with multiple TOS.
  - willow9886 9y ago
    Why do you see this as a single sign-on issue? Seems to me the issue is over reliance on large SaaS providers. Same things happens all the time to Google users.
    - mintplant 9y ago
      Because if you lose that single sign-on account, you lose everything attached to it as well.
      - willow9886 9y ago
        Amazon offers many services, of course they are going to want users to have one set of credentials to access all those services. There are trade-offs to every security approach, but storing passwords at every web service is 100x worse.
        Hnrobert42 9y ago
        I don't understand your concern. We all have numerous accounts all over the web. Having one or two more doesn't increase our attack surface 100x.
        aquadrop 9y ago
        What have passwords anything to do with this?
    - MichaelGG 9y ago
      Because you're unlikey to trigger a violation on your cloud SaaS account, but could easily run afoul of other policies like "Real Name" or "Bought a Pixel Phone and Sold It" or posting something "offensive", getting reported by other users, etc. If the account is just for a cloud SaaS, then there's likely to be very few policies to disable your account.
      - willow9886 9y ago
- joelrunyon 9y ago
  This happened to me with instagram. I reset a password, then they detected "suspicious activity." I clicked "send pin via email" and the email never shows up. I've done it 3 or 4 times over the course of a week + it never works. It's a documented error + FB/Instagram refuse to addres it. https://medium.com/@joelrunyon/instagrams-security-features-are-broken-and-they-won-t-do-anything-about-it-16233f0935b0 https://medium.com/@joelrunyon/instagrams-security-features-...
  - legohead 9y ago
    And a similar thing has happened to me with Microsoft. I needed to get to my OneDrive. I go to log in, and it says invalid password. I go to reset the password, and it never sends me an email. I go through the alternate-email update process, answer the security questions, and it doesn't believe I am who I am. When I try to get access to real support (a person), it makes me login. Back to problem #1. Also, I should note that the email on record is real and works. The only thing I can think of is I named it microsoft@mydomain, and they don't like the word microsoft in it?
    - sly010 9y ago
      Same here (email never arrived) with my Apple Developer Account.
      - wlesieutre 9y ago
        I got into a similar situation when Apple prompted me to turn on 2-factor auth, and then after I accepted it wouldn't send 2-factor codes. Thankfully the "we turned on 2-factor" email gives you a link to turn it back off within 30 days or I would have been in some trouble.
    - joelrunyon 9y ago
      This is worse because at least with mine, they send the reset password (so I know they have the right email on file). Then, when they send the PIN to the same email - it never actually shows up. Ugh.
  - 9y ago
- Twirrim 9y ago
  In all seriousness, email jeff@amazon.com. The most likely outcome is that some relevant managers will receive one of the infamous "?" emails from him. If so, that'll result in two things: 1) Your problem will be resolved ASAP, managers right up the chain will be tracking it extremely closely, as they'll have to justify every action to Jeff. Everyone goes scrambling when one of those emails goes out. 2) A post-mortem will be done of everything that happened, with processes and procedures improved to ensure it doesn't happen again.
  - sleepychu 9y ago
    Can you provide some links to stuff about the infamous "?" emails?
    - trevyn 9y ago
      This page has 10 such links. 8-) https://www.google.com/search?q=bezos+question+mark+email https://www.google.com/search?q=bezos+question+mark+email
      - sleepychu 9y ago
        Duckduckgo wasn't so helpful with this one. :-(
    - deleted 9y ago
      [deleted]
    - adrianpike 9y ago
      Here's a couple I found: https://www.quora.com/Whats-it-like-to-receive-a-question-mark-e-mail-from-Jeff-Bezos-at-Amazon-Inc https://www.quora.com/Whats-it-like-to-receive-a-question-ma... https://www.inc.com/bill-murphy-jr/customer-service-jeff-bezos-question-mark-rule.html https://www.inc.com/bill-murphy-jr/customer-service-jeff-bez...
    - Twirrim 9y ago
      https://www.bloomberg.com/news/articles/2013-10-10/jeff-bezos-and-the-age-of-amazon-excerpt-from-the-everything-store-by-brad-stone https://www.bloomberg.com/news/articles/2013-10-10/jeff-bezo... and a little bit here: https://www.quora.com/Whats-it-like-to-receive-a-question-mark-e-mail-from-Jeff-Bezos-at-Amazon-Inc https://www.quora.com/Whats-it-like-to-receive-a-question-ma... No one inside Amazon wants to receive a question mark email from Jeff, and a number of the VPs have picked up the habit too.
- buro9 9y ago
  > This should serve as a warning to anybody else who has an Amazon account that is shared between retail and AWS. So much this. I had such an account and neglected the retail side (it was linked to amazon.com as well as AWS) as I was using a different account for retail (linked to amazon.co.uk from the days that these were separate systems). Logging on to amazon.com one day I noticed LastPass suggest I log in, so I did. To see that I hadn't ordered anything retail for 5+ years. So I requested deletion of the amazon.com account (good hygiene, delete unused accounts). Retail happily obliged... and a week later when payment failed and dunning started I realised what I had done. The account did not exist any more, I could not login to resolve this. This was entirely my mistake (and quite funny as well as terrifying), but the risk is real. Should anything happen to your retail account then your AWS account can and will suffer. I managed to resolve this, I was only using S3 and I wrote a migration tool to remotely move S3 items from one account to another, using only the auth keys that were still active. But woah... if I'd been using EC2 or anything else I would have been in a lot of trouble. Keep accounts single purpose and obvious. Use an account that only handles your AWS purchases.
- birdman3131 9y ago
  A friend had this happen to him (The unauthorized person accessing it). He sells on amazon and had all his inventory removed from being sold while this was going on. Calls did nothing. What finally worked was the amazon facebook page. He posted on there, they PMed him and he was back up and going within a couple hours where he had been getting the run around for a week or two on the phone.
- allthecybers 9y ago
  I had this happen because of a closed AWS account with 2FA that locked out my longtime Amazon.com retail account. The 2FA factor was a business phone number that I had given back to my former employer a couple of years ago. The best that AWS/Amazon support could give me is start a new Amazon.com account. At least the AWS account wasn't billing anything.
gorkonsine 9y ago
This should be a good warning about what you can expect when relying on other companies for service.
- distantsounds 9y ago
  This is such a meaningless statement. What exactly are you trying to convey?
  - tartuffe78 9y ago
    Don't ever use services provided by a third party. That's why I cut my own hair, make my own toothpaste, and create my own electricity from coal I mine myself!
    - artursapek 9y ago
      >not generating it in a home-made hamster wheel magnetic generator
    - Confiks 9y ago
      And if you want toasted bread, don't buy that $5 toaster, but source your own: http://www.thetoasterproject.org/page2.htm http://www.thetoasterproject.org/page2.htm
    - gorkonsine 9y ago
      Your comparison, and the toaster one by the responder, are nonsensical. There's a difference between a product and a service. Toothpaste is a product, not a service. AWS is a service, not a product. You can buy toothpaste anywhere; if you want to compare with AWS, AWS is like hiring a dental hygienist to come to your house twice a day and brush your teeth for you instead of doing it yourself. The hair-cutting bit is valid, but lots of people cut their own hair, especially men. The electricity bit is only partially valid; coal is a commodity that you can buy, just like toothpaste. You can also buy solar panels and make yourself totally independent of the electric utility. But it falls down because electric utilities are utilities and are regulated as such, whereas AWS is not regulated. The toaster thing is just dumb; toasters are cheap commodities. Again, the AWS comparison is hiring a butler to make your toast for you.
the_common_man 9y ago
If it's critical to your business, why not do your hosting elsewhere? Is it because you are locked in already? I am building a product that will help people migrate across cloud providers, so that's the context...
- ovao 9y ago
  Presumably he built it with AWS in mind, using their proprietary services and APIs. I'm certain if it was easy to have transitioned away from AWS, he would've already done so.
iddqd 9y ago
Might sound obvious in hindsight, but _always_ create separate AWS accounts for your different projects.
- sillysaurus3 9y ago
  Doesn't this require separate gmail addresses? If so, then that's an extremely bad idea. I already had one gmail account completely banned with no notice. I wasn't doing anything abusive -- I used it for some npm projects and a github account. Actually, is there a reasonable free gmail alternative for situations like this? I'd like to migrate. FastMail is worth paying for, but it's too expensive for one-off side projects. And while I don't trust gmail, I think I trust most services even less. EDIT: My point was, if you use a single account, it's far less likely to get banned. I think my account was caught in some sort of automated purge, since I certainly wasn't abusing anything. Some proof: http://i.imgur.com/H5RRkyP.png http://i.imgur.com/H5RRkyP.png I'm not sure which policy violation they're referring to, but all appeals failed. I lost all emails in that account, which thankfully wasn't very serious because the account was still young. eropple and drbawb pointed out that you can use plus addresses with AWS, e.g. foo+aws1@gmail.com.
  - eropple 9y ago
    You can use plus addresses for multiple AWS accounts. They're fine with that.
    - sillysaurus3 9y ago
      Cool, thanks!
      - eropple 9y ago
        No problem. Fair warning--you'll want to be pretty proactive about going in and killing all their marketing emails, because each and every account gets all of them.
  - tjoff 9y ago
Cumulonimbus 9y ago
This is what happens when you tie yourself to a single point of failure. Sure, AWS is usually pretty damn stable... But if there are issues with the company and access, a simple bit can be flipped to stop you cold in your tracks. And that's what seemed to happen here. What's the answer? Well, there isn't one now, aside begging on twitter and HN (which is undoubtedly your last option). But prior to manufactured disaster, you should have had offsite backups of all critical data. And if you were to design a cluster that used AWS, Azure, and GCE, you would be relatively immune to "We don't like you" threats. But alas, this does nothing now to ameliorate your data right now. But hopefully, you will consider a proper evaluation of SPOF, regardless if it's technical, or "arbitrary decision" based. Both lead to the same result: catastrophic downtime.
deleted 9y ago
[deleted]
chrisacky 9y ago
My recommendation would be to email jbarr[at]amazon.com directly. He will probably naturally see this thread over the course of the day though if it get's popular anyway....
steven777400 9y ago
Stories like this are frustrating and a symptom of the impact very large companies can have on multiple facets of our lives. One possible approach is to keep accounts separate for personal and each business that you are involved with. For example, you probably have at least a separate personal checking account and business checking account. Likewise, it would make sense to have all accounts used for a given business to only be used for that business. In addition to providing some safety against automated action, division of accounts provides a nice legal line, wherein if a court order requires you to disclose information, you can simply dump everything on the account without touching any of the other businesses or personal documents. Stymieing this, of course, is companies (Facebook?) that have a policy of prohibiting a single real person from having distinct accounts.
elliottcarlson 9y ago
I have yet to receive a human response from Coinbase after contacting them 59 days ago... time to nag them again.
- gist 9y ago
  Write to Fred Wilson fred@usv.com (investor in coinbase) Guaranteed that you will see the escalation that you need. You may want to provide links to others complaints about the same that you can find but make it short and simple.
Thaxll 9y ago
Always use MFA.
luckystarr 9y ago
Send an email to jeff@amazon.com Jeff Bezos himself said if you are having problems you should mail him directly. Behind this address there is a full team investigating the issue and if it's something they want to handle will actually lead to improvements for all customers.
- mistermann 9y ago
  I think if Jeff actually cared he would have put some personnel in place to back up "Your feedback is helping us build Earth's Most Customer-Centric Company". It's odd though, in my experience customer support on Amazon is amazingly good.
  - Danihan 9y ago
    Mine hasn't been. I've had all sorts of petty issues with their customer support. Basically any time something falls outside of the norm or if anything is genuinely wrong with site functionality, their remedial processes are poor.
mabbo 9y ago
The moral of the story is that your AWS account and your personal amazon buying account should be separate. As well, if you use Kindle Direct Publishing, are an Amazon Seller, work for Amazon Flex, or use the Amazon Affiliates program, each of these should also be on an independent Amazon account. This way, problems on one won't affect problems on the other.
- falcolas 9y ago
  I am not convinced such a separation would be effective. Accounts identified as being associated with a "problem" account (shared CC, addresses, etc) could also justifiably be closed. The idea being to keep "abusive" individuals from just opening a new account and resuming their abusive behavior. The only long term solution is to get a person with enough power to make their own decisions to look at your claims, but that takes quite some time and is not guaranteed to be successful.
- intrasight 9y ago
  I agree. Isolate your shit. I know it's more work, but still do it.
tjbiddle 9y ago
I love AWS - but why, oh why, is a retail account linked to it? These need to be entirely separate.
- sipos 9y ago
  This. This is the worst design flaw I am aware of in AWS. It makes no sense that Amazon's two totally different businesses, use the same account.
maxehmookau 9y ago
We had exactly the same issue. We solved it by creating a new AWS account and using that to call support. Once through, being persistent eventually (it took a week or so) saw us regain access to the account.
- Aissen 9y ago
  He did just that though.
ikeboy 9y ago
I've had the same issue with buying and selling accounts - my buying account got locked out, which prevented me from logging in to my selling account, with 50 pending orders at the time. Luckily I emailed jeff@amazon.com and got my main account unlocked within 2 days and my buying eventually got back a week or two later. Seems like they still haven't fixed the underlying issue of bots locking accounts across services.
mirekrusin 9y ago
Also having problem with AWS - can't access it and they keep billing me for something there I want to shut it down (EC2?) but I can't. I recently moved from Brazil to UK (new address) and changed phone + sim card (Authenticator after restore from backup lost all 2 factor auth entries). This is the moment when you realise that you're outside of predefined use cases of The Machine and you're fucked. Nobody is here to help you. I've tried, nobody gives a shit at Amazon. They have procedures, you know. I blame 2FA and I think it's great if you don't have problems but it's shit if you have, ie. you move places, change phones etc. in your life. Something there in the process is missing like "next of kin" recovery that should be mandatory when enabling 2FAs.
- wnevets 9y ago
  >Something there in the process is missing like "next of kin" recovery that should be mandatory when enabling 2FAs. wouldn't this just weaken the second factor? Services that have bypasses to 2FA wind up rendering it useless.
  - roywiggins 9y ago
    NearlyFreeSpeech seems to have pretty comprehensive account recovery procedures, though I can't say I've ever used them. https://faq.nearlyfreespeech.net/section/login/losteverything#losteverything https://faq.nearlyfreespeech.net/section/login/losteverythin...
- colemorrison 9y ago
  I had 2FA activated, changed phones and lost it. I couldn't log in to my account, so I contacted support. Within about 30 min they had put me back into my account. The dude who helped me was super chill and understanding as well.
  - tqkxzugoaupvwqr 9y ago
    What is the purpose of 2FA when social engineering the support team circumvents it? This should not be possible! Lost your phone? That’s what 2FA backup codes are for.
coleca 9y ago
Some great advice in here about creating multiple accounts with a + sign in the email address. One thing I didn't see mentioned that is a standard best practice for AWS is to create a separate IAM account for your day to day usage and NEVER log into your root account (unless you need to open a billing support ticket) after creating the IAM account. You will get a new login page and username to log in with and not need an email address specific account. http://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html http://docs.aws.amazon.com/IAM/latest/UserGuide/best-practic...
dredmorbius 9y ago
"Who are you?" is the most expensive question in technology. No matter how you get it wrong, you're fucked. Letting the wrong person in to an account? You're fucked. Locking the right person out of an account? You're fucked. Given that data can't be reversed as charges can, arresting an account may be slightly preferable, but it remains highly disrupting. I've been through the experience a few times myself, largely with Google. Out of a fit of pique, the temporary account I created for myself (and through which I negotiated for recovery) was "The Real Slim Shady". Several of my G+ contacts noted that they could be pretty certain that this was in fact me, though I'm a little frightened whichever way that works out. (I did have other profiles through which I could announce my plight.) I still think that the matter of idientification, or rather, the more primary matters of authentication, authorisation, integrity, validation, payment authorisation, ownership, receipts rights, and similar associations, need to be worked out. I'm also strongly in favour of a system in which a physical token -- and I think a signet ring with a very-near-field chip and accompanying sensors on mobile, laptop, and desktop devices would be just about perfect -- should be part of that systme. Not an insertable device (as with Yubikey), or something requiring keying in a value (as with RSA fobs). But something which is worn (so: on you at all times), replaceable, destroyable, discardable, but also exceedingly difficult to duplicate or appropriate, or to read without intention on the part of the owner. https://www.reddit.com/r/dredmorbius/comments/2w618r/how_to_kill_your_google_account_access_it_via_tor/ https://www.reddit.com/r/dredmorbius/comments/2w618r/how_to_...
crb002 9y ago
Time to contact your solicitor chap.
Naushad 9y ago
Expected from the earths most customer centric company. Here in India, my first order at Amazon was a fraud done by Amazon with its JV firm CloudTail. tl dr: Amazon Fulfilled product sold at fake discount and MRP mentioned on site was higher than printed MRP. https://medium.com/@snaushads/my-first-order-at-amazon-in-5cba59ac932 https://medium.com/@snaushads/my-first-order-at-amazon-in-5c...
wiradikusuma 9y ago
Since we're on this topic: Is a Google Apps account considered "seperate"? Eg I have jim_gordon@gmail.com and jim@gordon.com. So I'm thinking of centralizing all non-business to gmail.com and the rest to gordon.com.
lightedman 9y ago
Protip for everyone on this site. Look at a companys stock price. If it's in the triple digits, avoid it, because they can and will screw you over.
- grogenaut 9y ago
  Lol so Microsoft, Comcast and Sony are safe?
- lotyrin 9y ago
  Hypothetical: I have filed incorporation with a single share and deposited a Benjamin into the capital account, exactly what powers have I conjured for myself here? Should your rule be written to use market cap?
markaius 9y ago
[Deleted]
- brians 9y ago
  That's a valuable perspective. How do you propose they prevent social engineering of their staff while meeting this goal?
- TrickyRick 9y ago
  Didn't you have backup codes or a backup phone number? Bearing in mind I have no idea how 2FA for DO works, but all services where I'm using 2FA have these options, although I've yet to fall into a similar situation I imagine that it should turn out fine thanks to these options.
- ianhawes 9y ago
  Please delete your comment. I am incredibly happy that Digital Ocean made you go to those lengths to get your account back. The last thing we need is web services companies requiring less security. Social engineering attacks are typically the method of entry to hosting providers such as Digital Ocean. Frankly I would be totally fine if they required another form of ID (such as a passport) or another form of address/name verification (such as a utility bill). Or perhaps even a picture of the card on file. What is NOT okay is a lack of response, which this article is describing.
  - deleted 9y ago
    [deleted]
  - deleted 9y ago
    [deleted]
serpix 9y ago
Exact same issue. Have tried to resolve it for six months now. I've cancelled the credit card and they can f* themselves.
kbullaughey 9y ago
Any references to how one should go about separating an Amazon retail account and an AWS account, if they are presently the same?
- stephengillie 9y ago
  The best option I know is rebuilding your services in a new AWS account. That will let you can keep using the same Amazon retail account as before, and transfer your assets in AWS to an account tied to your production organization. CloudFormer[0] might be able to automate some of the process - it analyzes your existing VPC and generates a CloudFormation[1] template. You could then take this template and deploy the stack in your new account, and you'd only have to rebuild the remaining few items. Then you could redeploy all your applications, test, and migrate production services to your freshly-tested instance. Finally, you must be aggressive in shutting down the old services. It would be agonizing to have your entire site down because one server remains in the old account, and the account had some issue. Feel free to contact me for more specific advice. [0] https://www.linkedin.com/pulse/how-why-use-aws-cloudformer-ashish-kucheria-1 https://www.linkedin.com/pulse/how-why-use-aws-cloudformer-a... [1] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGui...
- cjcampbell 9y ago
  I believe it's as simple as changing the email address for your AWS account, which can be done within the account settings. You can confirm that this does the trick by updating the password and ensuring it doesn't change your retail password.
danjoc 9y ago
>This should serve as a warning to anybody else who has an Amazon account that is shared between retail and AWS. Wouldn't Amazon have locked your AWS account for unauthorized login as well? I don't see how the retail activity matters here.
stickydink 9y ago
I've been locked out of my AWS account for almost 3 years now. I have 2FA enabled, tied to a phone number I no longer have access to. I receive two emails per month. One invoice, for $0.80 (I cannot remember what is running on there, but I guess it must be something). One threatening, "Your AWS Account is about to be suspended". I've been "about to be suspended" for the entire 3 years. I want to pay the bill, I can't log in. I emailed, I phoned. Eventually I spoke to somebody, who told me the only way I could access my account was to fill in "some paperwork"[1]. They emailed that to me. It has to be notarized. I called again, they absolutely will not accept this if it is not notarized. I've explained to them that all I want to do is pay the ~$30 in bills I've accrued for 3 years. I don't mind if I never get access to the account - let me pay the bill and shut the account down, they won't have it. I don't have any free notary access, and I'm not willing to pay more than the AWS bill amount just to be able to pay the bill. I've explained that to them, and they don't seem to care about that either, they'd rather not have the bill payed and continue piling it up. [1] https://s3.amazonaws.com/AWSCS_CustomerForms/IdentityVerificationFormAffidavit.doc https://s3.amazonaws.com/AWSCS_CustomerForms/IdentityVerific...
- otoburb 9y ago
  The problem is that as they get bigger, they may soon automate delinquent account notifications to debt collection agencies which could impact your credit rating sometime down the line. You are unfortunately on the wrong side of an asymmetric relationship here.
  - throwaway76543 9y ago
    That's solved by disputing the debt. Document the good faith attempts to pay.
    - djsumdog 9y ago
      Still a hassle you shouldn't have to go through.
    - CaptSpify 9y ago
raesene6 9y ago
Whilst this is more about AWS accounts, the ability of Amazon (and other cloud providers) to lock you out of an account with very limited recourse does present some other problems. I've got quite a few ebooks I've bought via Amazon Kindle. If amazon one day decided to delete/lock my account, I would lose access to all that content which I had "bought". The more data people store in various cloud providers systems, the more the need for some kind of recovery mechanism / dispute resolution process becomes apparent. Whilst its relatively easy, in many cases, for more technical users to ensure they have backups of data that they control, less technical users could have a lot of their information tied up in these systems, and loss of it could be quite bad for them.
- djsumdog 9y ago
  You don't really buy eBooks. You can't resell them after all. You're just renting them. I'd look up some of the free tools out there and backup/un-DRM your Amazon/Nook/Google e-books. There are some guides out there for extracting your books notes as well.
  - raesene9 9y ago
    Thus my quotes around "bought" . Again whilst technical people likely know the consequences of buying DRM protected content, I think that a non-technical person who suddenly found their paid for content removed from them due to an automated process locking/deleting their account would be quite upset. People are, for better or worse, entrusting more and more of their content to cloud services, things like photographs, documents they've created, music etc etc.
  - satbyy 9y ago
    > You're just renting them. It's not renting really. If I rent a physical book (or house, etc), I have exclusive access to it. Nobody else can possess it. It's for this privilege that I'm paying. Obviously, this is not true of ebooks because 'X' persons can "rent" at the same time. You're just licensing them. You're just paying for a license which can be revoked at Amazon's whim.
kyledrake 9y ago
This is such an unfathomable problem to me. When I need someone at my DC, I just call them and they pick up the phone.
- foobarbazetc 9y ago
  You can pay Amazon for that level of support.
  - kyledrake 9y ago
    The level of support where they won't ignore my emails after locking me out of my account and compromising my production servers for a week without my consent.
Paul-ish 9y ago
They tell him to create a new account because they think the old one was compromised? I would be furious. I have bought a number of books on Kindle. If this happened to me, I would essentially lose all of the books I purchased. I'm not sure I would ever use Amazon again.
bryanthompson 9y ago
I'm one account flag change or one password reset from being in this exact situation, and it's terrifying. I have been an Audible customer since before Amazon bought them. Somewhere in their account aggregation process, I've ended up with at least four distinct logins for amazon that all use the same email address. One email address... And i use one password for audble, one for amazon, one for aws, and one for amazon affiliate. If I password reset on any one of those services, my accounts are all bricks. I've made that mistake once and had to frantically call audible support & climb through the support chains until someone could basically undo my password change. During the process, they offered to try and deduplicate my accounts, but I think we're going to need a team of senior-level DBAs to sort this shit out.
jasonrhaas 9y ago
This happened to me as well. Email jeff@amazon.com. No joke, within 24 hours I was good to go. It worked for me a few months ago.
jasonrhaas 9y ago
Email jeff@amazon.com. This same thing happened to me a few months ago. I tried everything and was banging my head against the wall. After emailing jeff@amazon.com the issue was resolved in less than 24 hours.
ordinaryperson 9y ago
I spent a month and a half locked out of my AWS account due to 2FA issues and being caught in a Mobius strip with AWS support. IMHO 2 problems with how AWS handles customer support (vs. other co's): 1. Different support rep every time = following the same script with every phone call. I'm sure assigning first available rep speeds up response times but for you, if the problem can't be resolved in 1 phone call it's like talking to someone with Alzheimer's, you're constantly re-answering the same 15 questions to a new person every time. 2. Customers are not allowed to directly interface with level 2+ support, only the nontechnical level 1 support can do that. Good luck getting them to communicate your technical issue correctly. For example, every single support rep asked me if I had 2FA disabled for my Amazon retail account (I did). After re-answering this question with every single rep, they'd file tickets with the next level of support...only to be rejected later because level 2+ said it was most likely because I had 2FA on on my Amazon retail account (I did not). It was nearly impossible to bridge this disconnect. Customer support is not easy to do well so I hesitate to widely impugn Amazon's efforts, but if you're an AWS customer and you have an issue that's an edge case outside of the scripts these support reps are using prepare to waste weeks or months of your life trying to resolve it.
slosh 9y ago
I was locked out and charged from October till May being charged. Finally got a full refund. It's a nice savings plan lol
likelynew 9y ago
Before bitcoin caught up with general public, I became interested in what it is to mine. To try it, I set up mining software in heroku. I knew even then that it is not a very nice thing to do, but it was free for me. I wasn't looking for money or something. In a day, my account was banned permanently, without prompting me of anything. While it deserved to be banned, but maxing out the CPU might even be caused by simple mistake in a legitimate way. I have a big suspicion that they can read the application code if there is a problem like this.
colinmeinke 9y ago
UPDATE: The hold has been removed from my account, and I have access again. Even though I had previously been told my account had been closed, it seems like this wasn't final. This resolution was down to an escalation of my case at Amazon, after a team member contacted me through Twitter and promised to personally look into it.
- johnhenry 9y ago
  Did they mention this article when they contacted you?
- gjmveloso 9y ago
  Glad to hear that ;)
Crontab 9y ago
This story reminds me of a friend of mine who has a second Amazon account just for his Kindle. He does that because he read a story where someone lost access to their Kindle books after Amazon closed their account. Guess this idea applies to AWS as well.
FRex 9y ago
I had two experiences getting locked out of accounts. First was an old pre-Atlassian BitBucket one that just broke due to shenanigans with Atliassian accounts integration or SOMETHING. But big props to them. I complain and I get it fixed super quick. Just how it should be. Solid 4 out of 5 (5 is for guys who managed to not lock my account due to weird mergers, I'm even OK with the weird "don't use FRex, form now on login with your email: smtsmt@gmail.com" I get on attempting 'FRex' + password). Second is Twitter. FUCK THEM so hard. Excuse my French but I have no other words for how idiotic this situation is, it'd make a saint mad. I make an Twitter account using my secondary/side gmail account that has been phone verified and 2FA using Google Auth for Andoird, verified my Twitter account by clicking link in the email they sent there, connect it to my YouTube account that has been phone verified, send out the welcoming tweet they propose (something like "Hello Twitter!", I think it was just a button press or a combo box to pick from but I might be wrong now) and I get banned for (exact wording may vary) 'suspicious/possibly automated activity' (mhmm... these huge botnets of phone verified 2FA gmail and YT accounts operating out of EU ips... good job catching me Twitter). I could of course act like a good peon and provide them a phone number and be graciously allowed by the Twitter Heavenly Emperors to use my 10 minutes old account. I write to their support via some super idiotically hidden panel of theirs on twitter while still in my 'locked' account and.. I get an automated (!) email to my gmail (!!) telling me in steps how to just fuck off and enter my phone number (!!!) and to ask for help if I don't have it unlocked after providing a phone number and waiting a few minutes ('fucktastic' was the word of the day that day, seriously, that made my day). I wrote another one, telling them to shove it (in kinder words and with zero profanity but firmly making it clear I'd not provide my number on account I did literally nothing on and want to use for YouTube connectivity to a verified channel and created on a 2FA and phone verified gmail account I verified by clicking the link in the email) and got another bot email and no reply since then (about a month ago). Total human replies: 0. Bot replies: 3+ (see below). And I'm the one running an automated operation in here. And the cherry on top: I still get trending political BS tweets (because that's what trending where I live every week) sent to my social tab in gmail and can't disable it since my account is locked and throws me to 'provide a number' screen that only has 'help' (blabbering about how I must be the one in the wrong here but if I provide a phone number..) and 'log out' available. Good fucking riddance. I truly dodged a bullet by using my alternate gmail! And all this on a service that has users that are outright bots, Nazis, terrorists (ISIS itself), hacktivists (you can argue some of it is a positive force for change or securing up but it's still highly illegal and often done just for lulz) and the like. Of course I'm not going to give in to this BS. I can sort of understand Google/YouTube with their stuff and it actually helped me once by requiring SMS verification when my kinda weak old password got cracked/guessed but what Twitter did is downright dumb extortion ("gib phon number! gib, gib, don't write support requests! 1st gib!") or them being idiots (what did I do that's suspicious exactly.. make a Twitter account in 2017?) and grossly neglecting their users (0 human reply, ever). Twitter fortunately would just be a nice-to-have for my side hobby of YTing and I have the privilege of saying "fuck no" to them for this and shitting on them on every occasion but if this was my mail gmail it'd do me in for weeks before I recovered all of my stuff. There are horror stories on YT too, see Millbee (let's plays) or I Hate Everything a.k.a. IHE(critique/shitposting), banned overnight (Millbee for a nip snip in an anime game despite all the nudity, GONE SEXUAL and borderline CP on YT going unpunished and IHE for 'community guidelines' for a video of smashing a film DVD that was later hand judged as not in violation), both returned after a social shitstorm but with no apology, explanation, nothing. I bet if I was a high up in some company and had a company account tweet what BS I went through it'd all suddenly be fixed in a jiffy with no need for my phone number. But what are internet and real life rank and file tech nobodies supposed to do..?
akhatri_aus 9y ago
I'm actually glad its this way. Its difficult to take over an account. If you can't keep your passwords in check and use 2FA you ought to lose the account & make a new one. Some kind of consistency, e.g 2FA or password is needed to keep it secure.

463 points by colinmeinke 9y ago

8 days ago I tried to log in to my Amazon retail account, and received a password invalid error. As it turned out my account had been closed, as it appeared to Amazon that it had received a suspicious log in. This is the same account that I use for AWS - hosting websites critical to my business. Today it appears I am no closer to gaining access back to my AWS account than I was on day 1, even though I have been billed as normal for my services during this time. This should serve as a warning to anybody else who has an Amazon account that is shared between retail and AWS. Linked is a list of every event and interaction I have had during the last 8 days with Amazon, via Twitter, email, phone and chat.

btown 9y ago
Are services offline or are you just locked from accessing the account?
- deleted 9y ago
  [deleted]
- colinmeinke 9y ago
  My services are still online, so it's not a total disaster (yet), but I cannot sign in to the AWS control panel.
  - emeraldd 9y ago
    Definitely time to change services ...
digi_owl 9y ago
If anything this, along with similar situation(s?) with Google, should stand as a strong warning against single sign on systems across multiple services with multiple TOS.
- willow9886 9y ago
  Why do you see this as a single sign-on issue? Seems to me the issue is over reliance on large SaaS providers. Same things happens all the time to Google users.
  - mintplant 9y ago
    Because if you lose that single sign-on account, you lose everything attached to it as well.
    - willow9886 9y ago
      Amazon offers many services, of course they are going to want users to have one set of credentials to access all those services. There are trade-offs to every security approach, but storing passwords at every web service is 100x worse.
      - Hnrobert42 9y ago
        I don't understand your concern. We all have numerous accounts all over the web. Having one or two more doesn't increase our attack surface 100x.
      - aquadrop 9y ago
        What have passwords anything to do with this?
  - MichaelGG 9y ago
    Because you're unlikey to trigger a violation on your cloud SaaS account, but could easily run afoul of other policies like "Real Name" or "Bought a Pixel Phone and Sold It" or posting something "offensive", getting reported by other users, etc. If the account is just for a cloud SaaS, then there's likely to be very few policies to disable your account.
    - willow9886 9y ago
joelrunyon 9y ago
This happened to me with instagram. I reset a password, then they detected "suspicious activity." I clicked "send pin via email" and the email never shows up. I've done it 3 or 4 times over the course of a week + it never works. It's a documented error + FB/Instagram refuse to addres it. https://medium.com/@joelrunyon/instagrams-security-features-are-broken-and-they-won-t-do-anything-about-it-16233f0935b0 https://medium.com/@joelrunyon/instagrams-security-features-...
- legohead 9y ago
  And a similar thing has happened to me with Microsoft. I needed to get to my OneDrive. I go to log in, and it says invalid password. I go to reset the password, and it never sends me an email. I go through the alternate-email update process, answer the security questions, and it doesn't believe I am who I am. When I try to get access to real support (a person), it makes me login. Back to problem #1. Also, I should note that the email on record is real and works. The only thing I can think of is I named it microsoft@mydomain, and they don't like the word microsoft in it?
  - sly010 9y ago
    Same here (email never arrived) with my Apple Developer Account.
    - wlesieutre 9y ago
      I got into a similar situation when Apple prompted me to turn on 2-factor auth, and then after I accepted it wouldn't send 2-factor codes. Thankfully the "we turned on 2-factor" email gives you a link to turn it back off within 30 days or I would have been in some trouble.
  - joelrunyon 9y ago
    This is worse because at least with mine, they send the reset password (so I know they have the right email on file). Then, when they send the PIN to the same email - it never actually shows up. Ugh.
- 9y ago
Twirrim 9y ago
In all seriousness, email jeff@amazon.com. The most likely outcome is that some relevant managers will receive one of the infamous "?" emails from him. If so, that'll result in two things: 1) Your problem will be resolved ASAP, managers right up the chain will be tracking it extremely closely, as they'll have to justify every action to Jeff. Everyone goes scrambling when one of those emails goes out. 2) A post-mortem will be done of everything that happened, with processes and procedures improved to ensure it doesn't happen again.
- sleepychu 9y ago
  Can you provide some links to stuff about the infamous "?" emails?
  - trevyn 9y ago
    This page has 10 such links. 8-) https://www.google.com/search?q=bezos+question+mark+email https://www.google.com/search?q=bezos+question+mark+email
    - sleepychu 9y ago
      Duckduckgo wasn't so helpful with this one. :-(
  - deleted 9y ago
    [deleted]
  - adrianpike 9y ago
    Here's a couple I found: https://www.quora.com/Whats-it-like-to-receive-a-question-mark-e-mail-from-Jeff-Bezos-at-Amazon-Inc https://www.quora.com/Whats-it-like-to-receive-a-question-ma... https://www.inc.com/bill-murphy-jr/customer-service-jeff-bezos-question-mark-rule.html https://www.inc.com/bill-murphy-jr/customer-service-jeff-bez...
  - Twirrim 9y ago
    https://www.bloomberg.com/news/articles/2013-10-10/jeff-bezos-and-the-age-of-amazon-excerpt-from-the-everything-store-by-brad-stone https://www.bloomberg.com/news/articles/2013-10-10/jeff-bezo... and a little bit here: https://www.quora.com/Whats-it-like-to-receive-a-question-mark-e-mail-from-Jeff-Bezos-at-Amazon-Inc https://www.quora.com/Whats-it-like-to-receive-a-question-ma... No one inside Amazon wants to receive a question mark email from Jeff, and a number of the VPs have picked up the habit too.
buro9 9y ago
> This should serve as a warning to anybody else who has an Amazon account that is shared between retail and AWS. So much this. I had such an account and neglected the retail side (it was linked to amazon.com as well as AWS) as I was using a different account for retail (linked to amazon.co.uk from the days that these were separate systems). Logging on to amazon.com one day I noticed LastPass suggest I log in, so I did. To see that I hadn't ordered anything retail for 5+ years. So I requested deletion of the amazon.com account (good hygiene, delete unused accounts). Retail happily obliged... and a week later when payment failed and dunning started I realised what I had done. The account did not exist any more, I could not login to resolve this. This was entirely my mistake (and quite funny as well as terrifying), but the risk is real. Should anything happen to your retail account then your AWS account can and will suffer. I managed to resolve this, I was only using S3 and I wrote a migration tool to remotely move S3 items from one account to another, using only the auth keys that were still active. But woah... if I'd been using EC2 or anything else I would have been in a lot of trouble. Keep accounts single purpose and obvious. Use an account that only handles your AWS purchases.
birdman3131 9y ago
A friend had this happen to him (The unauthorized person accessing it). He sells on amazon and had all his inventory removed from being sold while this was going on. Calls did nothing. What finally worked was the amazon facebook page. He posted on there, they PMed him and he was back up and going within a couple hours where he had been getting the run around for a week or two on the phone.
allthecybers 9y ago
I had this happen because of a closed AWS account with 2FA that locked out my longtime Amazon.com retail account. The 2FA factor was a business phone number that I had given back to my former employer a couple of years ago. The best that AWS/Amazon support could give me is start a new Amazon.com account. At least the AWS account wasn't billing anything.

gorkonsine 9y ago

This should be a good warning about what you can expect when relying on other companies for service.

distantsounds 9y ago
This is such a meaningless statement. What exactly are you trying to convey?
- tartuffe78 9y ago
  Don't ever use services provided by a third party. That's why I cut my own hair, make my own toothpaste, and create my own electricity from coal I mine myself!
  - artursapek 9y ago
    >not generating it in a home-made hamster wheel magnetic generator
  - Confiks 9y ago
    And if you want toasted bread, don't buy that $5 toaster, but source your own: http://www.thetoasterproject.org/page2.htm http://www.thetoasterproject.org/page2.htm
  - gorkonsine 9y ago
    Your comparison, and the toaster one by the responder, are nonsensical. There's a difference between a product and a service. Toothpaste is a product, not a service. AWS is a service, not a product. You can buy toothpaste anywhere; if you want to compare with AWS, AWS is like hiring a dental hygienist to come to your house twice a day and brush your teeth for you instead of doing it yourself. The hair-cutting bit is valid, but lots of people cut their own hair, especially men. The electricity bit is only partially valid; coal is a commodity that you can buy, just like toothpaste. You can also buy solar panels and make yourself totally independent of the electric utility. But it falls down because electric utilities are utilities and are regulated as such, whereas AWS is not regulated. The toaster thing is just dumb; toasters are cheap commodities. Again, the AWS comparison is hiring a butler to make your toast for you.

the_common_man 9y ago

If it's critical to your business, why not do your hosting elsewhere? Is it because you are locked in already? I am building a product that will help people migrate across cloud providers, so that's the context...

ovao 9y ago
Presumably he built it with AWS in mind, using their proprietary services and APIs. I'm certain if it was easy to have transitioned away from AWS, he would've already done so.

iddqd 9y ago

Might sound obvious in hindsight, but _always_ create separate AWS accounts for your different projects.

sillysaurus3 9y ago
Doesn't this require separate gmail addresses? If so, then that's an extremely bad idea. I already had one gmail account completely banned with no notice. I wasn't doing anything abusive -- I used it for some npm projects and a github account. Actually, is there a reasonable free gmail alternative for situations like this? I'd like to migrate. FastMail is worth paying for, but it's too expensive for one-off side projects. And while I don't trust gmail, I think I trust most services even less. EDIT: My point was, if you use a single account, it's far less likely to get banned. I think my account was caught in some sort of automated purge, since I certainly wasn't abusing anything. Some proof: http://i.imgur.com/H5RRkyP.png http://i.imgur.com/H5RRkyP.png I'm not sure which policy violation they're referring to, but all appeals failed. I lost all emails in that account, which thankfully wasn't very serious because the account was still young. eropple and drbawb pointed out that you can use plus addresses with AWS, e.g. foo+aws1@gmail.com.
- eropple 9y ago
  You can use plus addresses for multiple AWS accounts. They're fine with that.
  - sillysaurus3 9y ago
    Cool, thanks!
    - eropple 9y ago
      No problem. Fair warning--you'll want to be pretty proactive about going in and killing all their marketing emails, because each and every account gets all of them.
- tjoff 9y ago

Cumulonimbus 9y ago

This is what happens when you tie yourself to a single point of failure. Sure, AWS is usually pretty damn stable... But if there are issues with the company and access, a simple bit can be flipped to stop you cold in your tracks. And that's what seemed to happen here. What's the answer? Well, there isn't one now, aside begging on twitter and HN (which is undoubtedly your last option). But prior to manufactured disaster, you should have had offsite backups of all critical data. And if you were to design a cluster that used AWS, Azure, and GCE, you would be relatively immune to "We don't like you" threats. But alas, this does nothing now to ameliorate your data right now. But hopefully, you will consider a proper evaluation of SPOF, regardless if it's technical, or "arbitrary decision" based. Both lead to the same result: catastrophic downtime.

deleted 9y ago

[deleted]

chrisacky 9y ago

My recommendation would be to email jbarr[at]amazon.com directly. He will probably naturally see this thread over the course of the day though if it get's popular anyway....

steven777400 9y ago

Stories like this are frustrating and a symptom of the impact very large companies can have on multiple facets of our lives. One possible approach is to keep accounts separate for personal and each business that you are involved with. For example, you probably have at least a separate personal checking account and business checking account. Likewise, it would make sense to have all accounts used for a given business to only be used for that business. In addition to providing some safety against automated action, division of accounts provides a nice legal line, wherein if a court order requires you to disclose information, you can simply dump everything on the account without touching any of the other businesses or personal documents. Stymieing this, of course, is companies (Facebook?) that have a policy of prohibiting a single real person from having distinct accounts.

elliottcarlson 9y ago

I have yet to receive a human response from Coinbase after contacting them 59 days ago... time to nag them again.

gist 9y ago
Write to Fred Wilson fred@usv.com (investor in coinbase) Guaranteed that you will see the escalation that you need. You may want to provide links to others complaints about the same that you can find but make it short and simple.

Thaxll 9y ago

Always use MFA.

luckystarr 9y ago

Send an email to jeff@amazon.com Jeff Bezos himself said if you are having problems you should mail him directly. Behind this address there is a full team investigating the issue and if it's something they want to handle will actually lead to improvements for all customers.

mistermann 9y ago
I think if Jeff actually cared he would have put some personnel in place to back up "Your feedback is helping us build Earth's Most Customer-Centric Company". It's odd though, in my experience customer support on Amazon is amazingly good.
- Danihan 9y ago
  Mine hasn't been. I've had all sorts of petty issues with their customer support. Basically any time something falls outside of the norm or if anything is genuinely wrong with site functionality, their remedial processes are poor.

mabbo 9y ago

The moral of the story is that your AWS account and your personal amazon buying account should be separate. As well, if you use Kindle Direct Publishing, are an Amazon Seller, work for Amazon Flex, or use the Amazon Affiliates program, each of these should also be on an independent Amazon account. This way, problems on one won't affect problems on the other.

falcolas 9y ago
I am not convinced such a separation would be effective. Accounts identified as being associated with a "problem" account (shared CC, addresses, etc) could also justifiably be closed. The idea being to keep "abusive" individuals from just opening a new account and resuming their abusive behavior. The only long term solution is to get a person with enough power to make their own decisions to look at your claims, but that takes quite some time and is not guaranteed to be successful.
intrasight 9y ago
I agree. Isolate your shit. I know it's more work, but still do it.

tjbiddle 9y ago

I love AWS - but why, oh why, is a retail account linked to it? These need to be entirely separate.

sipos 9y ago
This. This is the worst design flaw I am aware of in AWS. It makes no sense that Amazon's two totally different businesses, use the same account.

maxehmookau 9y ago

We had exactly the same issue. We solved it by creating a new AWS account and using that to call support. Once through, being persistent eventually (it took a week or so) saw us regain access to the account.

Aissen 9y ago
He did just that though.

ikeboy 9y ago

I've had the same issue with buying and selling accounts - my buying account got locked out, which prevented me from logging in to my selling account, with 50 pending orders at the time. Luckily I emailed jeff@amazon.com and got my main account unlocked within 2 days and my buying eventually got back a week or two later. Seems like they still haven't fixed the underlying issue of bots locking accounts across services.

mirekrusin 9y ago

Also having problem with AWS - can't access it and they keep billing me for something there I want to shut it down (EC2?) but I can't. I recently moved from Brazil to UK (new address) and changed phone + sim card (Authenticator after restore from backup lost all 2 factor auth entries). This is the moment when you realise that you're outside of predefined use cases of The Machine and you're fucked. Nobody is here to help you. I've tried, nobody gives a shit at Amazon. They have procedures, you know. I blame 2FA and I think it's great if you don't have problems but it's shit if you have, ie. you move places, change phones etc. in your life. Something there in the process is missing like "next of kin" recovery that should be mandatory when enabling 2FAs.

wnevets 9y ago
>Something there in the process is missing like "next of kin" recovery that should be mandatory when enabling 2FAs. wouldn't this just weaken the second factor? Services that have bypasses to 2FA wind up rendering it useless.
- roywiggins 9y ago
  NearlyFreeSpeech seems to have pretty comprehensive account recovery procedures, though I can't say I've ever used them. https://faq.nearlyfreespeech.net/section/login/losteverything#losteverything https://faq.nearlyfreespeech.net/section/login/losteverythin...
colemorrison 9y ago
I had 2FA activated, changed phones and lost it. I couldn't log in to my account, so I contacted support. Within about 30 min they had put me back into my account. The dude who helped me was super chill and understanding as well.
- tqkxzugoaupvwqr 9y ago
  What is the purpose of 2FA when social engineering the support team circumvents it? This should not be possible! Lost your phone? That’s what 2FA backup codes are for.

coleca 9y ago

Some great advice in here about creating multiple accounts with a + sign in the email address. One thing I didn't see mentioned that is a standard best practice for AWS is to create a separate IAM account for your day to day usage and NEVER log into your root account (unless you need to open a billing support ticket) after creating the IAM account. You will get a new login page and username to log in with and not need an email address specific account. http://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html http://docs.aws.amazon.com/IAM/latest/UserGuide/best-practic...

dredmorbius 9y ago

"Who are you?" is the most expensive question in technology. No matter how you get it wrong, you're fucked. Letting the wrong person in to an account? You're fucked. Locking the right person out of an account? You're fucked. Given that data can't be reversed as charges can, arresting an account may be slightly preferable, but it remains highly disrupting. I've been through the experience a few times myself, largely with Google. Out of a fit of pique, the temporary account I created for myself (and through which I negotiated for recovery) was "The Real Slim Shady". Several of my G+ contacts noted that they could be pretty certain that this was in fact me, though I'm a little frightened whichever way that works out. (I did have other profiles through which I could announce my plight.) I still think that the matter of idientification, or rather, the more primary matters of authentication, authorisation, integrity, validation, payment authorisation, ownership, receipts rights, and similar associations, need to be worked out. I'm also strongly in favour of a system in which a physical token -- and I think a signet ring with a very-near-field chip and accompanying sensors on mobile, laptop, and desktop devices would be just about perfect -- should be part of that systme. Not an insertable device (as with Yubikey), or something requiring keying in a value (as with RSA fobs). But something which is worn (so: on you at all times), replaceable, destroyable, discardable, but also exceedingly difficult to duplicate or appropriate, or to read without intention on the part of the owner. https://www.reddit.com/r/dredmorbius/comments/2w618r/how_to_kill_your_google_account_access_it_via_tor/ https://www.reddit.com/r/dredmorbius/comments/2w618r/how_to_...

crb002 9y ago

Time to contact your solicitor chap.

Naushad 9y ago

Expected from the earths most customer centric company. Here in India, my first order at Amazon was a fraud done by Amazon with its JV firm CloudTail. tl dr: Amazon Fulfilled product sold at fake discount and MRP mentioned on site was higher than printed MRP. https://medium.com/@snaushads/my-first-order-at-amazon-in-5cba59ac932 https://medium.com/@snaushads/my-first-order-at-amazon-in-5c...

wiradikusuma 9y ago

Since we're on this topic: Is a Google Apps account considered "seperate"? Eg I have jim_gordon@gmail.com and jim@gordon.com. So I'm thinking of centralizing all non-business to gmail.com and the rest to gordon.com.

lightedman 9y ago

Protip for everyone on this site. Look at a companys stock price. If it's in the triple digits, avoid it, because they can and will screw you over.

grogenaut 9y ago
Lol so Microsoft, Comcast and Sony are safe?
lotyrin 9y ago
Hypothetical: I have filed incorporation with a single share and deposited a Benjamin into the capital account, exactly what powers have I conjured for myself here? Should your rule be written to use market cap?

markaius 9y ago

[Deleted]

brians 9y ago
That's a valuable perspective. How do you propose they prevent social engineering of their staff while meeting this goal?
TrickyRick 9y ago
Didn't you have backup codes or a backup phone number? Bearing in mind I have no idea how 2FA for DO works, but all services where I'm using 2FA have these options, although I've yet to fall into a similar situation I imagine that it should turn out fine thanks to these options.
ianhawes 9y ago
Please delete your comment. I am incredibly happy that Digital Ocean made you go to those lengths to get your account back. The last thing we need is web services companies requiring less security. Social engineering attacks are typically the method of entry to hosting providers such as Digital Ocean. Frankly I would be totally fine if they required another form of ID (such as a passport) or another form of address/name verification (such as a utility bill). Or perhaps even a picture of the card on file. What is NOT okay is a lack of response, which this article is describing.
- deleted 9y ago
  [deleted]
- deleted 9y ago
  [deleted]

serpix 9y ago

Exact same issue. Have tried to resolve it for six months now. I've cancelled the credit card and they can f* themselves.

kbullaughey 9y ago

Any references to how one should go about separating an Amazon retail account and an AWS account, if they are presently the same?

stephengillie 9y ago
The best option I know is rebuilding your services in a new AWS account. That will let you can keep using the same Amazon retail account as before, and transfer your assets in AWS to an account tied to your production organization. CloudFormer[0] might be able to automate some of the process - it analyzes your existing VPC and generates a CloudFormation[1] template. You could then take this template and deploy the stack in your new account, and you'd only have to rebuild the remaining few items. Then you could redeploy all your applications, test, and migrate production services to your freshly-tested instance. Finally, you must be aggressive in shutting down the old services. It would be agonizing to have your entire site down because one server remains in the old account, and the account had some issue. Feel free to contact me for more specific advice. [0] https://www.linkedin.com/pulse/how-why-use-aws-cloudformer-ashish-kucheria-1 https://www.linkedin.com/pulse/how-why-use-aws-cloudformer-a... [1] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGui...
cjcampbell 9y ago
I believe it's as simple as changing the email address for your AWS account, which can be done within the account settings. You can confirm that this does the trick by updating the password and ensuring it doesn't change your retail password.

danjoc 9y ago

>This should serve as a warning to anybody else who has an Amazon account that is shared between retail and AWS. Wouldn't Amazon have locked your AWS account for unauthorized login as well? I don't see how the retail activity matters here.

stickydink 9y ago

I've been locked out of my AWS account for almost 3 years now. I have 2FA enabled, tied to a phone number I no longer have access to. I receive two emails per month. One invoice, for $0.80 (I cannot remember what is running on there, but I guess it must be something). One threatening, "Your AWS Account is about to be suspended". I've been "about to be suspended" for the entire 3 years. I want to pay the bill, I can't log in. I emailed, I phoned. Eventually I spoke to somebody, who told me the only way I could access my account was to fill in "some paperwork"[1]. They emailed that to me. It has to be notarized. I called again, they absolutely will not accept this if it is not notarized. I've explained to them that all I want to do is pay the ~$30 in bills I've accrued for 3 years. I don't mind if I never get access to the account - let me pay the bill and shut the account down, they won't have it. I don't have any free notary access, and I'm not willing to pay more than the AWS bill amount just to be able to pay the bill. I've explained that to them, and they don't seem to care about that either, they'd rather not have the bill payed and continue piling it up. [1] https://s3.amazonaws.com/AWSCS_CustomerForms/IdentityVerificationFormAffidavit.doc https://s3.amazonaws.com/AWSCS_CustomerForms/IdentityVerific...

otoburb 9y ago
The problem is that as they get bigger, they may soon automate delinquent account notifications to debt collection agencies which could impact your credit rating sometime down the line. You are unfortunately on the wrong side of an asymmetric relationship here.
- throwaway76543 9y ago
  That's solved by disputing the debt. Document the good faith attempts to pay.
  - djsumdog 9y ago
    Still a hassle you shouldn't have to go through.
  - CaptSpify 9y ago

raesene6 9y ago

Whilst this is more about AWS accounts, the ability of Amazon (and other cloud providers) to lock you out of an account with very limited recourse does present some other problems. I've got quite a few ebooks I've bought via Amazon Kindle. If amazon one day decided to delete/lock my account, I would lose access to all that content which I had "bought". The more data people store in various cloud providers systems, the more the need for some kind of recovery mechanism / dispute resolution process becomes apparent. Whilst its relatively easy, in many cases, for more technical users to ensure they have backups of data that they control, less technical users could have a lot of their information tied up in these systems, and loss of it could be quite bad for them.

djsumdog 9y ago
You don't really buy eBooks. You can't resell them after all. You're just renting them. I'd look up some of the free tools out there and backup/un-DRM your Amazon/Nook/Google e-books. There are some guides out there for extracting your books notes as well.
- raesene9 9y ago
  Thus my quotes around "bought" . Again whilst technical people likely know the consequences of buying DRM protected content, I think that a non-technical person who suddenly found their paid for content removed from them due to an automated process locking/deleting their account would be quite upset. People are, for better or worse, entrusting more and more of their content to cloud services, things like photographs, documents they've created, music etc etc.
- satbyy 9y ago
  > You're just renting them. It's not renting really. If I rent a physical book (or house, etc), I have exclusive access to it. Nobody else can possess it. It's for this privilege that I'm paying. Obviously, this is not true of ebooks because 'X' persons can "rent" at the same time. You're just licensing them. You're just paying for a license which can be revoked at Amazon's whim.

kyledrake 9y ago

This is such an unfathomable problem to me. When I need someone at my DC, I just call them and they pick up the phone.

foobarbazetc 9y ago
You can pay Amazon for that level of support.
- kyledrake 9y ago
  The level of support where they won't ignore my emails after locking me out of my account and compromising my production servers for a week without my consent.

Paul-ish 9y ago

They tell him to create a new account because they think the old one was compromised? I would be furious. I have bought a number of books on Kindle. If this happened to me, I would essentially lose all of the books I purchased. I'm not sure I would ever use Amazon again.

bryanthompson 9y ago

I'm one account flag change or one password reset from being in this exact situation, and it's terrifying. I have been an Audible customer since before Amazon bought them. Somewhere in their account aggregation process, I've ended up with at least four distinct logins for amazon that all use the same email address. One email address... And i use one password for audble, one for amazon, one for aws, and one for amazon affiliate. If I password reset on any one of those services, my accounts are all bricks. I've made that mistake once and had to frantically call audible support & climb through the support chains until someone could basically undo my password change. During the process, they offered to try and deduplicate my accounts, but I think we're going to need a team of senior-level DBAs to sort this shit out.

jasonrhaas 9y ago

This happened to me as well. Email jeff@amazon.com. No joke, within 24 hours I was good to go. It worked for me a few months ago.

jasonrhaas 9y ago

Email jeff@amazon.com. This same thing happened to me a few months ago. I tried everything and was banging my head against the wall. After emailing jeff@amazon.com the issue was resolved in less than 24 hours.

ordinaryperson 9y ago

I spent a month and a half locked out of my AWS account due to 2FA issues and being caught in a Mobius strip with AWS support. IMHO 2 problems with how AWS handles customer support (vs. other co's): 1. Different support rep every time = following the same script with every phone call. I'm sure assigning first available rep speeds up response times but for you, if the problem can't be resolved in 1 phone call it's like talking to someone with Alzheimer's, you're constantly re-answering the same 15 questions to a new person every time. 2. Customers are not allowed to directly interface with level 2+ support, only the nontechnical level 1 support can do that. Good luck getting them to communicate your technical issue correctly. For example, every single support rep asked me if I had 2FA disabled for my Amazon retail account (I did). After re-answering this question with every single rep, they'd file tickets with the next level of support...only to be rejected later because level 2+ said it was most likely because I had 2FA on on my Amazon retail account (I did not). It was nearly impossible to bridge this disconnect. Customer support is not easy to do well so I hesitate to widely impugn Amazon's efforts, but if you're an AWS customer and you have an issue that's an edge case outside of the scripts these support reps are using prepare to waste weeks or months of your life trying to resolve it.

slosh 9y ago

I was locked out and charged from October till May being charged. Finally got a full refund. It's a nice savings plan lol

likelynew 9y ago

Before bitcoin caught up with general public, I became interested in what it is to mine. To try it, I set up mining software in heroku. I knew even then that it is not a very nice thing to do, but it was free for me. I wasn't looking for money or something. In a day, my account was banned permanently, without prompting me of anything. While it deserved to be banned, but maxing out the CPU might even be caused by simple mistake in a legitimate way. I have a big suspicion that they can read the application code if there is a problem like this.

colinmeinke 9y ago

UPDATE: The hold has been removed from my account, and I have access again. Even though I had previously been told my account had been closed, it seems like this wasn't final. This resolution was down to an escalation of my case at Amazon, after a team member contacted me through Twitter and promised to personally look into it.

johnhenry 9y ago
Did they mention this article when they contacted you?
gjmveloso 9y ago
Glad to hear that ;)

Crontab 9y ago

This story reminds me of a friend of mine who has a second Amazon account just for his Kindle. He does that because he read a story where someone lost access to their Kindle books after Amazon closed their account. Guess this idea applies to AWS as well.

FRex 9y ago

I had two experiences getting locked out of accounts. First was an old pre-Atlassian BitBucket one that just broke due to shenanigans with Atliassian accounts integration or SOMETHING. But big props to them. I complain and I get it fixed super quick. Just how it should be. Solid 4 out of 5 (5 is for guys who managed to not lock my account due to weird mergers, I'm even OK with the weird "don't use FRex, form now on login with your email: smtsmt@gmail.com" I get on attempting 'FRex' + password). Second is Twitter. FUCK THEM so hard. Excuse my French but I have no other words for how idiotic this situation is, it'd make a saint mad. I make an Twitter account using my secondary/side gmail account that has been phone verified and 2FA using Google Auth for Andoird, verified my Twitter account by clicking link in the email they sent there, connect it to my YouTube account that has been phone verified, send out the welcoming tweet they propose (something like "Hello Twitter!", I think it was just a button press or a combo box to pick from but I might be wrong now) and I get banned for (exact wording may vary) 'suspicious/possibly automated activity' (mhmm... these huge botnets of phone verified 2FA gmail and YT accounts operating out of EU ips... good job catching me Twitter). I could of course act like a good peon and provide them a phone number and be graciously allowed by the Twitter Heavenly Emperors to use my 10 minutes old account. I write to their support via some super idiotically hidden panel of theirs on twitter while still in my 'locked' account and.. I get an automated (!) email to my gmail (!!) telling me in steps how to just fuck off and enter my phone number (!!!) and to ask for help if I don't have it unlocked after providing a phone number and waiting a few minutes ('fucktastic' was the word of the day that day, seriously, that made my day). I wrote another one, telling them to shove it (in kinder words and with zero profanity but firmly making it clear I'd not provide my number on account I did literally nothing on and want to use for YouTube connectivity to a verified channel and created on a 2FA and phone verified gmail account I verified by clicking the link in the email) and got another bot email and no reply since then (about a month ago). Total human replies: 0. Bot replies: 3+ (see below). And I'm the one running an automated operation in here. And the cherry on top: I still get trending political BS tweets (because that's what trending where I live every week) sent to my social tab in gmail and can't disable it since my account is locked and throws me to 'provide a number' screen that only has 'help' (blabbering about how I must be the one in the wrong here but if I provide a phone number..) and 'log out' available. Good fucking riddance. I truly dodged a bullet by using my alternate gmail! And all this on a service that has users that are outright bots, Nazis, terrorists (ISIS itself), hacktivists (you can argue some of it is a positive force for change or securing up but it's still highly illegal and often done just for lulz) and the like. Of course I'm not going to give in to this BS. I can sort of understand Google/YouTube with their stuff and it actually helped me once by requiring SMS verification when my kinda weak old password got cracked/guessed but what Twitter did is downright dumb extortion ("gib phon number! gib, gib, don't write support requests! 1st gib!") or them being idiots (what did I do that's suspicious exactly.. make a Twitter account in 2017?) and grossly neglecting their users (0 human reply, ever). Twitter fortunately would just be a nice-to-have for my side hobby of YTing and I have the privilege of saying "fuck no" to them for this and shitting on them on every occasion but if this was my mail gmail it'd do me in for weeks before I recovered all of my stuff. There are horror stories on YT too, see Millbee (let's plays) or I Hate Everything a.k.a. IHE(critique/shitposting), banned overnight (Millbee for a nip snip in an anime game despite all the nudity, GONE SEXUAL and borderline CP on YT going unpunished and IHE for 'community guidelines' for a video of smashing a film DVD that was later hand judged as not in violation), both returned after a social shitstorm but with no apology, explanation, nothing. I bet if I was a high up in some company and had a company account tweet what BS I went through it'd all suddenly be fixed in a jiffy with no need for my phone number. But what are internet and real life rank and file tech nobodies supposed to do..?

akhatri_aus 9y ago

I'm actually glad its this way. Its difficult to take over an account. If you can't keep your passwords in check and use 2FA you ought to lose the account & make a new one. Some kind of consistency, e.g 2FA or password is needed to keep it secure.