4 ms·

I'm pretty sure Amazon allows unlimited accounts as long as you have different passwords. This is beyond bizarre. I have at least 2 accounts with the same emai

by ada1981 9y ago

I'm pretty sure Amazon allows unlimited accounts as long as you have different passwords. This is beyond bizarre. I have at least 2 accounts with the same email and the way into it is by knowing what password leads to which one. I have yet to see what happens if I try to set both accounts to the same password.

r00fus 9y ago
This is hard to believe. So you're saying that they hash/bcrypt (user+pass) to determine uniqueness?
- ada1981 9y ago
  I have at least two accounts; same email; I have two passwords and sometimes I screw it up. I'm trying to think of a simple way to screenshot / show this without leaking person info...
- teraflop 9y ago
  Maybe, or maybe they just test the password you enter against all of the accounts when you try to log in. However it's implemented, this is a well-known, long-standing "feature" of Amazon. I think it happened to me once when I first tried to sign up for AWS, and accidentally ended up with a second Amazon account. See http://adaptivepath.org/ideas/the-woes-of-multiple-accounts/ http://adaptivepath.org/ideas/the-woes-of-multiple-accounts/
- ada1981 9y ago
  I just took a screenshot of being logged into both accounts. https://imgur.com/a/jxmhI https://imgur.com/a/jxmhI
  - r00fus 9y ago
    How did you get the 2nd account in the first place? I'd like to reproduce this.
    - ada1981 9y ago
      I guess I signed up for a new account with the same email and set a diff password? Pretty sure that is all it takes.
- stordoff 9y ago
  I don't know how it's implemented, but it's definitely the case -- I can currently log into two different accounts with the same email, depending solely on which password I use. I have a deliberately typo in my name on one of them so I can easily tell which I'm logged into.
bxu 9y ago
Is this really possible? So when you reset password, anyone know which account will it reset?
delecti 9y ago
They used to allow this, but AFAIK they don't anymore. I don't believe you'd be able to sign up a new account with that same email, and if you changed the email address on one, you wouldn't be able to change it back. Source: I used to work at Amazon, though never on any systems that would be directly involved in this.

r00fus 9y ago

This is hard to believe. So you're saying that they hash/bcrypt (user+pass) to determine uniqueness?

ada1981 9y ago
I have at least two accounts; same email; I have two passwords and sometimes I screw it up. I'm trying to think of a simple way to screenshot / show this without leaking person info...
teraflop 9y ago
Maybe, or maybe they just test the password you enter against all of the accounts when you try to log in. However it's implemented, this is a well-known, long-standing "feature" of Amazon. I think it happened to me once when I first tried to sign up for AWS, and accidentally ended up with a second Amazon account. See http://adaptivepath.org/ideas/the-woes-of-multiple-accounts/ http://adaptivepath.org/ideas/the-woes-of-multiple-accounts/
ada1981 9y ago
I just took a screenshot of being logged into both accounts. https://imgur.com/a/jxmhI https://imgur.com/a/jxmhI
- r00fus 9y ago
  How did you get the 2nd account in the first place? I'd like to reproduce this.
  - ada1981 9y ago
    I guess I signed up for a new account with the same email and set a diff password? Pretty sure that is all it takes.
stordoff 9y ago
I don't know how it's implemented, but it's definitely the case -- I can currently log into two different accounts with the same email, depending solely on which password I use. I have a deliberately typo in my name on one of them so I can easily tell which I'm logged into.

bxu 9y ago

Is this really possible? So when you reset password, anyone know which account will it reset?

delecti 9y ago

They used to allow this, but AFAIK they don't anymore. I don't believe you'd be able to sign up a new account with that same email, and if you changed the email address on one, you wouldn't be able to change it back. Source: I used to work at Amazon, though never on any systems that would be directly involved in this.