15 ms·
Amazon admits it exposed customer email addresses, but refuses to give details
- fredley 8y agoThis is one of the less appreciated clauses of the GDPR: That companies are required to disclose data breaches within a reasonable time-frame, and users have the right to know about any exposure of their data.
- behringer 8y agoIt sounds like they did that but TC wants more. I'm not really sure why HN allows techcrunch stories on the front page. TC is tabloid journalism at its finest.
- giancarlostoro 8y agoThere's been now and then reasonable TC articles that produced good conversations here on HN though. They also make mention of a reasonable number of startups which is obviously something that sparks interest to many here on HN.
- p49k 8y agoThey did not disclose any of the following as specified by the data breach notification requirements of the GDPR: The name and contact details of the data protection officer or other contact point where more information can be obtained The likely consequences of the personal data breach The measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects The are also required to submit the following information to EU authorities, but have given no indication that they have done so or are planning to: The categories and approximate number of data subjects concerned The categories and approximate number of personal data records concerned The mail that Amazon sent to affected customers was barebones and contained almost no information.
- behringer 8y agoWe could really use a good journalist to go out and find the answers to those questions right about now.
- ganeshkrishnan 8y agoI think only Amazon Europe account was leaked. We have account in couple of countries and I got the email only on my UK account.
- ZuBB 8y agoI am in Eastern Europe and have account only in US Amazon. This morning I also got that email..
- jessaustin 8y agoI live in USA, have only ever used Amazon in USA, and I got the email.
- beezle 8y agoI am in the US and got the email to my personal account, not my seller account.
- ghusbands 8y agoThey probably aren't obliged to speak to TechCrunh or any of the media about it, though.
- switch007 8y ago> It sounds like they did Which parts of the specific GDPR requirements did they comply with?
- behringer 8y agoGDPR isn't a US law.
- cyphar 8y agoBut Amazon is an EU company. They're incorporated in Luxembourg in order to avoid taxes, making them subject to EU laws (after all, they are subject to Luxembourg tax laws -- that's why they structured their business that way). You can't have your cake and eat it.
- kodablah 8y ago> This is one of the less appreciated clauses of the GDPR One wonders if this clause should have instead been its own, separate, narrowly focused legislation and enforced specifically as such.
- markovbot 8y agoAny particular reason? Seems like a reasonable thing for the GDPR to have.
- kodablah 8y agoSame reason you might do a gradual refractor instead of a large software rewrite. The more narrowly scoped a piece of legislation, the more feedback and implementation/enforcement can be tailored to the satisfaction of all before increasing scope (or not if ineffective). In the GDPR's case, it superseded existing data protection legislation because of a somewhat opposite mindset: the scope/consequences/enforcement weren't large enough. Also, such size potentially dilutes differing priorities by lumping several goals together thereby marrying its implementation success/failure to the general success/failure of the overall legislation.
- davewritescode 8y agoWriting laws is like writing software in every way except: 1. You have hundreds of code reviewers, many of whom will have their own motivations 2. The code base is hundreds of years old, poorly maintained and often contradictory in its goals. 3. You have hundreds of millions users.
- aidenn0 8y ago4. the machine that executes the code is ill-defined and will change far before the code you write is retired.
- coolaliasbro 8y ago
- jiveturkey 8y agobased on spam email i have received, that i clearly should not have, i believe this was an exposure to marketplace sellers from whom you have bought a product. I am very careful with my email. i’m not just guessing here. i actually reported it to amazon security. (no answer from them of course.)
- dingaling 8y agoeBay are particularly careless in that regard. There's no reason that a seller should ever see the customer's actual e-mail address on such a site but I'm up to ebay5@ on my mail server due to direct spam from sellers from whom I bought one item in the past. No, sellers, I did not 'opt in' to your spam just because I bought something. But why does eBay ever give them the address? Oddly I've never had a problem with random Chinese sellers, it's always Euro or US ones.
- dylz 8y agoChinese sellers have been very pleasant to deal with IME, including obviously hand-written niceties, handwritten thank you notes (maybe not in the best English but the sentiment is there) for a bunch of stuff. Occasionally small 'gift' items, have gotten Chinese fun-size snacks too. There are US sellers that have resulted in 27+ emails _within one day of purchase_, one seller has managed to sign my ebay_a10f9@ alias up for five separate companies reselling third party warranties / affiliate spam for the above. What the fuck?
- deleted 8y ago[deleted]
- CamperBob2 8y agoI have a different point of view as a longtime eBay user on both the buying and selling side. The more the company acted to "re-intermediate" buyer-seller interaction by doing things like restricting auction content, channeling communication through their own messaging system, concealing identities in feedback to prevent buyers and sellers from doing reasonable due diligence on each other, prohibiting various payment methods in order to shove PayPal down everyone's throats, and so on, the less interested I became in using eBay in general. There was a strong sense of community on eBay in the company's early years that gradually went away over the years, and I still miss it. eBay is now dominated by medium-to-high volume corporate sellers, and that was not how it was originally supposed to work.
- ben509 8y ago"Besides the brevity, what's giving people pause is they sign the email http://Amazon.com http://Amazon.com Why cap the "a" and why no https:// https://? Strange" This one is easy to answer: the customer support people aren't particularly technical. In many ways, Amazon is a weird mashup of a traditional retailer and a tech company.
- hbosch 8y agoYeah, this is one of those things that might look weird at first but is probably just a wonky quirk of bureaucratic systems, PR engagement, non-technical writers and probably even autocorrect. It's not far from the realm of possibility that someone tried to sign off a pre-written e-mail with "Amazon.com" and somewhere along the line a token "http://" http://" got added to it by sheer mistake. That being said, one of the biggest companies in the world should be more attentive when sending out e-mails like this.
- ouaiueoaieaeoiu 8y agoTo add insult to injury, http://amazon.com http://amazon.com redirects (301) to https://amazon.com https://amazon.com, but does not publish HSTS headers nor is it in the hstspreload list (but www.amazon.com is). https://hstspreload.org/?domain=amazon.com https://hstspreload.org/?domain=amazon.com https://hstspreload.org/?domain=www.amazon.com https://hstspreload.org/?domain=www.amazon.com
- edoo 8y agoWhen I started selling the first gadget I ever made on Amazon I was so excited and was only getting a couple sales a month. If you were one of my customers I looked at your house, judged your grass, found you on LinkedIn and Facebook, Instagram, mortgages, mugshots, everything lol. The sellers also get your full name and address even on fulfilled by Amazon. If you have been on the net long enough this will creep you out: https://haveibeenpwned.com/ https://haveibeenpwned.com/
- ejo4041 8y agoI can also confirm, I can still see names and addresses, but not emails. Honestly any online retailer has to be trusted with this information, and in the fulfillment by Amazon (FBA) case, there are 3rd party sellers that have some unnecessary access to it. I personally don't actually need access to it since I do FBA exclusively.
- lozenge 8y agoWithout giving you the address Amazon would find it difficult to argue that you are the seller and not them. Which will probably become relevant in a case about counterfeits on Amazon's site.
- ProAm 8y ago> any online retailer has to be trusted Well that is down right crazy. Most sellers are people in their garages drop shipping 3PL. I'd trust them if they were background checked....maybe
- garysahota93 8y agoWasn't there another post on HN of this?
- ProAm 8y agoI think it got black holed by the mods.
- hef19898 8y agoOne comment further down stated that it might have affected marketplace sellers. Amazon doesn't really put the same amount of thought and resources on marketplace than Amazon retail even if they should IMHO. Regardless, that's AFAIK the first time that ever happened to Amazon. Bad enough if it was third party sellers. A catastrophe if it was Amazon customers. With all the controversy regarding counterfeits in some countries an incident that bears the risk of impacting customer trust is the last thing Amazon needs. Maybe I should have sold my stock 4 months ago... But maybe Q4 will be stellar and stock goes up again in January. I should think about a stop order, just in case Q4 disappoints that year.
- asdfighidsf 8y agoThrowaway account. - Amazon US/CA/DE/UK/ES users registered and reviewed before this year: your Email is probably crawled. - Amazon users who registered recently: MAYBE you are safe. - Account before 2015: your Email is basically public. - Chances that your Email can be acquired: 25~30%. My guess: Amazon wanted to make a social platform. They reverted the idea after sellers started to spam negative reviewers.
- jumpinalake 8y agoThe video advertisement on the linked webpage crashed Safari on my iPhone.
- deleted 8y ago[deleted]
- erbium 8y agoWould explain the billions of new spam emails I've been receiving.
- gnulinux 8y agoI don't understand this. In the American startup I'm working we're extremely careful with respectful data practices due to ethics and GDPR (we have a lot European customers). Why doesn't Amazon give a shit about GDPR? Do they have a leverage?
- kodablah 8y ago> Why doesn't Amazon give a shit about GDPR? I would assume perceived toothlessness. A better question is why should they? Or else what? Is that "what" absorbable by them to not eagerly spend a bunch of money and be shown to kowtow to governments making very large internet laws? Can they just pay it some lip service for now like their peers?
- buboard 8y agoamazon doesn't have european headquarters
- gnulinux 8y agoThis is irrelevant as long as they have customers whose rights are protected by GDPR.
- buboard 8y agoi am mistaken. But the idea is , if they were not based in europe , which country's DPA is going to go after them? Where will the money be paid?
- jlawer 8y agoBut they have european entities (AWS, fulfilment centres, etc). If they don't choose to put themselves somewhere, everyone may go after them separately.
- buboard 8y ago... and then they can negotiate with the country that gives them the smallest punishment. (under gdpr only one will go after them at a time).
- deleted 8y ago[deleted]
- isarang 8y agoWatch this space https://amazon.com/profile https://amazon.com/profile
- danielor 8y agoHmm... it seems this drip of bad news in big tech is setting up for some heated debates on regulation. It will be interesting how proactive the Europeans are with GDPR.
- deleted 8y ago[deleted]
- moneil971 8y agoEvery major tech company has had this problem, yet people still keep sharing their personal info (even home address, phone numbers, social security numbers) online. Don't share anything you wouldn't yell out on a crowded street to strangers.
- rdiddly 8y agoAn email address isn't secret, is it? It's sent back and forth in clear text through any number of relay servers. I consider my name and email address to be basically public information. Along with (unfortunately) my Social Security number. If Amazon exposed any data fields more sensitive than email address, I would call that stonewalling/covering up as TC seems to be implying. But otherwise it kind of just sounds like TC being all petulant that Amazon wouldn't tell it everything it wanted to know. And the motivation there is likely to be the generation of clicks, not the protection of customers. Take the "number of users affected" for example. Knowing that info doesn't help any individual customer. But it does help journalists drum up pageviews, or at least I feel like they believe it does. Having a big number in there is like this (dubious) Holy Grail of page-irresistability. I'm just judging from how, for example, the reporters on the TV news always bug their eyes out and raise their voice and talk really slowly and emphatically any time they come to a number. "The pool was reported to be FOURTEEN FEET DEEP..." "The petition has THIRTY THOUSAND signatures..." Wow! A number! I'm supposed to be all impressed I guess! ZOMG let me throw all my money at you right now!!!!
- saltysugar 8y agoAmazon employee here, but the statement I'm making is of my own. Internally we treat customer names and email addresses as the second highest data classification. The highest one is credit card/financial/password data. What does it mean? It means that there are a bunch of requirements that a software team must fulfill and pass (reviewed by an SDE trained in the process outside the team). This makes accessing this sort of data a PITA for a lot of people, and I can see why they why they would send out notifications when a breach like this happen. Amazon takes security very seriously, and it in fact creates quite a bit of friction to many engineers. However, I'd rather than than the break things and ask for forgiveness model like some other companies (not going to name names here)
- ben509 8y agoI can confirm that names and email addresses are classified as saltysugar states, and the security reviews. So they do have to pass all those requirements for secure storage and transmission, but then names and emails are made visible by default through mechanisms like reviews, profile, wishlists, and that passes the review because it is the user's choice. I don't even think this is anything nefarious by Amazon. It's more that teams dedicated to security issues consider it out of their lane to deal with conflicts between the designed UX and actual user expectations; especially for privacy issues where even asking the person isn't a reliable way to understand what they want.
- kull 8y agoThis is how it looked for me: I few days ago I was shopping on Amazon and they showed me a message, you already purchased this product. See order details. I was surprised since I did not buy it before. After clicking the link, I was shown details of not my order, including name, address and email where a product was shipped to.
- tyingq 8y agoMaybe someone released a pretty aggressive page cache to help handle "Black Friday" shopping.
- andrewflnr 8y agoUh, that just sounds completely unrelated. You didn't get your "email" "exposed", your account got pwned.
- kull 8y agoWhy so? This is how somebody's data was exposed to me, and how my data was exposed to somebody else.
- andrewflnr 8y agoAh, I see what you mean, at least about the other person's data being exposed to you. I interpreted your story as someone making unauthorized purchases on your account. Do you think they accidentally merged your account or order history with this other person's? That's much worse than what they're currently admitting to, to say the least. My other question is where you saw the email address on the order record. I'm looking at my order history and can't even find my own email.
- sharkweek 8y agoAmazon is being so strangely cagey about this - I followed up on the email asking who saw my email, and they sent back the exact same response.
- rhizome 8y agoAren't all programming mistakes and bugs "technical errors?"
- Tsubasachan 8y agoAmazon and my spam filter have a long and intimate relationship.