21 ms·

When I started selling the first gadget I ever made on Amazon I was so excited and was only getting a couple sales a month. If you were one of my customers I l

• ejo4041 8y ago
  I can also confirm, I can still see names and addresses, but not emails. Honestly any online retailer has to be trusted with this information, and in the fulfillment by Amazon (FBA) case, there are 3rd party sellers that have some unnecessary access to it. I personally don't actually need access to it since I do FBA exclusively.
  • lozenge 8y ago
    Without giving you the address Amazon would find it difficult to argue that you are the seller and not them. Which will probably become relevant in a case about counterfeits on Amazon's site.
  • ProAm 8y ago
    > any online retailer has to be trusted Well that is down right crazy. Most sellers are people in their garages drop shipping 3PL. I'd trust them if they were background checked....maybe
    • Raphmedia 8y ago
      The internet is based on trust. There is nothing stopping anyone that has an e-commerce website from recording a clear version of your passwords along with all of your billing address and credit card informations. There's no audits or anything.
      • ProAm 8y ago
        I agree, the scale of amazon makes it nearly impossible for any type of remediation or penalty if its abused. It would hurt the consumers life far worse than anything Amazon would be interested in looking into. Identify theft for someone shopping to save the most money to help make ends meet might ruin their life, whereas the loss of business/revenue/profit by either the seller or buyer to Amazon is laughable.
      • dogma1138 8y ago
        There are audits a large enough retailer would need a QSA audited PCI compliance report and while they can have 2 versions to avoid being flagged by the auditor their liability when getting caught would be colossal. Credit Card companies are very good at identifying the source of the leak from only a handful of fraud complaints you’ll be surprised how few places would be shared across even a small batch of cards say <50. If the retailer is large enough to make an impact they’ll get caught and dealt with very quickly and the value of credit cards and matching PII/CHD today is very low a few million cards might be worth only a few 1000’s of dollars depending on their age, source and estimated credit limit.
      • bhnmmhmd 8y ago
        > The internet is based on trust. Maybe that's why we need to move towards blockchain-based networks since trust is not required on blockchain, only proof.
        • Kye 8y ago
          Then people have to trust the people with the time, energy, and interest to know how to develop the stuff behind it. All it does is shift the trust to people who are even less accountable.
  • lozaning 8y ago
    There used to be custom report you could run from one of the advanced dashboards that would still give you the email, it was called something unintuitive in the logistics category.
• paulcole 8y ago
  Yeah, when I used to sell on Amazon about 10 years ago, I'd see celebrities' names and phone numbers. One time Jimmy Kimmel ordered some gimmicky yoga thing and wanted it overnighted to his house along with a gift card. I checked and it was his girlfriend's birthday the next day. I called up offering to gift wrap it at no charge just hoping to talk to him but I ended up getting his assistant. Still offered the gift wrapping which they appreciated.
  • deleted 8y ago
    [deleted]
  • stimmed 8y ago
    How servile of you...
• bredren 8y ago
  I also noticed complete customer data access selling a bike part I had CAMd in China last year. I realized an attack method where: 1. Find an unusual but generic product used by niche group such as a particilar adult toy. 2. Order product and sell in using existing amazon SKU (very common) at below market price point. 3. You now have difficult to procure personal data on a very specific customer segment, paid for in lost margins on the product. Reminds me somewhat of the old days of Facebooks demographic targeting to get page likes. You could build interesting lists indirectly on the cheap.
• lozaning 8y ago
  The Amazon store I ran when I worked for a VAR was the best lead generation tool the company I worked for had ever found. I sold a part that if you bought indicated to us that your annual IT spend was minimum 150K a year, and I sold dozens of these parts a week. Most companies have a customer acquisition cost, we got paid to get new customers. It's super against Amazon's TOS for resellers to contact customers outside of Amazon controlled channels, but I never lost a lot of sleep over it, and dont think people were buying much 3PAR storage off amazon anyway.
  • guiambros 8y ago
    That is likely the model of many resellers on Amazon Marketplace. Some products are so cheap (including free shipping) that they must be making money by selling my information to direct marketers. I recently started making up random names when buying from Amazon Marketplace, to see if I can spot a pattern of who's buying and who's selling databases. I'll know better in a few months...
    • dvdbloc 8y ago
      Please report your findings. This sounds like great research.
    • ikeboy 8y ago
      Seems unlikely. What's more likely is people launch products at a loss in hopes of getting good reviews and expecting to be able to raise prices later. People are fine losing money for months to build up a product. Could also be bad quality, liquidating goods on failed launches, etc
• soperj 8y ago
  any of my actual email addresses don't show up on that site. Any of the email addresses I use for random web sign ups all appear on that site. I wouldn't use my bank password on any other site, why would I use the same email address?
• amatecha 8y ago
  You only get shipping address, not billing address, right? I have always got my Amazon stuff shipped to a work office address, so hopefully have kept the residential (billing) address from sketchy sellers! heh
  • robryan 8y ago
    Just a billing/customer name but no address. Email communication goes via Amazon so they can cut you off from the customer and also so they can remove email addresses and link, but they can't do much if a seller wants to call up or send promotional material in the package.
    • amatecha 8y ago
      Hmm, I see. In the past I ordered what ended up being a scam/"mistake"-priced item on Amazon, and I left negative feedback for the seller seemingly purposely baiting & switching customers by pricing items substantially low, cancelling the order on them, and offering them a store discount if they remove the negative review (this appears to be their long-term MO, as per the countless other reviewers experiencing the same bait & switch). A rep from the respective store actually called me on my cell phone, which is not listed in my shipping address (and is not in any public listings anywhere). Amazon should be more upfront/clear about what information is actually passed to a seller on their marketplace (ignoring manually scouring through EULA/ToS).
      • robryan 8y ago
        Yeah the only reason Amazon provides the phone number is because a lot of carriers require a number to be on the label. There are some rules around it listed here: https://sellercentral.amazon.com/gp/help/external/200386250 https://sellercentral.amazon.com/gp/help/external/200386250 But yeah, it is going to be a hard one for Amazon to enforce unless a number of people complain about a seller.
• dizzystar 8y ago
  For anyone who is curious why a seller gets this much information, you have to be able to confirm the shipping address is correct. Google Maps can quicken this process. Yes, this process is automated and usually works, however, the systems don't know everything, and you have to manually override the error to ship the product. With that said, I think it's grossly irresponsible to look people up on all their social media. This is part of considering customer trust. I've yet to hear about sellers stalking customers in the real world, but IMO, there isn't any difference between doing this stuff online and the real world. Please don't do this if you are planning to be a seller.
  • tdurden 8y ago
    > I think it's grossly irresponsible to look people up on all their social media. While I agree with you in one sense, this wouldn't even be an issue if people didn't willingly post their entire lives to social media. I don't understand how one can be too upset about someone looking at data that they themselves decided to make public.
    • JoeAltmaier 8y ago
      "Their window curtains were open, Officer! I just stood outside, on the grass, with my camera and a news crew."
      • TeMPOraL 8y ago
        Curious how time has changed people's perceptions, even though the service itself didn't. Back when I started using Facebook, it was obvious that you're building a profile to be publicly accessible, i.e. viewable by random strangers, and everything you posted publicly you did with the intent of it being a part of that public profile. It was kind of like blog, but with guaranteed active audience.
        • alttab 8y ago
          Funny, because when I started using Facebook it was obvious I was building a profile to be only accessible to direct friends at my school. I could safely post party pictures without worrying who saw them. The intent has changed vastly over time. By the time I was a senior, one of my parties got busted before it started because I forgot to lock down the invite.
• lightedman 8y ago
  "If you have been on the net long enough this will creep you out: https://haveibeenpwned.com/" https://haveibeenpwned.com/" Ahh, the most useful tool made by Troy Hunt, who doesn't even realize that we've been using his database to exploit known-leaked credentials for years. Thanks, Troy. Your desire to be an internet hero has actually resulted in more victims because you gave us a large database of searchable targets to go after, even if on a hunch. Not very smart, after all, are you? Don't realize how many people aren't going to be bothered to see if they've actually been pwned, even after being told about it? BTW, Corporate MITMs are still a full security concern, no matter how you try to dismiss them. If a gov't entity gets inside, and gets MITM creds, game over. So much for your supposition of security in that scenario, like you try to ascertain against your detractors.
• a_imho 8y ago
  If you have been on the net long enough this will creep you out: https://haveibeenpwned.com/ https://haveibeenpwned.com/ Checked with lol@gmail.com, you have to add 14 other 'l's (lolllllllllllllll@gmail.com) in order to result in a green good news. How can I validate the claims? I'm a bit skeptical seeing it doubles as a sales front for 1password.com.
  • edoo 8y ago
    It just cross references emails with public hack dumps. I have 7 listed breaches on sites with the email I've had forever. Those accounts didn't compromise my opsec in any way but it is interesting to see. The average person using the net for a while has some on there. It is an interesting tool. If someone is trying to hack you they might start there and see what your old passwords looked like.
  • krageon 8y ago
    I've verified some of the reported breaches myself (from publicly available password dumps). It's not a 100% given that those matching means it's all good, but it's a pretty solid indication.
  • GiuseppaAcciaio 8y ago
    Do a bit more research: you'll find that Troy (the guy who runs the service) has been working on this for several years before any involvement with 1password, and so far he's been very transparent about what he does with breach data and also about his relationship with 1password. Whenever he gets access to an unverified dump he first tries to verify its authenticity with the company or service that was pwned, then gets in touch with people whose details are in the dump to verify if the data is real.
    • a_imho 8y ago
      I'm aware, but my question is how can I verify it myself instead of taking his word for it.
      • edoo 8y ago
• eps 8y ago
  The exact same goes for PayPal. We were routinely getting emails saying "I'm not comfortable sharing my CC info with you" (even though it goes through a processor), so ended up adding PP as an alternative. Guess what - now we get to see their full name and physical address, neither of which we need, because we sell software licenses. I'm guessing that people are more concerned with needing to deal with compromised cards than they are worried about over-sharing of sensitive personal details.
  • superflyguy 8y ago
    Why would anyone care if you had their address, or email address? Why would Amazon be interested in going into details about an email address leak? Outside of a handful of people who get excited by every leak no matter what, nobody cares. It's an email address. You get some more spam maybe? Big deal.
    • speedplane 8y ago
      People care because it begs more questions. Why is Amazon leaking email addresses? What part of their system is unsecure? Can we trust Amazon at all?
      • superflyguy 8y ago
        Presumably because nobody cares about the security of email addresses. The part of their system which handles credit cards hasn't been shown to be compromised, but maybe Gmail's spam filter needs to work a little harder. (I've already spent longer writing this than I spend going through my spam folder each year)
        • speedplane 8y ago
          If a company's user email list is hacked, how much harder is it to attack other information? Financial information (e.g., credit cards) usually get extra security, but plenty of other information is typically stored right next to email addresses (e.g., user behavior history, IP addresses, signup dates, pricing info, password hashes, friend connections, etc etc etc). So whenever a company says that only their user email addresses were compromised and nothing more, I'm pretty skeptical of the validity of their assertions.
• Nursie 8y ago
  I love that site. Thankfully I'm in the habit of using throwaway passwords for sites I consider throwaway. I have noticed recently that I've been getting a lot of extortion spam, demanding bitcoin and saying that they know my passwords have compromising footage of me, having pwned all my devices. For proof they include a password I used on something like pandora, to the service-specific email address I set up for pandora. It's quite funny but I bet it's caught quite a few people with a guilty conscience out.
• deleted 8y ago
  [deleted]
• deleted 8y ago
  [deleted]
• hnaj 8y ago
  Mortgages and mugshots only if you live in the U S of A.