4 ms·
An email address isn't secret, is it? It's sent back and forth in clear text through any number of relay servers. I consider my name and email address to be b
by rdiddly 8y ago
An email address isn't secret, is it? It's sent back and forth in clear text through any number of relay servers. I consider my name and email address to be basically public information. Along with (unfortunately) my Social Security number.
If Amazon exposed any data fields more sensitive than email address, I would call that stonewalling/covering up as TC seems to be implying. But otherwise it kind of just sounds like TC being all petulant that Amazon wouldn't tell it everything it wanted to know. And the motivation there is likely to be the generation of clicks, not the protection of customers.
Take the "number of users affected" for example. Knowing that info doesn't help any individual customer. But it does help journalists drum up pageviews, or at least I feel like they believe it does. Having a big number in there is like this (dubious) Holy Grail of page-irresistability. I'm just judging from how, for example, the reporters on the TV news always bug their eyes out and raise their voice and talk really slowly and emphatically any time they come to a number. "The pool was reported to be FOURTEEN FEET DEEP..." "The petition has THIRTY THOUSAND signatures..." Wow! A number! I'm supposed to be all impressed I guess! ZOMG let me throw all my money at you right now!!!!
- saltysugar 8y agoAmazon employee here, but the statement I'm making is of my own. Internally we treat customer names and email addresses as the second highest data classification. The highest one is credit card/financial/password data. What does it mean? It means that there are a bunch of requirements that a software team must fulfill and pass (reviewed by an SDE trained in the process outside the team). This makes accessing this sort of data a PITA for a lot of people, and I can see why they why they would send out notifications when a breach like this happen. Amazon takes security very seriously, and it in fact creates quite a bit of friction to many engineers. However, I'd rather than than the break things and ask for forgiveness model like some other companies (not going to name names here)
- ben509 8y agoI can confirm that names and email addresses are classified as saltysugar states, and the security reviews. So they do have to pass all those requirements for secure storage and transmission, but then names and emails are made visible by default through mechanisms like reviews, profile, wishlists, and that passes the review because it is the user's choice. I don't even think this is anything nefarious by Amazon. It's more that teams dedicated to security issues consider it out of their lane to deal with conflicts between the designed UX and actual user expectations; especially for privacy issues where even asking the person isn't a reliable way to understand what they want.
- pluma 8y ago> saltysugar Can you elaborate? I've never heard this phrase before and google results aren't very helpful.
- curiousfab 8y agoIt's not a policy, it's the username of the parent's poster.
- ben509 8y agoLOL, now I realize the wisdom of not referring to people by usernames... "saltysugar states" sounds completely plausible.
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- stupidbird 8y agoWhat's your email address?
- yesenadam 8y ago..and name and Social Security number?
- EpicEng 8y agoI notice you don't have your email address in your HN profile.
- rdiddly 8y agoI do though.