8 ms·

Everyone has an opinion on why Amazon is a monopoly and should be broken up, but this is what they don't think about. I trust Amazon not to get breached. No one

Everyone has an opinion on why Amazon is a monopoly and should be broken up, but this is what they don't think about. I trust Amazon not to get breached. No one is infallible, but tech is their thing. I have no interest however, in further increasing the amount of online shopping accounts I maintain, because that means I have to keep tabs on the shenanigans of even more, highly technically incompetent, companies to know if I've been compromised.

symlinkk 7y ago
Just use a password manager so you can have a different password for each site. It's not that hard.
- jvagner 7y ago
  The article points out that MoviePass had user and credit card data in plain text. A password manager wouldn't have helped with that.
  - checker 7y ago
    The credit agencies are supposed to protect cardholders via PCI DSS audits (see https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...). This is definitely non-compliant. Obviously this system is broken. Additionally, I don't understand why companies continue to roll their own payment processing rather than paying a service that knows how to do it. I guess it seems easy...
    - tsukurimashou 7y ago
      Well if you can make more profit, have all the advantages without being PCI DSS compliant. Why would you not roll your own payment processing? Since nothing happens apparently when the data of your customers get "breached"
      - AdieuToLogic 7y ago
        > Why would you not roll your own payment processing? There are various "financial hammers" these types of breaches will induce, depending on the network (Visa, MasterCard, etc.). Plus, processors (the banks) will put the liability onto Merchants which are shown to have violated thier ToS. Storing PAN's in clear text (or at all in some cases) is certain to trigger one or both of these ramifications.
        heavenlyblue 7y ago
        What about being “big enough that they will discount all of these ramifications”?
    - nineears 7y ago
      PCI DSS is a program of the card associations to protect the issuing banks from fraud losses. Merchants have difficulty complying so it ends up as a balancing act between keeping the wheels of commerce moving and preventing fraud. Fully outsourced payment solutions are a good fit for some business models but not for others.
      - AdieuToLogic 7y ago
        Great post. One thing I would add is that PCI DSS is also applicable for ISO's as well VAR's which operate payment processing gateways.
- realshowbiz 7y ago
  It is a hard-ish habit to start, and fully migrate into. But easy to maintain
- soulofmischief 7y ago
  I do use a password manager. Offline, in a separate VM. No amount of password security is going to protect my credit card information, address, phone number, shopping data, and other PI from being leaked by incompetent companies.
- aloknnikhil 7y ago
  That and 2FA. If a service fucks even 2FA up, then I don't know.
save_ferris 7y ago
Aspects of Amazon's businesses have been breached in the past. One could argue that tech is Facebook's thing too, but that didn't stop them from storing millions of passwords in plaintext[0]. Drinking the kool-aid of a big tech brand does not a secure platform make. Amazon is inevitably gonna get hit again someday precisely because they're Amazon. Whether or not they could theoretically provide a more secure service has no bearing on the monopoly argument because the moment that we accept companies completely destroying fundamental tenets of capitalism (i.e. not controlling a market) because they can do it better is the moment that capitalism truly begins to die. Amazon shouldn't have the power to control the ecommerce market regardless of their security, and the fact that there are people out there willing to make this trade-off kinda scares me. It's also not that hard to replace a credit card since the industry has been regulated to cooperate with consumers on fraudulent claims. As another user mentioned, password managers help here too. 0: https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/ https://krebsonsecurity.com/2019/03/facebook-stored-hundreds...
- darkerside 7y ago
  > Aspects of Amazon's businesses have been breached in the past What a vague condemnation. And is your post about security on its merits (examples of breaches please, unless you mean improperly configured S3 buckets)? Or is it just unrelated anti monopoly concerns?
  - mc32 7y ago
    They may have insider knowledge they ought not make public but can make vague remarks so as to not make things uncomfortable for parties involved.
  - save_ferris 7y ago
    If only there was a tool that you could enter search terms for and get results from :) Black Friday 2018, names and emails leaked: https://www.theguardian.com/technology/2018/nov/21/amazon-hit-with-major-data-breach-days-before-black-friday https://www.theguardian.com/technology/2018/nov/21/amazon-hi... Amazon Kindle 2016, 80K names, emails, IP addresses, etc. Worth noting that Amazon has denied that this was a legit breach: https://www.mic.com/articles/148207/a-hacker-claims-to-have-leaked-80-000-amazon-users-passwords-and-personal-information#.t1h8RH0Z7 https://www.mic.com/articles/148207/a-hacker-claims-to-have-... Zappos (Amazon subsidiary) names, emails, billing info on 24M users leaked: https://www.zdnet.com/article/amazons-zappos-in-massive-data-breach-24-million-affected/ https://www.zdnet.com/article/amazons-zappos-in-massive-data... Whole Foods (Amazon subsidiary), credit card data breach: https://media.wholefoodsmarket.com/news/whole-foods-market-payment-card-investigation-notification https://media.wholefoodsmarket.com/news/whole-foods-market-p...
kbos87 7y ago
The fact that you think they’ll keep your password safe is a terrible reason to support a monopoly that is bad for society in so many other ways. But hey, it’s more convenient I guess.
- austhrow743 7y ago
  They didn't say anything about passwords. This was credit cards and address information. An online retailer breach could be purchase history on top of that.
ryanlol 7y ago
>I have to keep tabs on the shenanigans of even more, highly technically incompetent, companies to know if I've been compromised. But why not just assume that your data has already been compromised? It has. What could you even do with that information? How do you respond when you find out that your data has been leaked?

symlinkk 7y ago

Just use a password manager so you can have a different password for each site. It's not that hard.

jvagner 7y ago
The article points out that MoviePass had user and credit card data in plain text. A password manager wouldn't have helped with that.
- checker 7y ago
  The credit agencies are supposed to protect cardholders via PCI DSS audits (see https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...). This is definitely non-compliant. Obviously this system is broken. Additionally, I don't understand why companies continue to roll their own payment processing rather than paying a service that knows how to do it. I guess it seems easy...
  - tsukurimashou 7y ago
    Well if you can make more profit, have all the advantages without being PCI DSS compliant. Why would you not roll your own payment processing? Since nothing happens apparently when the data of your customers get "breached"
    - AdieuToLogic 7y ago
      > Why would you not roll your own payment processing? There are various "financial hammers" these types of breaches will induce, depending on the network (Visa, MasterCard, etc.). Plus, processors (the banks) will put the liability onto Merchants which are shown to have violated thier ToS. Storing PAN's in clear text (or at all in some cases) is certain to trigger one or both of these ramifications.
      - heavenlyblue 7y ago
        What about being “big enough that they will discount all of these ramifications”?
  - nineears 7y ago
    PCI DSS is a program of the card associations to protect the issuing banks from fraud losses. Merchants have difficulty complying so it ends up as a balancing act between keeping the wheels of commerce moving and preventing fraud. Fully outsourced payment solutions are a good fit for some business models but not for others.
    - AdieuToLogic 7y ago
      Great post. One thing I would add is that PCI DSS is also applicable for ISO's as well VAR's which operate payment processing gateways.
realshowbiz 7y ago
It is a hard-ish habit to start, and fully migrate into. But easy to maintain
soulofmischief 7y ago
I do use a password manager. Offline, in a separate VM. No amount of password security is going to protect my credit card information, address, phone number, shopping data, and other PI from being leaked by incompetent companies.
aloknnikhil 7y ago
That and 2FA. If a service fucks even 2FA up, then I don't know.

save_ferris 7y ago

Aspects of Amazon's businesses have been breached in the past. One could argue that tech is Facebook's thing too, but that didn't stop them from storing millions of passwords in plaintext[0]. Drinking the kool-aid of a big tech brand does not a secure platform make. Amazon is inevitably gonna get hit again someday precisely because they're Amazon. Whether or not they could theoretically provide a more secure service has no bearing on the monopoly argument because the moment that we accept companies completely destroying fundamental tenets of capitalism (i.e. not controlling a market) because they can do it better is the moment that capitalism truly begins to die. Amazon shouldn't have the power to control the ecommerce market regardless of their security, and the fact that there are people out there willing to make this trade-off kinda scares me. It's also not that hard to replace a credit card since the industry has been regulated to cooperate with consumers on fraudulent claims. As another user mentioned, password managers help here too. 0: https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/ https://krebsonsecurity.com/2019/03/facebook-stored-hundreds...

darkerside 7y ago
> Aspects of Amazon's businesses have been breached in the past What a vague condemnation. And is your post about security on its merits (examples of breaches please, unless you mean improperly configured S3 buckets)? Or is it just unrelated anti monopoly concerns?
- mc32 7y ago
  They may have insider knowledge they ought not make public but can make vague remarks so as to not make things uncomfortable for parties involved.
- save_ferris 7y ago
  If only there was a tool that you could enter search terms for and get results from :) Black Friday 2018, names and emails leaked: https://www.theguardian.com/technology/2018/nov/21/amazon-hit-with-major-data-breach-days-before-black-friday https://www.theguardian.com/technology/2018/nov/21/amazon-hi... Amazon Kindle 2016, 80K names, emails, IP addresses, etc. Worth noting that Amazon has denied that this was a legit breach: https://www.mic.com/articles/148207/a-hacker-claims-to-have-leaked-80-000-amazon-users-passwords-and-personal-information#.t1h8RH0Z7 https://www.mic.com/articles/148207/a-hacker-claims-to-have-... Zappos (Amazon subsidiary) names, emails, billing info on 24M users leaked: https://www.zdnet.com/article/amazons-zappos-in-massive-data-breach-24-million-affected/ https://www.zdnet.com/article/amazons-zappos-in-massive-data... Whole Foods (Amazon subsidiary), credit card data breach: https://media.wholefoodsmarket.com/news/whole-foods-market-payment-card-investigation-notification https://media.wholefoodsmarket.com/news/whole-foods-market-p...

kbos87 7y ago

The fact that you think they’ll keep your password safe is a terrible reason to support a monopoly that is bad for society in so many other ways. But hey, it’s more convenient I guess.

austhrow743 7y ago
They didn't say anything about passwords. This was credit cards and address information. An online retailer breach could be purchase history on top of that.

ryanlol 7y ago

>I have to keep tabs on the shenanigans of even more, highly technically incompetent, companies to know if I've been compromised. But why not just assume that your data has already been compromised? It has. What could you even do with that information? How do you respond when you find out that your data has been leaked?