14 ms·

Getting my personal data from Amazon was weeks of confusion and tedium

362 points by Ansil849 5y ago

Terry_Roll 5y ago
One the things people can ask for is who data is shared with. Its a massive paper trail but so many entities dont want to comply with data protection laws, its not just big tech its any large entity because interpretation of the laws is so vague, but thats the beauty of legislation, its vague.
inopinatus 5y ago
One of those relatively few circumstances where structuring the company into service teams is nothing but a hurdle, rather than a net advantage, to delivering on customer expectations.
7373737373 5y ago
I had the exact same experience. I wouldn't mind if they would be sued for this. It's audacious, a dark pattern, user hostile, lazy.
- MaxGanzII 5y ago
SpicyLemonZest 5y ago
The full, complete set of tedium the author describes is: * Navigate through a handful of pages. * Scroll to the bottom of a menu. * Click an email confirmation link. * Wait 19 days. * Click 74 download links. That last part is pretty dumb! But it's also the only thing that seems remotely tedious, and I'm not sure where at any point he'd be confused. The author implies some sort of issue with the 19 day waiting period, but it seems entirely plausible to me that many of the datasets being requested have "ask an engineer to run through this long manual process" as a dependency.
- pacaro 5y ago
  I very much doubt that there is any human interaction on the Amazon end of this workflow. What seems more likely is that because this doesn't generate revenue it gets the minimum resources necessary to complete the request within some legally mandated time frame. The request probably sits in queues for most of its life. If a court order requests these same data, I suspect that it can be produced in under 24 hours
  - deleted 5y ago
    [deleted]
  - whoknew1122 5y ago
    And you'd be wrong. There are humans involved at every level of GDPR requests. Signed, Someone who has handled such requests for AWS
    - pacaro 5y ago
      That feels like an untenable solution, it wouldn't take much to create a denial of service...
      - shadowgovt 5y ago
        Very little about GDPR was designed with technical reality in mind. It's a grand example of using the mallet of law to try and beat the world into the shape someone wants it in, ignorant of why it's in the shape it's currently in.
- mschuster91 5y ago
  > That last part is pretty dumb! It's not just dumb, the whole process is at the edges of the law. Art. 12 GDPR mandates "intelligible and easily accessible form", which navigating through a number of pages, wait times and finally a 74-link download is certainly not fulfilling. The gold standard, for what it's worth, is a direct link from the privacy policy page in the section that details GDPR subject rights to the page that provides the download - basically, three clicks in total. > but it seems entirely plausible to me that many of the datasets being requested have "ask an engineer to run through this long manual process" as a dependency. Which is ridiculous for a company at Amazon's scale and again at the edges of legality - Art. 12 GDPR mandates "without undue delay" and the one month is clearly meant as an upper bound here, not as the regular case. That is the problem with American companies and also the US government: they all default to hoard data in warehouses and make use of it later, and completely ignoring that all the data they hoard must also be made accessible to the people it's related to.
ourmandave 5y ago
Probably easier to buy it off the Dark Web. And what is the Bitcoin to Bezo Bucks conversion rate right now?
noasaservice 5y ago
> It’s a bit like if you have a stalker who’s been shadowing you around, meticulously documenting everywhere you go, everyone you talk to, and everything you do, who’s now handing you a form to fill out if you want to see the boxes of files they’ve been keeping on you. This has me thinking. I can get an injunction for a human stalker who's going after me at home, my workplace, following me wherever I go, etc. According to US law, companies are also people. So, why can't I get an injunction against, say, Facebook/Meta ? Get enough of these injunctions, and these shitty privacy-invading data blackholes would dry up pretty quick. If they don't, then they'd be liable for violating court orders. That usually never ends up well.
- amelius 5y ago
  Because you clicked Yes on their EULA.
  - noasaservice 5y ago
    I said facebook for a *very* specific reason: https://medium.com/@SpiderOak/facebook-shadow-profiles-a-profile-of-you-that-you-never-created-302f99f20930 https://medium.com/@SpiderOak/facebook-shadow-profiles-a-pro... There's absolutely NO agreement with shadow profiles. And on to your EULA excuse - show the court that: 1. That YOU accepted a EULA 2. That the EULA was even presented 3. That the EULA agreed (if proven) is the same one withe the onerous terms 4. That the user didn't revoke permissions (affirmative consent is a thing)
    - amelius 5y ago
      I agree with you, but it might be difficult to prove that someone is keeping a shadow profile.
- Sujan 5y ago
  The difference between a stalker and Amazon is that Amazon does not get any data from you (or at least 99% of what this author could request from Amazon, some ad tracking stuff might be an exception) if you do not willingy give it to them. Don't have an Amazon account and use it do order things or search, talk to Alexa, etc - and they will have no data.
eranation 5y ago
The multiple download buttons is not a dark pattern to prevent you from downloading your data, it’s just bad UX, it’s a feature you add to check a legal box and it doesn’t get priority for usability. Probably someone just shrugged, this is good enough and moved on. They should definitely give you it all in one zip file but “Never attribute to malice that which is adequately explained by a developer rushing to get something done by making it just barely usable” (the fact I worked at AWS as a development manager has nothing to do with the above and is solely my opinion)
- hamiltonians 5y ago
  This is unnaceptable given how inportant user interface is the rest of the site. one click shopping
- JaimeThompson 5y ago
  If the developers felt rushed to make such a feature that is the fault of their management but given the history of Amazon which includes publicly facing service status boards that don't update unless senior management approve the outage it is more likely that Amazon doesn't really want people to know what they know about their users.
- bryanrasmussen 5y ago
  Ok well, the same thing could be said by any organization in the world regarding any dark pattern ascribed to them. As far as never ascribing, if a company is super big and rich and would find it beneficial if people give up trying to do something because of bad UX I think it's a reasonable assumption that the bad UX is an example of a dark pattern. Otherwise this helpful concept to describe actual things that companies do to tire out users and get them to relent in doing things the companies don't want done would have to disappear. TLDR: If what Amazon is doing here isn't a dark pattern, what is?
- 7373737373 5y ago
  Even if this were the case, it'd still be customer time neglicience. This is one of the largest companies in the world
- 5y ago
jrmann100 5y ago
Wired Magazine recently did a feature on “Amazon’s Dark Secret” of what this mess looks like from the inside: https://www.wired.com/story/amazon-failed-to-protect-your-data-investigation/ https://www.wired.com/story/amazon-failed-to-protect-your-da...
nicwolff 5y ago
whoknew1122 5y ago
Clicking on the author's byline, it says the author is a 'security researcher focusing on privacy issues revolving around source protection, counter-forensics, and privacy assurance.' I would assume, therefore, the author would have at least passing knowledge of security and web applications. > Amazon at this point makes some intonations about how this email verification step is necessary because your privacy and security are the company’s top priority, though considering that when your data is available you’ll need to check your email anyway, it’s not clear how checking your email twice adds any security. People can argue about whether email should be used for authentication purposes. But what is the alternate model suggested? From the formulation of the complaint, the author seems to suggest that it'd be better if Amazon did not decouple authentication and payload delivery. Sending the payload (in this case, a load of personal data) to an email address without first checking whether the requestor is in control of the address is a horrendously terrible idea. I'm starting to wonder about the author's security chops. > Though Amazon says that it will “provide your information to you as soon as we can,” “soon” is apparently meant to be interpreted on a monthly time scale, as the page further states that “usually, this should not take more than a month.” Though of course, “in exceptional cases, for example if a request is more complex or if we are processing a high volume of requests, it might take longer.” This protracted time frame forms an intriguing juxtaposition to the otherwise universal emphasis on speed that facilitates shopping on Amazon. It's much easier to put information into various databases than it is to determine what databases contain information about a particular user, and present that data to the user in a secure, auditable manner. For example, you have to make sure that the user gets all the information they asked for (which means you have to determine whether the information exists, and if it doesn't you have to log the nonexistance of the data, lest you be audited). And you need to make sure user doesn't get information about someone else (which has happened in the past). Distributed systems are hard. It takes time to determine where all possible information could live. And you have to make sure you're providing the correct information. And do this flawlessly, every single time lest you open yourself up to bad press and potential fines. This all takes time in systems as large and distributed as Amazon. --- If the author is as knowledgeable in the security space as their byline suggests, I'm left to think that their incurious write-up is just trying to throw red meat at the 'We hate anything associated with Amazon' crowd. For what it's worth, my team at AWS processes GDPR requests within 3-or-so business days. But we can only do that because there is a single data warehouse for our product/service.
Sujan 5y ago
It's not very often that each and every point in an article just feels "fabricated" or over the top. It starts with finding the page: Amazon -> Customer Service -> Search for "personal data" -> Search result #1 is "Request Your Personal Information" which nicely explains what to do and links directly to that page. The need to verify or activate a data request via clicking a link? Of course required so some third party can not just request your data to your inbox (and process it along the way) without you actually wanting to do that. All the mentions that most of the data is available in your Amazon account? Well, what many people are looking for (order history etc) is and even nicely formatted, searchable and cross linked to make it much more convenient. Clicking "Remove address" only removes it from the list of addresses? Of course, addresses you ordered to in the past can not be deleted as they have to legally be stored together with other order information. And the list goes on and on. I get that it is scary that a big company keeps all the data you gave to them. And it is also unfortunate for you that it is not their business goal to make it instant and pretty for you to look at all the data. But there is no reason for them to do that. If you don't want Amazon to have your data, don't user Amazon. When you use Amazon, the way you can get a lot of data from them is actually pretty good (also compared to other companies which pretent search history does not exist and so on). (And bye to some Hacker News points. This will get nicely downvoted I suspect.)
- jen20 5y ago
  > But there is no reason for them to do that. If that is not their business goal, perhaps the GDPR needs to be strengthened and strongly enforced until it is.
  - Sujan 5y ago
    That is certainly a political decision that can be made, I agree and would actually be happy about that. If that happens, I am sure Amazon will invest the time and money to comply with that. At the same time it will put many smaller business out of business though, as they do not have the resources to do that. Even the current state of having to fulfill data requests is quite a problem for mayn of them.
bigyellow 5y ago
amelius 5y ago
Has anyone tried to get their data from Apple? Was the experience any different?
- micromacrofoot 5y ago
  I’m more of an anti-Facebook bias person myself
- deleted 5y ago
  [deleted]
gentleman11 5y ago
When you buy from Amazon, you are supporting their various awful practices. Yes, you
- m1gu3l 5y ago
  I will never be able to reconcile humans simultaneous need for everything to be good and pure but you know also cheap shit. Accept and embrace the gray area we all live in.
y04nn 5y ago
I had to click through more than 100 links to download all the data, how can this be acceptable? Specially coming from Amazon. How hard is it for them to create an archive with all the data? This is ridiculous, I can't imagine how was the meeting when they decided to produce purposefully such garbage UX.
- lrem 5y ago
  I'm not sure "an archive with all the data" is what you really want either. At some point you'll hit the limit of how much data does your filesystem allow in one file. Not sure if your browser is that good at resuming failed downloads too.
  - yencabulator 5y ago
    Google Takeout lets you split into multiple zips based on size. Amazon's take on this is just willfully evil.
- MaxGanzII 5y ago
  Exactly the problem I had. It would take Amazon almost no effort to make a single archive with all those files in. I cannot help but view this as deliberate obstruction.
- NelsonMinar 5y ago
  Here's a picture of the UI for the download, with 123 different "Download" buttons. https://twitter.com/nelson/status/1503848290193862658 https://twitter.com/nelson/status/1503848290193862658 I did an Amazon download too, after Amazon's subsidiary Goodreads lost all my data of 9 years. I'm grateful for how the GDPR and the CCPA mandate that companies provide data downloads. Amazon is clearly doing the bare minimum to comply. Other companies do more; Twitter's data download comes with a fully working offline Javascript app for reading and searching your tweets!
- IshKebab 5y ago
  Pretty sure there are a gazillion browser extensions that can do that for you. Not ideal but hardly the end of the world.
gorgoiler 5y ago
HN probably aren't required to let me download my data, but it sure would be nice. Does that option exist, on this site?
- mintplant 5y ago
  If you really want it, you can probably get a dump of your data by emailing dang & co (hn@ycombinator.com). They're pretty responsive. Don't overwhelm them with superfluous requests, though.
- GekkePrutser 5y ago
  I'm sure it does as many third party clients offer features where you can read back your own posts etc.
  - karlicoss 5y ago
    I'm personally using https://github.com/dogsheep/hacker-news-to-sqlite#usage https://github.com/dogsheep/hacker-news-to-sqlite#usage, it's great. You basically just need your username and that's it
    - GekkePrutser 5y ago
      Ooh nice thanks for the tip!! I'm making a "life log" system that stores stuff I do online automatically. This will come in very handy.
      - karlicoss 5y ago
        Oooh, I'm a big fun of lifelogging! You might want to check out some of my projects like https://github.com/karlicoss/HPI#readme https://github.com/karlicoss/HPI#readme :)
        GekkePrutser 5y ago
        Nice, I had no idea this was already 'a thing' :) Thanks again for this! What I want to do is indeed capture my emails, social media posts, photos, location data and chats (I run everything through Matrix anyway so that's pretty easy). And then store it in a database (or just a filesystem per day, not sure about that yet - I see your concerns about databases for this and I agree). With the more sensitive stuff GPG encrypted. I'll see if your projects can help me out with this, thanks! Like you say in your readme, indeed my goal is to regain control of my information. And enable myself to actually do something with it.
legitster 5y ago
I run a part of the data request process at our company. This article is an example where people expect anything technology related to be magic. We have to go through EVERY tech stack we own and look for that person's data. It's amazingly manual and tedious and takes about 6 people about an hour per request. We're working to automate it, but needless to say we try not to broadcast it too broadly. I hate that everyone jumps on any bad experience as a "dark pattern" when there's plenty of incompetence to share the blame.
- QuikAccount 5y ago
  I understand what you mean and I agree about everyone whining that the "sky is falling" but in my opinion, you shouldn't collect what you can't easily give me.
- lelandfe 5y ago
  It's revealing how hard this stuff is when Google's Data Liberation Front needed 4 years to release Google Takeout – which I consider to be best-in-class for personal data access.
  - jsnell 5y ago
    It is a hard problem, but the GDPR went into effect 3 years and 10 months ago. That date didn't come as a surprise, but was known 6 years ago. Anything newer than that should have taken data requests into account from the design stage. Anything older than that has had ample time to adjust. More than that 4 years you quote for Takeout!
  - blip54321 5y ago
    I disagree. Google Takeout is a sham. It doesn't have all the data they collect about you. It's almost adequate for data portability, but not quite. It's useless for data transparency. Google Docs keeps keystroke-level logs of everything you type, for example. That's not in Takeout. Neither are things needed to conduct a security audit (that's a paid service for Workspace customers). Neither is a lot of advertising profiling data.
- 5y ago
kerng 5y ago
I like this detailed walk throughs, although obviously subjective it reflects well on the many obstacles and dark patterns that are put in the way. The "funniest" one certainly is that there are dozens of download buttons to actually download the data in the end. So, it seems understandable that the author got quite frustrated with this process Amazon built.
MaxGanzII 5y ago
I've been trying for over two years to get my data from Amazon. I eventually got to a point where Amazon provided a web-page, which has no less than sixty-two download links on, each of which would have to be manually operated. It's properly tantamount to obstruction. After finally reaching this point, Support were arrogant and high-handed - "We will not do any more than we have. We look forward to seeing you on Amazon in the future." I still do not have my data. I tried to start the process off a second time, but it went nowhere. I chased it, and then had some very disconnected and confusing responsese from Support (email from some random guy in Support who by the looks of it had been told to email me, but neither he had been told what for, nor I that it would happen). I've not spent more time on it since then. I stopped using Amazon about two years ago, because I've come to the view that the stories about how Amazon treats warehouse staff are accurate. I want to get my personal data, so I can close the account. Amazon of course refuse point blank (in the usual, slimey, support-talking-past-you way) to delete any personal data, so all you can do is delete the account and hope in the end Amazon expire the data.
- bmn__ 5y ago
  > I eventually got to a point where Amazon provided a web-page, which has no less than sixty-two download links on, each of which would have to be manually operated. > I still do not have my data. > I want to get my personal data Is there a good reason why you don't take the three minutes to click the 62 download links?
  - deleted 5y ago
    [deleted]
bstrawson 5y ago
People in glass houses shouldn't throw stones. The author may want to read the privacy policy[0] for the site they are publishing their story on. They are collecting all sorts of data that they don't need to. And IANAL but apparently your rights to access the data they hold on you are restricted only to locations where they legally have to allow it. [0] https://theintercept.com/privacy-policy/ https://theintercept.com/privacy-policy/
- starwind 5y ago
  A few highlights from the privacy policy: > We may automatically collect information such as: Device connectivity and configuration data, including the type of device you’re using (computer, mobile phone, tablet, etc.), the operating system running on that device, the type and version of browser software you’re using, the resolution of your computer monitor or other device display, and the screen colors available on your device; > We may obtain information about you from other sources, and combine such information with information we have collected about you through the Services. To the extent we combine such third-party sourced information with information we have collected about you on the Services, we will treat the combined information in accordance with this Privacy Policy. These third-party sources vary over time, but have included third-party donor partners and publicly available sources. > We and our Service Providers may collect and store your information in log files as well as through the use of cookies, web beacons (also known as “tracking pixels”), embedded scripts, and other tracking technologies now and hereafter developed (“Tracking Technologies”). > Do Not Track. Your browser or device may include “Do Not Track” functionality. At this time, we do not respond to Do Not Track signals. > Our agents, vendors, consultants, and other service providers (“Service Providers”) may receive or be given access to your information in connection with their work on our behalf. These Service Providers are prohibited from using your information for any purpose other than to provide this assistance, although we may permit them to use aggregate information which does not identify you or de-identified data for other purposes.
rdiddly 5y ago
The article would be stronger if it didn't overreact and exaggerate, but then again I do appreciate the sarcasm. The 74 zip files are the most egregious part of it though. You can't zip those mofos into one file? It's spiteful somehow, like you asked for water and Amazon said "Here you go" and threw it in your face.
elygre 5y ago
I did this myself a month ago or so. In addition to the process and the multiple downloads, I was very fascinated to discover that many reports were delivered as PDF. Why would that be, if not to make it more difficult to access?
jaclaz 5y ago
What I found "queer" (besides the tediousness/whining) was the: >It’s not explained how Amazon acquires this third-party audience data, but according to this dataset I apparently am a homeowner, in possession of a luxury sedan and SUV, and in the 45 to 54 age range. This was all news to me, as I am none of those things. This kind of data is seemingly what "circulates" about you and on which advertising statistics and targeting are made. Should we believe that it is only a singular glitch or that most of these data is simply wrong/made up?
- salawat 5y ago
  Probably LexisNexus. Their sales offerings will promise datasets offering information on political affiliation and marital status of arbitrary addresses. Or info shared from partners/affiliates. People talk about you, and most of it is BS, but you as the consumer should just accept it so businesses can monetize their datasets! Ain't it great?
yoaviram 5y ago
I'm one of the creators of YourDigitalRights.org, a service which automates the process of sending data requests (it's free, open source and were a registered charity). What is described in this article is, unfortunately, a common case with some big tech companies. I've recently started an experiment to send data deletion requests to 600 data brokers and document what happens. It's dark patterns all the way down. The solution is to escalate your request to the local data protection agency (attorney general in case of California). I believe that if enough of us do this it will make a difference, even in the case of Amazon. Following this realization we've recently added an optional features which will follow up with you some time after a request is made, and depending on the outcome, offer to automate the escalation process.
- lelandfe 5y ago
  > I've recently started an experiment to send data deletion requests to 600 data brokers and document what happens. It's dark patterns all the way down. I would love to read a long form piece on your findings! It sounds like it would a great way to advertise YourDigitalRights as well.
  - yoaviram 5y ago
    We're going to be speaking about this at Good Tech Fest 2022 [1], and will also write it up post it to HN. https://www.goodtechfest.com/good-tech-fest-2022 https://www.goodtechfest.com/good-tech-fest-2022
- TeeMassive 5y ago
  You're doing privacy a great service, you're charity is awesome! Are your services also work outside of the US, like, say, Canada?
  - yoaviram 5y ago
    Thank you! We are about to launch support for the Brazilian LGPD, and have 17 other regulations we want to support this year, including Canada.
shadowgovt 5y ago
> It ultimately took about 19 days for Amazon to fulfill my data request, in stark contrast to its reported median time of 1.5 days to process a data request, as per the company’s California Consumer Privacy Act disclosure for 2020. That's interesting but not particularly surprising. I bet the median request isn't for all data. An all-data request may involve pulling data from cold-storage, which I'm not surprised would take 2+ weeks (it's quite possibly a relatively manual process).
oriettaxx 5y ago
I tried one time, they wrote me they where going to send me my data, but never did (!) I gave up I'll try again now :)
- oriettaxx 5y ago
  "more than a month" :) > Data Request Confirmation > We’ve received and are processing your request to access your personal data. > We will provide your information to you as soon as we can. > Usually, this should not take more than a month. >In exceptional cases, for example if a request is more complex or if we are processing a high volume of requests, it might take longer, but if so we will notify you that there will be a delay.
robertlagrant 5y ago
I can imagine it takes a month so older backups can cycle out and then don't have to dredge up data they're about to no longer keep on you anyway.
r_singh 5y ago
Does anyone know if companies are obliged to do this in india?
gigel82 5y ago
Yes, they have multiple download buttons and it takes a bit, but I got the same with Google; it only took a few minutes to download the data once made available. I was most surprised by the sheer amount of audio data kept: in my case, more than 5Gb of wave files dating back to when I set up my first Alexa 6 years ago. I believe at least 50% of everything Alexa heard in my house is recorded there. That's when I started looking for an offline alternative, since -after the initial novelty wore off- we're only using it to listen to music, turn on/off smart home lights and ask the occasional random question (convert C to F, etc.).
Weryj 5y ago
What I’m surprised we aren’t talking about is the encrypted blobs that Facebook provide when you download your data. With no instructions on how to decrypt to view your actual data.
mark_l_watson 5y ago
That is something that I like about Google. It only takes a minute to get to what they admit to data they have collected. Also easy to dump all data and then download it a few hours later. I mostly just use paid for services (GCP, Play books and movies, sometimes Colab Pro), but Gmail is my backup email and I like to download that occasionally. re: Amazon: I like to refresh my VPN IP address, and go to Amazon in a private browser tab to avoid being "gamed" on item pricing. I login once I have the price set.
- yencabulator 5y ago
  Google Takeout is "all your data", this Amazon download seems to actually be "all data about you". It seems you can't get the latter from Google.
ozzythecat 5y ago
From the article: > Given Amazon’s obsession with speed and eliminating friction to foster faster consumerism, the dawdling data solicitation process seems like it just might be intentional, designed to dissuade requests. > It ultimately took about 19 days for Amazon to fulfill my data request, in stark contrast to its reported median time of 1.5 days to process a data request, as per the company’s California Consumer Privacy Act disclosure for 2020. There was no option for expedited Amazon Prime data delivery and no button equivalent to an instantaneous Buy Now (née 1-Click) option when selecting my data. When you use Amazon services, I don't think there is a single, global database of all your data. Amazon has many different offerings (prime video, alexa, music, photos, books) often with many individual organizations and sets of teams within those organizations. Each customer-facing feature is supported by some N number of services, which collect and store data in different systems. These can be modern day systems built from the ground up with "privacy data reporting" as a first class feature, or they could legacy systems that were built any time before GDPR and other compliance laws came online. Some of these systems are write optimized as opposed to being read optimized. Others aren't even backed by a relational or NoSQL database. Instead, they may contain your data in some format that you cannot quickly query in constant time. It makes little sense for Amazon or any other company to invest hundreds of millions of dollars, if not more, to stand up entire organizations to migrate off these systems – simply because a median 1.5 day turnaround time is too high or so that Nikita Mazurov doesn't have to wait 19 days. Presumably that 19 days is closer to their 80th percentile or 90th percentile turn around time. Under the GDPR legislation, a Google search shows that the maximum turn around time under the law is about ~1 month. Any single system that has to integrate with practically EVERYTHING else in your entire company is going to be complex, no matter how much you try to simplify it. Your data may be stored in some format that's meaningful if it's given to you as is. Or that data may be stored containing proprietary information. Or it could contain implementation details. For instance, I've built systems where we stored "magic numbers" in place of string into a database, mainly to save on storage costs. I probably wouldn't want to return those magic numbers to a customer, because it would be meaningless. What I'm getting at is to even return one record from one specific service isn't necessarily just a SELECT query (assuming the data is stored in a relational db to being with). This article is full of outright negativity, trying to fuel outrage and assuming everything on Amazon's side is malice, incompetence, or some combination of both. I couldn't but help and look up the author's page on The Intercept: > Nikita Mazurov is a security researcher focusing on privacy issues revolving around source protection, counter-forensics, and privacy assurance. I don't use such strong language on HN, but here's my own thesis: This is an egregiously padded resume. Best case, it describes a university student/researcher who has never actually solved any real world problem. It's a combination of that fact and the fact that this article was deliberately written in a way to generate clicks by manufacturing outrage.
oyebenny 5y ago
My Amazon account got accessed from within. Several Amazon employees/reps confirm it. But when I asked who and what happened to the employees who did they don't tell me anything. It's ANNOYING.
catlifeonmars 5y ago
There really should be an open standard for data subject requests and delivery methods and formats. Maybe something built on WebFinger?

362 points by Ansil849 5y ago

One the things people can ask for is who data is shared with. Its a massive paper trail but so many entities dont want to comply with data protection laws, its not just big tech its any large entity because interpretation of the laws is so vague, but thats the beauty of legislation, its vague.

inopinatus 5y ago

One of those relatively few circumstances where structuring the company into service teams is nothing but a hurdle, rather than a net advantage, to delivering on customer expectations.

7373737373 5y ago

I had the exact same experience. I wouldn't mind if they would be sued for this. It's audacious, a dark pattern, user hostile, lazy.

MaxGanzII 5y ago

SpicyLemonZest 5y ago

The full, complete set of tedium the author describes is: * Navigate through a handful of pages. * Scroll to the bottom of a menu. * Click an email confirmation link. * Wait 19 days. * Click 74 download links. That last part is pretty dumb! But it's also the only thing that seems remotely tedious, and I'm not sure where at any point he'd be confused. The author implies some sort of issue with the 19 day waiting period, but it seems entirely plausible to me that many of the datasets being requested have "ask an engineer to run through this long manual process" as a dependency.

pacaro 5y ago
I very much doubt that there is any human interaction on the Amazon end of this workflow. What seems more likely is that because this doesn't generate revenue it gets the minimum resources necessary to complete the request within some legally mandated time frame. The request probably sits in queues for most of its life. If a court order requests these same data, I suspect that it can be produced in under 24 hours
- deleted 5y ago
  [deleted]
- whoknew1122 5y ago
  And you'd be wrong. There are humans involved at every level of GDPR requests. Signed, Someone who has handled such requests for AWS
  - pacaro 5y ago
    That feels like an untenable solution, it wouldn't take much to create a denial of service...
    - shadowgovt 5y ago
      Very little about GDPR was designed with technical reality in mind. It's a grand example of using the mallet of law to try and beat the world into the shape someone wants it in, ignorant of why it's in the shape it's currently in.
mschuster91 5y ago
> That last part is pretty dumb! It's not just dumb, the whole process is at the edges of the law. Art. 12 GDPR mandates "intelligible and easily accessible form", which navigating through a number of pages, wait times and finally a 74-link download is certainly not fulfilling. The gold standard, for what it's worth, is a direct link from the privacy policy page in the section that details GDPR subject rights to the page that provides the download - basically, three clicks in total. > but it seems entirely plausible to me that many of the datasets being requested have "ask an engineer to run through this long manual process" as a dependency. Which is ridiculous for a company at Amazon's scale and again at the edges of legality - Art. 12 GDPR mandates "without undue delay" and the one month is clearly meant as an upper bound here, not as the regular case. That is the problem with American companies and also the US government: they all default to hoard data in warehouses and make use of it later, and completely ignoring that all the data they hoard must also be made accessible to the people it's related to.

ourmandave 5y ago

Probably easier to buy it off the Dark Web. And what is the Bitcoin to Bezo Bucks conversion rate right now?

noasaservice 5y ago

> It’s a bit like if you have a stalker who’s been shadowing you around, meticulously documenting everywhere you go, everyone you talk to, and everything you do, who’s now handing you a form to fill out if you want to see the boxes of files they’ve been keeping on you. This has me thinking. I can get an injunction for a human stalker who's going after me at home, my workplace, following me wherever I go, etc. According to US law, companies are also people. So, why can't I get an injunction against, say, Facebook/Meta ? Get enough of these injunctions, and these shitty privacy-invading data blackholes would dry up pretty quick. If they don't, then they'd be liable for violating court orders. That usually never ends up well.

amelius 5y ago
Because you clicked Yes on their EULA.
- noasaservice 5y ago
  I said facebook for a *very* specific reason: https://medium.com/@SpiderOak/facebook-shadow-profiles-a-profile-of-you-that-you-never-created-302f99f20930 https://medium.com/@SpiderOak/facebook-shadow-profiles-a-pro... There's absolutely NO agreement with shadow profiles. And on to your EULA excuse - show the court that: 1. That YOU accepted a EULA 2. That the EULA was even presented 3. That the EULA agreed (if proven) is the same one withe the onerous terms 4. That the user didn't revoke permissions (affirmative consent is a thing)
  - amelius 5y ago
    I agree with you, but it might be difficult to prove that someone is keeping a shadow profile.
Sujan 5y ago
The difference between a stalker and Amazon is that Amazon does not get any data from you (or at least 99% of what this author could request from Amazon, some ad tracking stuff might be an exception) if you do not willingy give it to them. Don't have an Amazon account and use it do order things or search, talk to Alexa, etc - and they will have no data.

eranation 5y ago

The multiple download buttons is not a dark pattern to prevent you from downloading your data, it’s just bad UX, it’s a feature you add to check a legal box and it doesn’t get priority for usability. Probably someone just shrugged, this is good enough and moved on. They should definitely give you it all in one zip file but “Never attribute to malice that which is adequately explained by a developer rushing to get something done by making it just barely usable” (the fact I worked at AWS as a development manager has nothing to do with the above and is solely my opinion)

hamiltonians 5y ago
This is unnaceptable given how inportant user interface is the rest of the site. one click shopping
JaimeThompson 5y ago
If the developers felt rushed to make such a feature that is the fault of their management but given the history of Amazon which includes publicly facing service status boards that don't update unless senior management approve the outage it is more likely that Amazon doesn't really want people to know what they know about their users.
bryanrasmussen 5y ago
Ok well, the same thing could be said by any organization in the world regarding any dark pattern ascribed to them. As far as never ascribing, if a company is super big and rich and would find it beneficial if people give up trying to do something because of bad UX I think it's a reasonable assumption that the bad UX is an example of a dark pattern. Otherwise this helpful concept to describe actual things that companies do to tire out users and get them to relent in doing things the companies don't want done would have to disappear. TLDR: If what Amazon is doing here isn't a dark pattern, what is?
7373737373 5y ago
Even if this were the case, it'd still be customer time neglicience. This is one of the largest companies in the world
5y ago

jrmann100 5y ago

Wired Magazine recently did a feature on “Amazon’s Dark Secret” of what this mess looks like from the inside: https://www.wired.com/story/amazon-failed-to-protect-your-data-investigation/ https://www.wired.com/story/amazon-failed-to-protect-your-da...

nicwolff 5y ago

whoknew1122 5y ago

Clicking on the author's byline, it says the author is a 'security researcher focusing on privacy issues revolving around source protection, counter-forensics, and privacy assurance.' I would assume, therefore, the author would have at least passing knowledge of security and web applications. > Amazon at this point makes some intonations about how this email verification step is necessary because your privacy and security are the company’s top priority, though considering that when your data is available you’ll need to check your email anyway, it’s not clear how checking your email twice adds any security. People can argue about whether email should be used for authentication purposes. But what is the alternate model suggested? From the formulation of the complaint, the author seems to suggest that it'd be better if Amazon did not decouple authentication and payload delivery. Sending the payload (in this case, a load of personal data) to an email address without first checking whether the requestor is in control of the address is a horrendously terrible idea. I'm starting to wonder about the author's security chops. > Though Amazon says that it will “provide your information to you as soon as we can,” “soon” is apparently meant to be interpreted on a monthly time scale, as the page further states that “usually, this should not take more than a month.” Though of course, “in exceptional cases, for example if a request is more complex or if we are processing a high volume of requests, it might take longer.” This protracted time frame forms an intriguing juxtaposition to the otherwise universal emphasis on speed that facilitates shopping on Amazon. It's much easier to put information into various databases than it is to determine what databases contain information about a particular user, and present that data to the user in a secure, auditable manner. For example, you have to make sure that the user gets all the information they asked for (which means you have to determine whether the information exists, and if it doesn't you have to log the nonexistance of the data, lest you be audited). And you need to make sure user doesn't get information about someone else (which has happened in the past). Distributed systems are hard. It takes time to determine where all possible information could live. And you have to make sure you're providing the correct information. And do this flawlessly, every single time lest you open yourself up to bad press and potential fines. This all takes time in systems as large and distributed as Amazon. --- If the author is as knowledgeable in the security space as their byline suggests, I'm left to think that their incurious write-up is just trying to throw red meat at the 'We hate anything associated with Amazon' crowd. For what it's worth, my team at AWS processes GDPR requests within 3-or-so business days. But we can only do that because there is a single data warehouse for our product/service.

Sujan 5y ago

It's not very often that each and every point in an article just feels "fabricated" or over the top. It starts with finding the page: Amazon -> Customer Service -> Search for "personal data" -> Search result #1 is "Request Your Personal Information" which nicely explains what to do and links directly to that page. The need to verify or activate a data request via clicking a link? Of course required so some third party can not just request your data to your inbox (and process it along the way) without you actually wanting to do that. All the mentions that most of the data is available in your Amazon account? Well, what many people are looking for (order history etc) is and even nicely formatted, searchable and cross linked to make it much more convenient. Clicking "Remove address" only removes it from the list of addresses? Of course, addresses you ordered to in the past can not be deleted as they have to legally be stored together with other order information. And the list goes on and on. I get that it is scary that a big company keeps all the data you gave to them. And it is also unfortunate for you that it is not their business goal to make it instant and pretty for you to look at all the data. But there is no reason for them to do that. If you don't want Amazon to have your data, don't user Amazon. When you use Amazon, the way you can get a lot of data from them is actually pretty good (also compared to other companies which pretent search history does not exist and so on). (And bye to some Hacker News points. This will get nicely downvoted I suspect.)

jen20 5y ago
> But there is no reason for them to do that. If that is not their business goal, perhaps the GDPR needs to be strengthened and strongly enforced until it is.
- Sujan 5y ago
  That is certainly a political decision that can be made, I agree and would actually be happy about that. If that happens, I am sure Amazon will invest the time and money to comply with that. At the same time it will put many smaller business out of business though, as they do not have the resources to do that. Even the current state of having to fulfill data requests is quite a problem for mayn of them.

bigyellow 5y ago

amelius 5y ago

Has anyone tried to get their data from Apple? Was the experience any different?

micromacrofoot 5y ago
I’m more of an anti-Facebook bias person myself
deleted 5y ago
[deleted]

gentleman11 5y ago

When you buy from Amazon, you are supporting their various awful practices. Yes, you

m1gu3l 5y ago
I will never be able to reconcile humans simultaneous need for everything to be good and pure but you know also cheap shit. Accept and embrace the gray area we all live in.

y04nn 5y ago

I had to click through more than 100 links to download all the data, how can this be acceptable? Specially coming from Amazon. How hard is it for them to create an archive with all the data? This is ridiculous, I can't imagine how was the meeting when they decided to produce purposefully such garbage UX.

lrem 5y ago
I'm not sure "an archive with all the data" is what you really want either. At some point you'll hit the limit of how much data does your filesystem allow in one file. Not sure if your browser is that good at resuming failed downloads too.
- yencabulator 5y ago
  Google Takeout lets you split into multiple zips based on size. Amazon's take on this is just willfully evil.
MaxGanzII 5y ago
Exactly the problem I had. It would take Amazon almost no effort to make a single archive with all those files in. I cannot help but view this as deliberate obstruction.
NelsonMinar 5y ago
Here's a picture of the UI for the download, with 123 different "Download" buttons. https://twitter.com/nelson/status/1503848290193862658 https://twitter.com/nelson/status/1503848290193862658 I did an Amazon download too, after Amazon's subsidiary Goodreads lost all my data of 9 years. I'm grateful for how the GDPR and the CCPA mandate that companies provide data downloads. Amazon is clearly doing the bare minimum to comply. Other companies do more; Twitter's data download comes with a fully working offline Javascript app for reading and searching your tweets!
IshKebab 5y ago
Pretty sure there are a gazillion browser extensions that can do that for you. Not ideal but hardly the end of the world.

gorgoiler 5y ago

HN probably aren't required to let me download my data, but it sure would be nice. Does that option exist, on this site?

mintplant 5y ago
If you really want it, you can probably get a dump of your data by emailing dang & co (hn@ycombinator.com). They're pretty responsive. Don't overwhelm them with superfluous requests, though.
GekkePrutser 5y ago
I'm sure it does as many third party clients offer features where you can read back your own posts etc.
- karlicoss 5y ago
  I'm personally using https://github.com/dogsheep/hacker-news-to-sqlite#usage https://github.com/dogsheep/hacker-news-to-sqlite#usage, it's great. You basically just need your username and that's it
  - GekkePrutser 5y ago
    Ooh nice thanks for the tip!! I'm making a "life log" system that stores stuff I do online automatically. This will come in very handy.
    - karlicoss 5y ago
      Oooh, I'm a big fun of lifelogging! You might want to check out some of my projects like https://github.com/karlicoss/HPI#readme https://github.com/karlicoss/HPI#readme :)
      - GekkePrutser 5y ago
        Nice, I had no idea this was already 'a thing' :) Thanks again for this! What I want to do is indeed capture my emails, social media posts, photos, location data and chats (I run everything through Matrix anyway so that's pretty easy). And then store it in a database (or just a filesystem per day, not sure about that yet - I see your concerns about databases for this and I agree). With the more sensitive stuff GPG encrypted. I'll see if your projects can help me out with this, thanks! Like you say in your readme, indeed my goal is to regain control of my information. And enable myself to actually do something with it.

legitster 5y ago

I run a part of the data request process at our company. This article is an example where people expect anything technology related to be magic. We have to go through EVERY tech stack we own and look for that person's data. It's amazingly manual and tedious and takes about 6 people about an hour per request. We're working to automate it, but needless to say we try not to broadcast it too broadly. I hate that everyone jumps on any bad experience as a "dark pattern" when there's plenty of incompetence to share the blame.

QuikAccount 5y ago
I understand what you mean and I agree about everyone whining that the "sky is falling" but in my opinion, you shouldn't collect what you can't easily give me.
lelandfe 5y ago
It's revealing how hard this stuff is when Google's Data Liberation Front needed 4 years to release Google Takeout – which I consider to be best-in-class for personal data access.
- jsnell 5y ago
  It is a hard problem, but the GDPR went into effect 3 years and 10 months ago. That date didn't come as a surprise, but was known 6 years ago. Anything newer than that should have taken data requests into account from the design stage. Anything older than that has had ample time to adjust. More than that 4 years you quote for Takeout!
- blip54321 5y ago
  I disagree. Google Takeout is a sham. It doesn't have all the data they collect about you. It's almost adequate for data portability, but not quite. It's useless for data transparency. Google Docs keeps keystroke-level logs of everything you type, for example. That's not in Takeout. Neither are things needed to conduct a security audit (that's a paid service for Workspace customers). Neither is a lot of advertising profiling data.
5y ago

kerng 5y ago

I like this detailed walk throughs, although obviously subjective it reflects well on the many obstacles and dark patterns that are put in the way. The "funniest" one certainly is that there are dozens of download buttons to actually download the data in the end. So, it seems understandable that the author got quite frustrated with this process Amazon built.

MaxGanzII 5y ago

I've been trying for over two years to get my data from Amazon. I eventually got to a point where Amazon provided a web-page, which has no less than sixty-two download links on, each of which would have to be manually operated. It's properly tantamount to obstruction. After finally reaching this point, Support were arrogant and high-handed - "We will not do any more than we have. We look forward to seeing you on Amazon in the future." I still do not have my data. I tried to start the process off a second time, but it went nowhere. I chased it, and then had some very disconnected and confusing responsese from Support (email from some random guy in Support who by the looks of it had been told to email me, but neither he had been told what for, nor I that it would happen). I've not spent more time on it since then. I stopped using Amazon about two years ago, because I've come to the view that the stories about how Amazon treats warehouse staff are accurate. I want to get my personal data, so I can close the account. Amazon of course refuse point blank (in the usual, slimey, support-talking-past-you way) to delete any personal data, so all you can do is delete the account and hope in the end Amazon expire the data.

bmn__ 5y ago
> I eventually got to a point where Amazon provided a web-page, which has no less than sixty-two download links on, each of which would have to be manually operated. > I still do not have my data. > I want to get my personal data Is there a good reason why you don't take the three minutes to click the 62 download links?
- deleted 5y ago
  [deleted]

bstrawson 5y ago

People in glass houses shouldn't throw stones. The author may want to read the privacy policy[0] for the site they are publishing their story on. They are collecting all sorts of data that they don't need to. And IANAL but apparently your rights to access the data they hold on you are restricted only to locations where they legally have to allow it. [0] https://theintercept.com/privacy-policy/ https://theintercept.com/privacy-policy/

starwind 5y ago
A few highlights from the privacy policy: > We may automatically collect information such as: Device connectivity and configuration data, including the type of device you’re using (computer, mobile phone, tablet, etc.), the operating system running on that device, the type and version of browser software you’re using, the resolution of your computer monitor or other device display, and the screen colors available on your device; > We may obtain information about you from other sources, and combine such information with information we have collected about you through the Services. To the extent we combine such third-party sourced information with information we have collected about you on the Services, we will treat the combined information in accordance with this Privacy Policy. These third-party sources vary over time, but have included third-party donor partners and publicly available sources. > We and our Service Providers may collect and store your information in log files as well as through the use of cookies, web beacons (also known as “tracking pixels”), embedded scripts, and other tracking technologies now and hereafter developed (“Tracking Technologies”). > Do Not Track. Your browser or device may include “Do Not Track” functionality. At this time, we do not respond to Do Not Track signals. > Our agents, vendors, consultants, and other service providers (“Service Providers”) may receive or be given access to your information in connection with their work on our behalf. These Service Providers are prohibited from using your information for any purpose other than to provide this assistance, although we may permit them to use aggregate information which does not identify you or de-identified data for other purposes.

rdiddly 5y ago

The article would be stronger if it didn't overreact and exaggerate, but then again I do appreciate the sarcasm. The 74 zip files are the most egregious part of it though. You can't zip those mofos into one file? It's spiteful somehow, like you asked for water and Amazon said "Here you go" and threw it in your face.

elygre 5y ago

I did this myself a month ago or so. In addition to the process and the multiple downloads, I was very fascinated to discover that many reports were delivered as PDF. Why would that be, if not to make it more difficult to access?

jaclaz 5y ago

What I found "queer" (besides the tediousness/whining) was the: >It’s not explained how Amazon acquires this third-party audience data, but according to this dataset I apparently am a homeowner, in possession of a luxury sedan and SUV, and in the 45 to 54 age range. This was all news to me, as I am none of those things. This kind of data is seemingly what "circulates" about you and on which advertising statistics and targeting are made. Should we believe that it is only a singular glitch or that most of these data is simply wrong/made up?

salawat 5y ago
Probably LexisNexus. Their sales offerings will promise datasets offering information on political affiliation and marital status of arbitrary addresses. Or info shared from partners/affiliates. People talk about you, and most of it is BS, but you as the consumer should just accept it so businesses can monetize their datasets! Ain't it great?

yoaviram 5y ago

I'm one of the creators of YourDigitalRights.org, a service which automates the process of sending data requests (it's free, open source and were a registered charity). What is described in this article is, unfortunately, a common case with some big tech companies. I've recently started an experiment to send data deletion requests to 600 data brokers and document what happens. It's dark patterns all the way down. The solution is to escalate your request to the local data protection agency (attorney general in case of California). I believe that if enough of us do this it will make a difference, even in the case of Amazon. Following this realization we've recently added an optional features which will follow up with you some time after a request is made, and depending on the outcome, offer to automate the escalation process.

lelandfe 5y ago
> I've recently started an experiment to send data deletion requests to 600 data brokers and document what happens. It's dark patterns all the way down. I would love to read a long form piece on your findings! It sounds like it would a great way to advertise YourDigitalRights as well.
- yoaviram 5y ago
  We're going to be speaking about this at Good Tech Fest 2022 [1], and will also write it up post it to HN. https://www.goodtechfest.com/good-tech-fest-2022 https://www.goodtechfest.com/good-tech-fest-2022
TeeMassive 5y ago
You're doing privacy a great service, you're charity is awesome! Are your services also work outside of the US, like, say, Canada?
- yoaviram 5y ago
  Thank you! We are about to launch support for the Brazilian LGPD, and have 17 other regulations we want to support this year, including Canada.

shadowgovt 5y ago

> It ultimately took about 19 days for Amazon to fulfill my data request, in stark contrast to its reported median time of 1.5 days to process a data request, as per the company’s California Consumer Privacy Act disclosure for 2020. That's interesting but not particularly surprising. I bet the median request isn't for all data. An all-data request may involve pulling data from cold-storage, which I'm not surprised would take 2+ weeks (it's quite possibly a relatively manual process).

oriettaxx 5y ago

I tried one time, they wrote me they where going to send me my data, but never did (!) I gave up I'll try again now :)

oriettaxx 5y ago
"more than a month" :) > Data Request Confirmation > We’ve received and are processing your request to access your personal data. > We will provide your information to you as soon as we can. > Usually, this should not take more than a month. >In exceptional cases, for example if a request is more complex or if we are processing a high volume of requests, it might take longer, but if so we will notify you that there will be a delay.

robertlagrant 5y ago

I can imagine it takes a month so older backups can cycle out and then don't have to dredge up data they're about to no longer keep on you anyway.

r_singh 5y ago

Does anyone know if companies are obliged to do this in india?

gigel82 5y ago

Yes, they have multiple download buttons and it takes a bit, but I got the same with Google; it only took a few minutes to download the data once made available. I was most surprised by the sheer amount of audio data kept: in my case, more than 5Gb of wave files dating back to when I set up my first Alexa 6 years ago. I believe at least 50% of everything Alexa heard in my house is recorded there. That's when I started looking for an offline alternative, since -after the initial novelty wore off- we're only using it to listen to music, turn on/off smart home lights and ask the occasional random question (convert C to F, etc.).

Weryj 5y ago

What I’m surprised we aren’t talking about is the encrypted blobs that Facebook provide when you download your data. With no instructions on how to decrypt to view your actual data.

mark_l_watson 5y ago

That is something that I like about Google. It only takes a minute to get to what they admit to data they have collected. Also easy to dump all data and then download it a few hours later. I mostly just use paid for services (GCP, Play books and movies, sometimes Colab Pro), but Gmail is my backup email and I like to download that occasionally. re: Amazon: I like to refresh my VPN IP address, and go to Amazon in a private browser tab to avoid being "gamed" on item pricing. I login once I have the price set.

yencabulator 5y ago
Google Takeout is "all your data", this Amazon download seems to actually be "all data about you". It seems you can't get the latter from Google.

ozzythecat 5y ago

From the article: > Given Amazon’s obsession with speed and eliminating friction to foster faster consumerism, the dawdling data solicitation process seems like it just might be intentional, designed to dissuade requests. > It ultimately took about 19 days for Amazon to fulfill my data request, in stark contrast to its reported median time of 1.5 days to process a data request, as per the company’s California Consumer Privacy Act disclosure for 2020. There was no option for expedited Amazon Prime data delivery and no button equivalent to an instantaneous Buy Now (née 1-Click) option when selecting my data. When you use Amazon services, I don't think there is a single, global database of all your data. Amazon has many different offerings (prime video, alexa, music, photos, books) often with many individual organizations and sets of teams within those organizations. Each customer-facing feature is supported by some N number of services, which collect and store data in different systems. These can be modern day systems built from the ground up with "privacy data reporting" as a first class feature, or they could legacy systems that were built any time before GDPR and other compliance laws came online. Some of these systems are write optimized as opposed to being read optimized. Others aren't even backed by a relational or NoSQL database. Instead, they may contain your data in some format that you cannot quickly query in constant time. It makes little sense for Amazon or any other company to invest hundreds of millions of dollars, if not more, to stand up entire organizations to migrate off these systems – simply because a median 1.5 day turnaround time is too high or so that Nikita Mazurov doesn't have to wait 19 days. Presumably that 19 days is closer to their 80th percentile or 90th percentile turn around time. Under the GDPR legislation, a Google search shows that the maximum turn around time under the law is about ~1 month. Any single system that has to integrate with practically EVERYTHING else in your entire company is going to be complex, no matter how much you try to simplify it. Your data may be stored in some format that's meaningful if it's given to you as is. Or that data may be stored containing proprietary information. Or it could contain implementation details. For instance, I've built systems where we stored "magic numbers" in place of string into a database, mainly to save on storage costs. I probably wouldn't want to return those magic numbers to a customer, because it would be meaningless. What I'm getting at is to even return one record from one specific service isn't necessarily just a SELECT query (assuming the data is stored in a relational db to being with). This article is full of outright negativity, trying to fuel outrage and assuming everything on Amazon's side is malice, incompetence, or some combination of both. I couldn't but help and look up the author's page on The Intercept: > Nikita Mazurov is a security researcher focusing on privacy issues revolving around source protection, counter-forensics, and privacy assurance. I don't use such strong language on HN, but here's my own thesis: This is an egregiously padded resume. Best case, it describes a university student/researcher who has never actually solved any real world problem. It's a combination of that fact and the fact that this article was deliberately written in a way to generate clicks by manufacturing outrage.

oyebenny 5y ago

My Amazon account got accessed from within. Several Amazon employees/reps confirm it. But when I asked who and what happened to the employees who did they don't tell me anything. It's ANNOYING.

catlifeonmars 5y ago

There really should be an open standard for data subject requests and delivery methods and formats. Maybe something built on WebFinger?