5 ms·
The level of security you apply to a service ought to be proportionate to the potential loss. Apple have failed here completely, providing a woeful level of sec
by pja 14y ago
The level of security you apply to a service ought to be proportionate to the potential loss. Apple have failed here completely, providing a woeful level of security for a service where the potential cost (loss of all user data) for the end-user is very high.
Amazon on the other hand doesn't (potentially) have the power to wipe your machines and cause havoc. If someone compromises your Amazon account, then worst case they can order goods in your name to be sent to you & Amazon will be out the cost of shipping and re-selling those goods, plus the cost of any chargebacks if they mess you about refunding your credit card. In other words, the risk here lies with Amazon, not the end-user, so they are rightly free to set the level of security applied to Amazon accounts to whatever they feel meets their goals.
It's not Amazon's fault that the 4 digits that the credit card companies decided that it was ok to leave on your receipts are precisely the four digits that Apple accepts as evidence that you own the card in question.
The fault lies with Apple for accepting data that you leave behind every time you make a purchase with your credit card (it's printed on every credit card receipt you leave behind at the local pizza joint IIRC) as being suitable evidence to permit an anonymous caller access to an Apple account.
Now, if Amazon applies the same level of security to accounts with personal data or other costs to the end-user (cloud drive, Amazon S3 or EC2 accounts and so on) then you'd be right to lay into them. Does anyone know if that's the case?
- rjsamson 14y agoWell, if you have AWS linked to your amazon account I would imagine this could be disastrous...
- jonknee 14y agoAWS supports two factor auth among other ways to secure your account.
- deleted 14y ago[deleted]
- danso 14y agoYou make a good argument. I was going to say that in Apple's defense, there's some expectation that a user who enables remote-wipe knows what he/she is getting into and has some responsibility to have a backup solution. But that point is mostly moot since Apple also hosts personal email/data accounts, which would be compromised by this hack. Amazon does to a lesser extent...there's data, but not terribly actionable data. Whereas if Apple is your email account used to retrieve passwords...well, then you're in Honan's terrible position. AFAIK, though, I use the same credentials to get into my Amazon consumer account as I do my Amazon EC2 and S3 account and into my affiliate account (and Kindle, etc.). Does the security level elevate as soon as I've been flagged as a developer-user who isn't just buying books/CDs? If there is, I've seen no sign of it.
- Peaker 14y agoIsn't remote wipe enabled by default in iCloud?
- pja 14y agoI think it comes along for the ride with "Find my <Apple Device>" which would for most users seem to be a fairly innocuous feature. I don't think the possibility of total data loss if they lost control of their iCloud account would occur to most people.
- Ihavenoname 14y agoIt is an option you need to approve on the Mac the iPhone automatically backers itself up so it is a non issue unless your computer or Mac is not backed up too.
- pja 14y agoUnless you've synced your iPhone to a Mac which gets remote wiped along with the iPhone itself. Then you've got problems.
- makomk 14y agoApparently - and I don't have any way of confirming this myself - if you enable automatic backups to iCloud your iPhone refuses to automatically back itself up to your computer anymore. So all your eggs are basically in one iCloud-shaped basket.
- dasil003 14y agoWhy would they have to send the stuff to you?
- makomk 14y agoAmazon make you re-enter all your credit card details every time you want to ship to a new address.
- jasonlingx 14y agoI remember reading somewhere how Amazon actively optimizes security vs user experience. I.e. as far as possible they try not to make the user login or enter a password unless absolutely necessary. You could have a stale login from months ago and still access some parts of your account, but you need to enter your password before you purchase or access some sensitive information.