5 ms·

90% of these attempts at scamming the CSRs could be prevented if Amazon allowed me to provide a SMS address that they could send a message to for confirmation.

90% of these attempts at scamming the CSRs could be prevented if Amazon allowed me to provide a SMS address that they could send a message to for confirmation. Every time I login to gmail over the web from anywhere but my personal computer, I take an (at most) 5 second pause while Google SMS's my cellphone and has me enter the 6 digit code. Failing that, in my wallet, I have a list of 12 Backup "Nuclear Codes" should I for some reason lose my iPhone and need to login to email in the intervening period while I get it replaced. Trivial to implement, very secure.

cobbal 14y ago
Unfortunately, what Amazon has to secure is almost every account. 2 factor authentication is great for the more security-conscious, but that's a very small percentage of Amazon's customers. All the scammers would have to do is hit one of the 98% of accounts that just have default security. Sure, it can protect your account, but it can't protect Amazon unless they force everyone to use it (which would obviously not be good for building customer loyalty.)
ProblemFactory 14y ago
GMail has a nice 2-factor scheme. While the SMS might need external services, the app-based verification keys are based on open standards and open-source code, and can be added to any web application with about 10 lines of code: http://code.google.com/p/google-authenticator/ http://code.google.com/p/google-authenticator/ There is even a Unix login module for adding it to SSH.
- bigiain 14y ago
  Amazon use the same two factor auth too. I've got my AWS account secured with the Google Authenticator app using TOTP codes as well as passwords. It worries me that "consumer friendly" customer service leaks information like this, that could potentially lead to my AWS account getting suspended while fraud is investigated.
  - mbreese 14y ago
    It's probably a good idea not to use the same Amazon account for AWS and personal shopping, just for this reason.
    - bigiain 14y ago
      Yeah, I know that _now_… I've got real live client sites which I haven't (yet) migrated important S3/Route53/EC2/CloudFront services out of the "I'll just try this out on my account to see if it'll work" setup.
mseebach 14y ago
The OP actually suggests a second factor for authentication: The last four digits of the card you paid the order with.
- micro-ram 14y ago
  Except that Amazon shows you the last 4 of your card when logged in. That should be removed and the cards should be named.
  - mseebach 14y ago
    This is for authentication when you're not logged in. But that aside, yes, I'd would too prefer named cards. I don't think of my cards by their numbers quite as much as their issuers.

cobbal 14y ago

Unfortunately, what Amazon has to secure is almost every account. 2 factor authentication is great for the more security-conscious, but that's a very small percentage of Amazon's customers. All the scammers would have to do is hit one of the 98% of accounts that just have default security. Sure, it can protect your account, but it can't protect Amazon unless they force everyone to use it (which would obviously not be good for building customer loyalty.)

ProblemFactory 14y ago

GMail has a nice 2-factor scheme. While the SMS might need external services, the app-based verification keys are based on open standards and open-source code, and can be added to any web application with about 10 lines of code: http://code.google.com/p/google-authenticator/ http://code.google.com/p/google-authenticator/ There is even a Unix login module for adding it to SSH.

bigiain 14y ago
Amazon use the same two factor auth too. I've got my AWS account secured with the Google Authenticator app using TOTP codes as well as passwords. It worries me that "consumer friendly" customer service leaks information like this, that could potentially lead to my AWS account getting suspended while fraud is investigated.
- mbreese 14y ago
  It's probably a good idea not to use the same Amazon account for AWS and personal shopping, just for this reason.
  - bigiain 14y ago
    Yeah, I know that _now_… I've got real live client sites which I haven't (yet) migrated important S3/Route53/EC2/CloudFront services out of the "I'll just try this out on my account to see if it'll work" setup.

mseebach 14y ago

The OP actually suggests a second factor for authentication: The last four digits of the card you paid the order with.

micro-ram 14y ago
Except that Amazon shows you the last 4 of your card when logged in. That should be removed and the cards should be named.
- mseebach 14y ago
  This is for authentication when you're not logged in. But that aside, yes, I'd would too prefer named cards. I don't think of my cards by their numbers quite as much as their issuers.