4 ms·

When you sign up, your Amazon email and password are sent to server using GET and so are visible in the URL. While the request is done over HTTPS (and traffic s

When you sign up, your Amazon email and password are sent to server using GET and so are visible in the URL. While the request is done over HTTPS (and traffic snoopers can't see it), it is very likely that there are a ton of Amazon credentials lying around unencrypted in a log somewhere on their server. For some reason, the "Norton Secured" badge makes me less likely to trust the site and looking at the inline, not very well written Javascript gives me even less confident that the guys behind this site have the technical chops to keep my data secure.

jggonz 12y ago
I agree. The use of the Norton Secured badge made me quickly leave the site. A possible solution: There's a "Login with Amazon" service that may be what the developer needs to be using: http://login.amazon.com/ http://login.amazon.com/
- martingordon 12y ago
  According to one of the founders, "Login with Amazon" doesn't grant access to a user's Amazon account.[1] If they were using it, there would be no need to ask for users' passwords. 1: https://news.ycombinator.com/item?id=8070310 https://news.ycombinator.com/item?id=8070310
- ChristianKletzl 12y ago
  A/B testing showed that the Norton security badge is perceived positively. Does anyone have a different experience?
  - dbtc 12y ago
    I would guess that A/B testing against HN users would provide different results than the general population.
  - seanlinehan 12y ago
    I can't speak broadly, only from my personal reaction. I also left the site after seeing the Norton logo (and before reading the comments here), because it seemed completely misplaced. I associate Norton with cleaning my computer of badware, not of whether or not some just-launched service is treating my data securely. Because it seemed out of place, it felt like it was an obvious tactic to bootstrap trust where there wasn't any. A better icon (for me) would have been a badge from your SSL provider, or even just some well designed lock icon.
    - ChristianKletzl 12y ago
      Very interesting point. The Norton batch is our SSL Batch (Symantec bought them or vice versa). It seems like they need to do a better job of education users about that. I don't think they have a pure "Symantec SSL" batch anymore.
  - deleted 12y ago
    [deleted]
jflowers45 12y ago
Wow ... good call on the logs ... curious to hear whether they plan to change from GET to POST. Still wouldn't be comfortable, but seems like something they should do, like right now
ChristianKletzl 12y ago
thanks for the information. looking into this right now (and preemptively deleted the logs)
ElComradio 12y ago
For the public at large, that badge is likely to increase trust, and certainly few outside the tech community are going to be concerned with poor JS. disc: not implying you would disagree with any of the above.
jngreenlee 12y ago
Can you briefly explain how to analyze for that, using non-dev tools like Chrome Inspector? I used 'Inspect Element', but found 'Post' on the popup form: <form id="add_products_form" name="add_products_form" onsubmit="connect_amazon2(); return false;" method="post" enctype="multipart/form-data" _lpchecked="1">
- schrodinger 12y ago
  http://i.imgur.com/06580e9.png http://i.imgur.com/06580e9.png This is from chrome developer tools, network tab
  - jngreenlee 12y ago
    So its POST to their server, then GET is generated to AMZ, if I understand correctly? Also, would you say chrome developer tools is the lightest/most accessible way for the general public to inspect for such a thing? EDIT: TY, schrodinger. That turned out to be a tab in Dev Tools that I just hadn't dug into before. No need to install anything!
    - schrodinger 12y ago
      It seems the form submit is being cancelled by the "return false" in the onsubmit, meaning that the form won't be posted normally and that method="post" irrelevant. The connect_amazon2() must be making the GET request.
    - martingordon 12y ago
      Using the Chrome Dev Tools, you can record the network requests that occur using the Timeline tab. It's actually using GET to their server and something unknown to Amazon (that would most likely be server to server and not accessible over Javascript). Although the method on the form is POST, it has an onsubmit handler which calls the connect_amazon2() JS function (which makes a GET AJAX request on line 311) and then returns false, preventing the form from being submitted. Yes, the Chrome Dev Tools are probably the easiest way to take a look at this type of information. I actually used Safari, but Chrome's tools are much easier to use.
bambax 12y ago
> in a log somewhere on their server As well as on Amazon's logs, which aren't meant to hold customers' passwords. This is bad, bad, bad (interesting idea though).

jggonz 12y ago

I agree. The use of the Norton Secured badge made me quickly leave the site. A possible solution: There's a "Login with Amazon" service that may be what the developer needs to be using: http://login.amazon.com/ http://login.amazon.com/

martingordon 12y ago
According to one of the founders, "Login with Amazon" doesn't grant access to a user's Amazon account.[1] If they were using it, there would be no need to ask for users' passwords. 1: https://news.ycombinator.com/item?id=8070310 https://news.ycombinator.com/item?id=8070310
ChristianKletzl 12y ago
A/B testing showed that the Norton security badge is perceived positively. Does anyone have a different experience?
- dbtc 12y ago
  I would guess that A/B testing against HN users would provide different results than the general population.
- seanlinehan 12y ago
  I can't speak broadly, only from my personal reaction. I also left the site after seeing the Norton logo (and before reading the comments here), because it seemed completely misplaced. I associate Norton with cleaning my computer of badware, not of whether or not some just-launched service is treating my data securely. Because it seemed out of place, it felt like it was an obvious tactic to bootstrap trust where there wasn't any. A better icon (for me) would have been a badge from your SSL provider, or even just some well designed lock icon.
  - ChristianKletzl 12y ago
    Very interesting point. The Norton batch is our SSL Batch (Symantec bought them or vice versa). It seems like they need to do a better job of education users about that. I don't think they have a pure "Symantec SSL" batch anymore.
- deleted 12y ago
  [deleted]

jflowers45 12y ago

Wow ... good call on the logs ... curious to hear whether they plan to change from GET to POST. Still wouldn't be comfortable, but seems like something they should do, like right now

ChristianKletzl 12y ago

thanks for the information. looking into this right now (and preemptively deleted the logs)

ElComradio 12y ago

For the public at large, that badge is likely to increase trust, and certainly few outside the tech community are going to be concerned with poor JS. disc: not implying you would disagree with any of the above.

jngreenlee 12y ago

Can you briefly explain how to analyze for that, using non-dev tools like Chrome Inspector? I used 'Inspect Element', but found 'Post' on the popup form: <form id="add_products_form" name="add_products_form" onsubmit="connect_amazon2(); return false;" method="post" enctype="multipart/form-data" _lpchecked="1">

schrodinger 12y ago
http://i.imgur.com/06580e9.png http://i.imgur.com/06580e9.png This is from chrome developer tools, network tab
- jngreenlee 12y ago
  So its POST to their server, then GET is generated to AMZ, if I understand correctly? Also, would you say chrome developer tools is the lightest/most accessible way for the general public to inspect for such a thing? EDIT: TY, schrodinger. That turned out to be a tab in Dev Tools that I just hadn't dug into before. No need to install anything!
  - schrodinger 12y ago
    It seems the form submit is being cancelled by the "return false" in the onsubmit, meaning that the form won't be posted normally and that method="post" irrelevant. The connect_amazon2() must be making the GET request.
  - martingordon 12y ago
    Using the Chrome Dev Tools, you can record the network requests that occur using the Timeline tab. It's actually using GET to their server and something unknown to Amazon (that would most likely be server to server and not accessible over Javascript). Although the method on the form is POST, it has an onsubmit handler which calls the connect_amazon2() JS function (which makes a GET AJAX request on line 311) and then returns false, preventing the form from being submitted. Yes, the Chrome Dev Tools are probably the easiest way to take a look at this type of information. I actually used Safari, but Chrome's tools are much easier to use.

bambax 12y ago

> in a log somewhere on their server As well as on Amazon's logs, which aren't meant to hold customers' passwords. This is bad, bad, bad (interesting idea though).