10 ms·

The lack of HTTPS at Amazon: identifying items purchased via information leakage

128 points by Smerity 12y ago

liareye 12y ago
Mr Bezos, tear down this HTTP
greglindahl 12y ago
In an era where American ISPs charge extra to not spy on your non-encrypted traffic, it seems odd that Amazon doesn't care... improving the non-Amazon ads that you receive surely causes Amazon to lose money.
- miander 12y ago
  Can you elaborate on what you mean by ISP's charging extra? I'm not familiar with what you're referring to. Do you mean traffic shaping?
  - jordanthoms 12y ago
    http://arstechnica.com/information-technology/2013/12/att-offers-gigabit-internet-discount-in-exchange-for-your-web-history/ http://arstechnica.com/information-technology/2013/12/att-of...
    - oldmanjay 12y ago
      ah, interesting. so the charitable, non-gratuitously-negative interpretation of the OP is that he or she is a very lazy summarizer. the uncharitable interpretation is that he or she uses deceptive rhetorical devices to bolster a weak point.
- fennecfoxen 12y ago
  There's also some fascinating anti-showrooming technology out there which monitors when you look at things over the store's guest wifi network. Browsing products on Amazon still isn't encrypted (as the article identifies) and neither is "Add to Cart". http://techcrunch.com/2013/12/03/retailnext-acquires-eric-schmidt-backed-wi-fi-analytics-company-nearbuy-systems/ http://techcrunch.com/2013/12/03/retailnext-acquires-eric-sc...
coderdude 12y ago
I wonder if the lack of HTTPS during normal browsing is a deliberate choice (one motivated by testing) or if it's only like that out of legacy (preservation of URLs). It's difficult to imagine all of the possible issues they may know about that we don't, given their scale. The author mentions that removing the ref parameter would be a solution to one of the problems discussed in the article but I put forward that they could also just encrypt the value for transmission and store the information in plain on the backend. If they won't move to HTTPS then that should solve at least one of the issues.
- diziet 12y ago
  I would imagine they ran the A/B tests on 99th percentile metrics and also on consumer behavior and decided that having the HTTPS enabled by default would result in less revenue/growth/etc I'd imagine with the number of requests they make to various analytics, internal services etc it is not a super simple migration.
  - tombrossman 12y ago
    Old discussion here on HN, but the claim is made that every 100ms latency cost 1% in profit: https://news.ycombinator.com/item?id=273900 https://news.ycombinator.com/item?id=273900 HTTPS is pretty fast now with SPDY (and soon HTTP/2) but there is no avoiding the fact that is slows down that first page load ever so slightly. No doubt they have studied this carefully and opted for maximum speed, as this maximizes income.
  - yandie 12y ago
    No. The reason Amazon is not on HTTPS yet is because not all parts of the system are ready. I believe the company will finish the transition in June
  - DeuceDaily 12y ago
    My wild guess is processing costs. With the amount of traffic they see, encrypting every page of every item someone looks at could potentially be very costly.
throwaway5060 12y ago
There are definitely plans to enable https on www.amazon.* and people are working on this right now.
- theandrewbailey 12y ago
  Citation needed.
yandie 12y ago
Amazon is moving to HTTPS everywhere in this June. The whole website is a complex machinery with multiple components and it takes time to move those components to HTTPS.
- MichaelApproved 12y ago
  What's the source of this info?
  - throwaway5060 12y ago
    I don't know about yandie, but I work at Amazon and I have seen emails about this. It's not planned for rolling out to production until September.
    - MichaelApproved 12y ago
      You're posting with a throwaway account which has no credibility. This is not a source at all.
hannob 12y ago
It is actually worse than that. Given an active attacker one can easily steal passwords using SSL stripping attacks. Ebay is also affected. Cookie stealing also works. Pretty much every mixed http/https setup ("encrypt only the login") is broken.
- steakejjs 12y ago
  No. SSL stripping is an attack where you prevent a user from upgrading to an HTTPS connection. That isn't possible here. Many sites have multiple tiers of authentication. For example viewing items to purchase is over HTTP but to actually checkout or manage your account requires you to go to HTTPS and reauthenticate on an HTTPS login page. Always. After this you are kept on HTTPS for the trusted actions. Amazon only does shopping over http but trusted actions are all HTTPS. This has been amazons authentication scheme for years and it is actually the same as googles (where Google does have http assets, they force a reauth before going to https only stuff). The most an attacker could do is inject code on http pages, annoyingly add things to cart, purchase items with 1 click purchase (inject javascript that clicks the button) and eavesdrop on all items purchased (quite serious). BUT they cannot perform SSL stripping if Amazon doesn't do any auth over HTTP. An attacker could do some phishing like attacks to try to convince the user to put their password in at the wrong time, though.
  - pomfpomfpomf3 12y ago
    An attacker can also replace an https:// https:// login URL with an http:// http:// one on a page sent via unencrypted connection. The http:// http:// page can then be manipulated in any way.
    - steakejjs 12y ago
      Right, but you get a redirect to the https login page with an http login URL. An attacker can attempt phishing with HTML/JS injection on a HTTP page but an attacker cannot get a user to be looking at Amazon's real login page over http. I think the problem here is the term ``SSL stripping'' was used and it may be kind unclear what MITM attacks is actually encompassed by it. The OP wrote ``An attacker can easily steal passwords with SSL Stripping''. If OP meant he can easily steal passwords by basically a s/https/http on all urls on the page, OP's wrong. The attacker needs to create their own fake login page, present it to the victim, and hope the victim falls for it
aareet 12y ago
I had a scare regarding this a few days ago. I was searching for a Bose airline adapter on DuckDuckGo and clicked the top result without looking at the URL. [1] I ended up hitting some page on www.casselsonline.com that exactly mirrored Amazon's website right down to suggested items and everything. I didn't even notice I wasn't on amazon.ca until I went to sign in and found the certificate broken. Couldn't find a place to report URLs on DDG, so I reported them to Google. [1] These bad results still show in the index - https://duckduckgo.com/?q=bose%20airline%20adapter%20canada+site:www.casselsonline.com https://duckduckgo.com/?q=bose%20airline%20adapter%20canada+...
- shaldengeki 12y ago
  It helps to have something like HTTP Switchboard[1] installed on your browser, with per-domain rules. When I click the result, I get a white page since HTTPSB blocks the CSS/JS/cookies etc by default on domains that I haven't explicitly whitelisted. [1] https://chrome.google.com/webstore/detail/http-switchboard/mghdpehejfekicfjcdbfofhcmnjhgaag?hl=en https://chrome.google.com/webstore/detail/http-switchboard/m...
sarciszewski 12y ago
With an HTTP connection, it becomes easy for an attacker in the middle to prompt the user to re-enter their password and have it re-transmitted in the clear. I'm surprised more attackers don't do this.

128 points by Smerity 12y ago

Mr Bezos, tear down this HTTP

In an era where American ISPs charge extra to not spy on your non-encrypted traffic, it seems odd that Amazon doesn't care... improving the non-Amazon ads that you receive surely causes Amazon to lose money.

miander 12y ago
Can you elaborate on what you mean by ISP's charging extra? I'm not familiar with what you're referring to. Do you mean traffic shaping?
- jordanthoms 12y ago
  http://arstechnica.com/information-technology/2013/12/att-offers-gigabit-internet-discount-in-exchange-for-your-web-history/ http://arstechnica.com/information-technology/2013/12/att-of...
  - oldmanjay 12y ago
    ah, interesting. so the charitable, non-gratuitously-negative interpretation of the OP is that he or she is a very lazy summarizer. the uncharitable interpretation is that he or she uses deceptive rhetorical devices to bolster a weak point.
fennecfoxen 12y ago
There's also some fascinating anti-showrooming technology out there which monitors when you look at things over the store's guest wifi network. Browsing products on Amazon still isn't encrypted (as the article identifies) and neither is "Add to Cart". http://techcrunch.com/2013/12/03/retailnext-acquires-eric-schmidt-backed-wi-fi-analytics-company-nearbuy-systems/ http://techcrunch.com/2013/12/03/retailnext-acquires-eric-sc...

coderdude 12y ago

I wonder if the lack of HTTPS during normal browsing is a deliberate choice (one motivated by testing) or if it's only like that out of legacy (preservation of URLs). It's difficult to imagine all of the possible issues they may know about that we don't, given their scale. The author mentions that removing the ref parameter would be a solution to one of the problems discussed in the article but I put forward that they could also just encrypt the value for transmission and store the information in plain on the backend. If they won't move to HTTPS then that should solve at least one of the issues.

diziet 12y ago
I would imagine they ran the A/B tests on 99th percentile metrics and also on consumer behavior and decided that having the HTTPS enabled by default would result in less revenue/growth/etc I'd imagine with the number of requests they make to various analytics, internal services etc it is not a super simple migration.
- tombrossman 12y ago
  Old discussion here on HN, but the claim is made that every 100ms latency cost 1% in profit: https://news.ycombinator.com/item?id=273900 https://news.ycombinator.com/item?id=273900 HTTPS is pretty fast now with SPDY (and soon HTTP/2) but there is no avoiding the fact that is slows down that first page load ever so slightly. No doubt they have studied this carefully and opted for maximum speed, as this maximizes income.
- yandie 12y ago
  No. The reason Amazon is not on HTTPS yet is because not all parts of the system are ready. I believe the company will finish the transition in June
- DeuceDaily 12y ago
  My wild guess is processing costs. With the amount of traffic they see, encrypting every page of every item someone looks at could potentially be very costly.

throwaway5060 12y ago

There are definitely plans to enable https on www.amazon.* and people are working on this right now.

theandrewbailey 12y ago
Citation needed.

yandie 12y ago

Amazon is moving to HTTPS everywhere in this June. The whole website is a complex machinery with multiple components and it takes time to move those components to HTTPS.

MichaelApproved 12y ago
What's the source of this info?
- throwaway5060 12y ago
  I don't know about yandie, but I work at Amazon and I have seen emails about this. It's not planned for rolling out to production until September.
  - MichaelApproved 12y ago
    You're posting with a throwaway account which has no credibility. This is not a source at all.

hannob 12y ago

It is actually worse than that. Given an active attacker one can easily steal passwords using SSL stripping attacks. Ebay is also affected. Cookie stealing also works. Pretty much every mixed http/https setup ("encrypt only the login") is broken.

steakejjs 12y ago
No. SSL stripping is an attack where you prevent a user from upgrading to an HTTPS connection. That isn't possible here. Many sites have multiple tiers of authentication. For example viewing items to purchase is over HTTP but to actually checkout or manage your account requires you to go to HTTPS and reauthenticate on an HTTPS login page. Always. After this you are kept on HTTPS for the trusted actions. Amazon only does shopping over http but trusted actions are all HTTPS. This has been amazons authentication scheme for years and it is actually the same as googles (where Google does have http assets, they force a reauth before going to https only stuff). The most an attacker could do is inject code on http pages, annoyingly add things to cart, purchase items with 1 click purchase (inject javascript that clicks the button) and eavesdrop on all items purchased (quite serious). BUT they cannot perform SSL stripping if Amazon doesn't do any auth over HTTP. An attacker could do some phishing like attacks to try to convince the user to put their password in at the wrong time, though.
- pomfpomfpomf3 12y ago
  An attacker can also replace an https:// https:// login URL with an http:// http:// one on a page sent via unencrypted connection. The http:// http:// page can then be manipulated in any way.
  - steakejjs 12y ago
    Right, but you get a redirect to the https login page with an http login URL. An attacker can attempt phishing with HTML/JS injection on a HTTP page but an attacker cannot get a user to be looking at Amazon's real login page over http. I think the problem here is the term ``SSL stripping'' was used and it may be kind unclear what MITM attacks is actually encompassed by it. The OP wrote ``An attacker can easily steal passwords with SSL Stripping''. If OP meant he can easily steal passwords by basically a s/https/http on all urls on the page, OP's wrong. The attacker needs to create their own fake login page, present it to the victim, and hope the victim falls for it

aareet 12y ago

I had a scare regarding this a few days ago. I was searching for a Bose airline adapter on DuckDuckGo and clicked the top result without looking at the URL. [1] I ended up hitting some page on www.casselsonline.com that exactly mirrored Amazon's website right down to suggested items and everything. I didn't even notice I wasn't on amazon.ca until I went to sign in and found the certificate broken. Couldn't find a place to report URLs on DDG, so I reported them to Google. [1] These bad results still show in the index - https://duckduckgo.com/?q=bose%20airline%20adapter%20canada+site:www.casselsonline.com https://duckduckgo.com/?q=bose%20airline%20adapter%20canada+...

shaldengeki 12y ago
It helps to have something like HTTP Switchboard[1] installed on your browser, with per-domain rules. When I click the result, I get a white page since HTTPSB blocks the CSS/JS/cookies etc by default on domains that I haven't explicitly whitelisted. [1] https://chrome.google.com/webstore/detail/http-switchboard/mghdpehejfekicfjcdbfofhcmnjhgaag?hl=en https://chrome.google.com/webstore/detail/http-switchboard/m...

sarciszewski 12y ago

With an HTTP connection, it becomes easy for an attacker in the middle to prompt the user to re-enter their password and have it re-transmitted in the clear. I'm surprised more attackers don't do this.