News for hackers. Stuff that matters.
Re:Amazon's customer service backdoor by fps on Sunday January 24, 2016 @05:25PM (#10964339)
I think the bigger problem is that public information like your name and address is sufficient for proving your identity. If we make whois information private, what about phone books, property records, direct mail databases, etc. etc.
Re:Amazon's customer service backdoor by VeilEm on Sunday January 24, 2016 @05:50PM (#10964418)
If someone has your public name and address you're already at significant risk if you ever say anything controversial that gets attention. You're liable to being swatted, getting fake pizza orders, having people show up at your house, harassing you and much more. See Zoe Quinn, Brian Krebs, lots of less well known individuals, etc.
Re:Amazon's customer service backdoor by thephyber on Sunday January 24, 2016 @06:28PM (#10964561)
Which only proves your comment's parent's point even more.

{SWAT, pizza orders, etc} assume that the phone number that shows up on caller ID is authentication of the identity of the phone line on the other end. They could call back the number on caller ID to verify the original caller matched the person who picked up, but they don't.

Having knowledge of a Social Security number was assumed to be authentication, but it's increasingly obvious that such an authentication scheme is antiquated and was destined to fail from the beginning. When an identity thief can get a mortgage under my name with little more than credit bureau data on me, it costs only a little more than $15 to destroy my credit, my time, and my future because transactions don't have sufficient authentication.

These awfully designed authentication schemes will only magnify the problems as more companies (especially credit bureaus and data marketers) pass around data on me and make it easier for someone to buy it on demand.

Re:Amazon's customer service backdoor by the_ancient on Monday January 25, 2016 @05:59AM (#10966530)
>Having knowledge of a Social Security number was assumed to be authentication

No the people that designed and implemented Social Security knew it was not secure for identification purposes, the first few decades of the program even had "Not to be used for Identification" on the card.

Then the government, and financial industry got lazy and said "well since the majority of people already have these numbers assigned to them lets just use them for Identification as well" and made it a defacto National ID. Something it was never designed for, nor secure enough to be,

Re:Amazon's customer service backdoor by bigiain on Sunday January 24, 2016 @06:51PM (#10964649)
Keep in mind too that Caller ID is trivially blockable (and blocked caller id isn't remarkable enough to be super suspicious), and it's also easily within the capability of many of the 4chan/gg griefers to spoof "correct" Caller ID numbers as well.
Re:Amazon's customer service backdoor by XorNot on Monday January 25, 2016 @10:05AM (#10967518)
Caller ID shouldn't be blockable, these days. It's a big ridiculous problem that we've defaulted to "you can intrude with communications anonymously" - and phone calls are definitely intrusive.

I'm pretty much a hair away from blocking all calls without caller ID at my house so I can reliably lock out the remaining spam callers.

Re:Amazon's customer service backdoor by hollerith on Sunday January 24, 2016 @10:01PM (#10965327)
By "gg" you mean what? Gamer gate?
Re:Amazon's customer service backdoor by Karunamon on Monday January 25, 2016 @11:17AM (#10967983)
I assume so. The "gamergate are women-hating harassers" misconception is still alive and well.
Re:Amazon's customer service backdoor by rplnt on Monday January 25, 2016 @05:15AM (#10966414)
Not that I order pizza more than once a few months, but I would probably switch the pizza place that would call back to confirm order each time.
Re:Amazon's customer service backdoor by TeMPOraL on Monday January 25, 2016 @04:55AM (#10966379)
As a counterpoint, see billions of people every day.

This is getting to the point of paranoia at this point. You're already at significant risk if you ever say anything that gets attention by virtue of living in a society. But it comes with benefits, too...

Re:Amazon's customer service backdoor by ams6110 on Sunday January 24, 2016 @06:15PM (#10964517)
Agree. Your contact info in whois adds little to any number of other public records that will contain your name, address, phone number.

It does make good sense to not use your primary "personal" email address in whois, nor your home address. PO Box rentals are fairly cheap and that's what I use for whois registrations.

Re:Amazon's customer service backdoor by detaro on Sunday January 24, 2016 @07:34PM (#10964838)
Sadly, you can't even use PO boxes for all domains, some registries require a "full" address.
Re:Amazon's customer service backdoor by Pyxl101 on Sunday January 24, 2016 @09:45PM (#10965287)
USPS now supports a feature called "street addressing". Basically, instead of writing "PO Box #" as the address, you may write the actual street address of the same facility followed by your box number, something like "123 Main St #456". Private mailbox providers also often accept addresses like "123 Main St Apt 456", where 456 is the number of your mailbox as well.
Re:Amazon's customer service backdoor by Anechoic on Sunday January 24, 2016 @11:47PM (#10965629)
USPS now supports a feature called "street addressing".

Keep in mind that street addressing doesn't work at all USPS locations, although it does work at most of them. You have to fill out a form with USPS or any mail addressed to that location will be returned as undeliverable.

Re:Amazon's customer service backdoor by jcrawfordor on Monday January 25, 2016 @04:15AM (#10966279)
I've found private mailbox providers to be preferable in most every way to post-office PO boxes. Private providers are "street addressed" to begin with, virtually always accept from all couriers, usually have longer hours, often can call or email you when you receive a package, etc. In most cities, there are also more of them than post offices, I suspect because it's such an easy business to start. Look around your neighborhood: copy/print shops, shipping stores, and small business supply stores probably also rent mail boxes.

I wish this was an industry with a bit more visibility. When you think about renting a "PO Box", there's a good chance that you'd be better off with a box rental from a private mail service.

Re:Amazon's customer service backdoor by bigiain on Sunday January 24, 2016 @07:49PM (#10964894)
"The street finds its own uses for things."

Where I am (Australia) theres a whole bunch of places that'll provide "non Post Office PO boxes" who're perfectly happy for you to address things to "Suite 306" or "Apartment 306" as well as "PO Box 306" at whatever address the box is located. Fools _most_ of the "must be a real address, not a PO Box" restrictions.

(Interestingly StartSSL failed me on that once when I gave one of those as a personal address - they mailed me saying "that looks like a business address, we need a personal home address for personal identity validation") - I dunno of they Google Street-viewed it or of they've got some automated system that flagged it...)

Re:Amazon's customer service backdoor by DrScump on Sunday January 24, 2016 @09:34PM (#10965264)
USA is a little different. To get mail using the street address of the PO, boxholders have to sign an additional agreement, BUT:

1) it's free, and

2) they will also accept UPS/FedEx/DHL/etc shipments on your behalf for no charge! (they will sign for packages, but if "Direct" signature (the named recipient) is required, they can't accept those.)

If you just try using "UNIT #" or "APT #" or whatever, or you don't have this additional agreement signed, they can and will return to sender.

Re:Amazon's customer service backdoor by fanf2 on Monday January 25, 2016 @04:27AM (#10966309)
"Mailboxes etc." in the UK is a fairly widespread commercial PO box provider. I didn't realise that was their business until I found out about a local spammer using their Cambridge branch for their address :-)
Re:Amazon's customer service backdoor by MaikuMori on Sunday January 24, 2016 @09:12PM (#10965206)
Most likely more than x accounts used the same address.
Re:Amazon's customer service backdoor by rashkov on Sunday January 24, 2016 @07:45PM (#10964877)
Yes, but the new piece of information is that you are the one who owns that domain
Re:Amazon's customer service backdoor by Your_Creator on Thursday January 28, 2016 @03:34PM (#10991072)
It's not just about proving who is who, it can also be about wanting to distance yourself from random people and their nonsense problems.
Re:Amazon's customer service backdoor by akerro on Monday January 25, 2016 @03:51AM (#10966223)
https://news.ycombinator.com/item?id=7525198

His daughter was also attacked...