Amazon on the other hand doesn't (potentially) have the power to wipe your machines and cause havoc. If someone compromises your Amazon account, then worst case they can order goods in your name to be sent to you & Amazon will be out the cost of shipping and re-selling those goods, plus the cost of any chargebacks if they mess you about refunding your credit card. In other words, the risk here lies with Amazon, not the end-user, so they are rightly free to set the level of security applied to Amazon accounts to whatever they feel meets their goals.
It's not Amazon's fault that the 4 digits that the credit card companies decided that it was ok to leave on your receipts are precisely the four digits that Apple accepts as evidence that you own the card in question. The fault lies with Apple for accepting data that you leave behind every time you make a purchase with your credit card (it's printed on every credit card receipt you leave behind at the local pizza joint IIRC) as being suitable evidence to permit an anonymous caller access to an Apple account.
Now, if Amazon applies the same level of security to accounts with personal data or other costs to the end-user (cloud drive, Amazon S3 or EC2 accounts and so on) then you'd be right to lay into them. Does anyone know if that's the case?
You could have a stale login from months ago and still access some parts of your account, but you need to enter your password before you purchase or access some sensitive information.
AFAIK, though, I use the same credentials to get into my Amazon consumer account as I do my Amazon EC2 and S3 account and into my affiliate account (and Kindle, etc.). Does the security level elevate as soon as I've been flagged as a developer-user who isn't just buying books/CDs? If there is, I've seen no sign of it.
And obviously most people share their address with various online retailers and friends/family, etc. This is not something I expect to have to keep secret to securely use amazon.com.
(ps. I'm not an iCloud user. But I am a frequest amazon.com user, so I've sent them an e-mail voicing my concerns -- I hope they fix their policies).
From Honan's post:
"In response, Apple issued a temporary password. It did this despite the caller’s inability to answer security questions I had set up. And it did this after the hacker supplied only two pieces of information that anyone with an internet connection and a phone can discover."
Sounds like Apple support needs some lessons on social engineering prevention.
Sure, if I was a facebook db admin I'd be semantically satiated with the data, but that doesn't mean it isn't important.
There used to be books that they put on everyone's doorsteps that had everyone's name, address and phone number in them. Society managed. Addresses should not be considered private information, nor should birthdays, mother's maiden name, etc.
'Tell us your account number, as well the amount of a recent transaction on the account'.
Oh, so you gave me a personal check? Great, let me go deposit it, so that's a transaction that I know about. And I already have your account number (and routing information) from the check itself.
This isn't just to be able to drain all funds from the checking account (for which the numbers on the check alone are sufficient) but to reset the passwords on the account, which usually gives you access to any linked accounts as well.
* SSN?
* Full name?
* How long have you been with the bank?
* How many accounts do you have?
* Do you have a business account?
* How many business accounts?
* What's the name of the business?
* Have you set up auto-debit?
* Have you set up electronic-debit?
* To what companies?
* What was your last charge on your credit card?
* Do you have any monthly transfers set up?
* For what amounts?
* Do you have any loans?
* Do you own any investment funds?
* Which?
* Have you reset the password before?
* <My security question>?
* How many two-factor auth thingies do you have?
* Serial number on your two-factor auth thingy?
* Model of the above?
Are the questions I recall. So at least not every bank is careless enough to only require you to name a recent transaction.
The banks seem to have worked out that they have access to a reasonable amount of information that they can use it in this way.
The answers weren't easily guessable and there was a threshold so you didn't need to get everything right which allows them to make the questions a little trickier.
The system wasn't perfect - if you broke into my house and got my papers you could probably get past it - but it was a million times better than asking where I went to school.
Including business accounts and brokerage accounts (which are often handled separately with different security processes), I've had numerous accounts with many different providers, and never had anything close to that level of security.
(private browsing, throwaway email, tor, check cashing place, etc.)
This, on the other hand, was simply following procedure. No social "engineering" here.
Seeming clueless when doing malicious things is unquestionably a form of social engineering.
Say I'm a naive person and say I go for dinner and pay via credit card. Since there's not much information on there, I throw the receipt away. On the receipt (at least those I get here) is my last name, as well as the 4 last digits of my CC number. Now assume my last name was sufficiently rare in the area for a potential attacker to make sure that this was actually my receipt. Also assume, that I'm an Apple nerd with an iCloud account (which I'm not).
Some potential hacker finds my receipt, puts 1 and 1 together and calls Apple and gains complete access using nothing but a receipt with 4 digits and a name on it.
Is the restaurant to be hold responsible for it because they printed those 4 digits on the receipt? Hell no! Is Apple responsible for giving access to my account to a complete stranger possessing nothing but a CC receipt? Yes.
In this case, Apple is after all responsible for the data loss and their security measures are clearly questionable. One should never use a security key which is obtainable by everybody and his grandma. The last 4 digits of your CC number are not private because the card companies decided that it's secure enough to show them.
Don't get me wrong, 95% of the fault rests with Apple, but Amazon should review their processes. There is simply no reason for them to be handing these details out, particularly without valid confirmation of the person's identity - if they need to confirm the card details the customer can give the four digits and the customer service representative can confirm them.
One of the basic rules of security, don't do anything that's not necessary and this is entirely unnecessary.
Excuse me while I delete all of my files from Amazon's Cloud Drive...
Or a driver's license, or a voter registration form....
In this case it's a bit of a red herring given that his private address is right there on his personal website -- the whois is just an extra, completely unnecessary, step. Hide behind a whois protection service, but anyone motivated can get your address easily.
A personal address is not a secret bit of information. Pretending that it is brings nothing but an illusion of security. The same goes for many other laughably easy to acquire bits of information about someone -- what primary school you went to, one's mother's maiden name, etc: These are things that we've never treated as secret, and it's only the laziest of hackers that it discourages.
Private registrations allow you to anonymously register a domain. That's still a useful service for a lot of people.
http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-hona...
> First you call Amazon and tell them you are the account holder, and want to add a credit card number to the account. All you need is the name on the account, an associated e-mail address, and the billing address. Amazon then allows you to input a new credit card. (Wired used a bogus credit card number from a website that generates fake card numbers that conform with the industry’s published self-check algorithm.) Then you hang up.
> Next you call back, and tell Amazon that you’ve lost access to your account. Upon providing a name, billing address, and the new credit card number you gave the company on the prior call, Amazon will allow you to add a new e-mail address to the account. From here, you go to the Amazon website, and send a password reset to the new e-mail account. This allows you to see all the credit cards on file for the account — not the complete numbers, just the last four digits. But, as we know, Apple only needs those last four digits. We asked Amazon to comment on its security policy, but didn’t have anything to share by press time.
At least to get into the Apple account, you need the credit card on file. For Amazon, you can send a fabricated credit card number and get complete access (because you can add a new email account, to which you send a password reset to).
Apple just seems like the worser player because Mat Honan put so much power into the hands of iCloud. If Honan was in charge of administering enterprise services using Amazon's EC2 services, and hackers used his account to wipe out everything (or compromise corporate security), everyone would be calling out Amazon.
Edit: I haven't seen this fact mentioned much, but Honan's billing address was compromised through a WHOIS lookup on his domain. This is a huge reason to use registry protection services. It's true someone could look you up using things like Pipl and Spokeo, but that's only if you have something in public records, such as a mortgage (or, in some cases, leases).
Honan is in an especially tough situation because of the uniqueness of his real name.