Well, if you have AWS linked to your amazon account I would imagine this could be disastrous...
AWS supports two factor auth among other ways to secure your account.
Re:The weakest link by far is Apple
by jasonlingx on Tuesday August 07, 2012 @09:47PM
(#4353443)
I remember reading somewhere how Amazon actively optimizes security vs user experience. I.e. as far as possible they try not to make the user login or enter a password unless absolutely necessary.
You could have a stale login from months ago and still access some parts of your account, but you need to enter your password before you purchase or access some sensitive information.
Why would they have to send the stuff to you?
Amazon make you re-enter all your credit card details every time you want to ship to a new address.
You make a good argument. I was going to say that in Apple's defense, there's some expectation that a user who enables remote-wipe knows what he/she is getting into and has some responsibility to have a backup solution. But that point is mostly moot since Apple also hosts personal email/data accounts, which would be compromised by this hack. Amazon does to a lesser extent...there's data, but not terribly actionable data. Whereas if Apple is your email account used to retrieve passwords...well, then you're in Honan's terrible position.
AFAIK, though, I use the same credentials to get into my Amazon consumer account as I do my Amazon EC2 and S3 account and into my affiliate account (and Kindle, etc.). Does the security level elevate as soon as I've been flagged as a developer-user who isn't just buying books/CDs? If there is, I've seen no sign of it.
Isn't remote wipe enabled by default in iCloud?
I think it comes along for the ride with "Find my <Apple Device>" which would for most users seem to be a fairly innocuous feature. I don't think the possibility of total data loss if they lost control of their iCloud account would occur to most people.
Re:The weakest link by far is Apple
by Ihavenoname on Tuesday August 07, 2012 @04:27PM
(#4352094)
It is an option you need to approve on the Mac the iPhone automatically backers itself up so it is a non issue unless your computer or Mac is not backed up too.
Apparently - and I don't have any way of confirming this myself - if you enable automatic backups to iCloud your iPhone refuses to automatically back itself up to your computer anymore. So all your eggs are basically in one iCloud-shaped basket.
Amazon on the other hand doesn't (potentially) have the power to wipe your machines and cause havoc. If someone compromises your Amazon account, then worst case they can order goods in your name to be sent to you & Amazon will be out the cost of shipping and re-selling those goods, plus the cost of any chargebacks if they mess you about refunding your credit card. In other words, the risk here lies with Amazon, not the end-user, so they are rightly free to set the level of security applied to Amazon accounts to whatever they feel meets their goals.
It's not Amazon's fault that the 4 digits that the credit card companies decided that it was ok to leave on your receipts are precisely the four digits that Apple accepts as evidence that you own the card in question. The fault lies with Apple for accepting data that you leave behind every time you make a purchase with your credit card (it's printed on every credit card receipt you leave behind at the local pizza joint IIRC) as being suitable evidence to permit an anonymous caller access to an Apple account.
Now, if Amazon applies the same level of security to accounts with personal data or other costs to the end-user (cloud drive, Amazon S3 or EC2 accounts and so on) then you'd be right to lay into them. Does anyone know if that's the case?