How can you trust an Used Kindle ?

[GeorgeYellow]

With Kindles once again jailbroken, I put forward that:
1. It is completely unsafe to ever enter your Amazon account credentials into an Used Kindle
2. It is possibly unsafe sell a non-jailbroken Kindle that has ever had your credentials.

I will explain my reasoning, and you can tell me I'm overly paranoid.

Buying an used Kindle:

• it is trivial to install code on a Kindle that will survive either a Factory Reset or a firmware installation.
• I see no reason why someone can't modify the list of files preserved across Factory Reset to preserve an installation across both Factory Reset and firmware install
• There are three files that are common knowledge, but there may be others that can be preserved.
• It is straightforward to put code that waits for a token to be entered (probably by watching for LIPC Event), and sending that to C&C endpoint.
• The tokens on the device are sufficient for purchasing titles, as well as obtaining Wifi credentials from every device on the account

Selling an used Kindle:

• Kindles do not overwrite files on Factory Reset
• Token(s) are preserved on the filesystem, and have a consistent format
• Once a Kindle is jailbroken by the new owner, they can extract these tokens
• It is unclear how long the preserved tokens are valid for!!

I think the answer is for there to be a push for Amazon to release the full software installation process - presumably this is over a "special" usb cable - so users can be confident that the device isn't "contaminated"

Meanwhile, anyone buying an used device needs to trust in the Kindness of Strangers.

[Quoth]

How can you trust a used car, Mac, Android, iOS, PC etc?
The larger risk is that it's a blacklisted Kindle.

Also the best reason for a cheap used kindle is simply to register once, put it in a drawer and use Amazon's Download & Transfer in a browser for bought books. None of your objections apply to all that, even if all or true.

A Kindle is madness for PD books. It's now too restrictive a platform compared to all except Nook.

[Barty]

I trust in the laziness of strangers not to bother doing any of this shenanigan

Sent from my SM-T720 using Tapatalk

[neil_swann80]

Whilst a jailbroken and compromised Kindle could be of concern, I'd see is as being a more targeted attack (for a specific person etc).

Scammers wouldn't go to the trouble of modifying a Kindle to obtain a single person's credentials when they have other avenues for acquiring credentials in bulk with far less time and effort.

I would like to see an option for a full disk wipe, repartition and install though, for peace of mind.

[lazyreadr]

Originally Posted by Quoth

How can you trust a used car, Mac, Android, iOS, PC etc?
The larger risk is that it's a blacklisted Kindle.

The problem with a kindle is that the account credentials can potentially be abused to buy stuff on your bill. That's pretty hard with a car and a PC and Android can be safely wiped (even if that step is often omitted). A kindle due to its locked OS potentially is much harder to safely wipe? Then this is indeed an issue.

As always, most of the time nothing will happen. Yet a rest risk remains.

[binaryhermit]

Y'all are paranoid.

[deleted2]

Originally Posted by binaryhermit

Y'all are paranoid.

[Quoth]

Originally Posted by lazyreadr

The problem with a kindle is that the account credentials can potentially be abused to buy stuff on your bill.

After it's deregistered? Surely that's a sellers's issue, not a buyer?
If that's true, then never sell it. Put it in a drawer.

I get an immediate email after any Amazon purchase and I never turn on WiFi except on rare situations on any ereader, especially not Kindle once registered, except the Android one to add an App from Playstore or get a Library book/

[Frogm4n]

In the professional security industry we have the term "risk tolerance". You evaluate a risk based on the likelihood of it happening/effecting you and the damages/costs it will incur. You mitigate based on your willingness to take on the costs of time and/or money to prevent it. Is a $15 used Kindle worth being super paranoid that someone put it into the wild with the intent of stealing your account? For the vast majority of people, no. There's always a risk that someone stuck a GPS tracker on your car at any time. Do you do a full inspection for one before you drive? No, because the risk vs the hassle is usually within your risk tolerance, unless you have very specific circumstances.

[JSWolf]

Originally Posted by binaryhermit

Y'all are paranoid.

I agree 100%. There is no such thing as privacy. It's a fallacy.

[DNSB]

I may be paranoid. The question is if I am paranoid enough.