AMAZON force-resets some account passwords

[fjtorres]

From ZDNet:
http://www.zdnet.com/article/amazon-...tag=TREc64629f

The story so far:

In the email, Amazon said it "recently discovered that your [Amazon] password may have been improperly stored on your device or transmitted to Amazon in a way that could potentially expose it to a third party."

It adds: "We have corrected the issue to prevent this exposure."

The email said it has "no reason" to believe passwords were improperly disclosed to a third party but issued a temporary password out of an "abundance of caution."

The story is still developing so the source will be updating the posted story.
Sounds like it might be platform specific.

[HarryT]

A sensible precaution to take if there's any possibility of passwords being compromised.

[Atunah]

Originally Posted by HarryT

A sensible precaution to take if there's any possibility of passwords being compromised.

Agreed. About a 1 or 2 years ago, they did a reset on my account. At the time they said there might have been a attempt to get in or some thing. But I appreciate that they take precautions.

[Nate the great]

Originally Posted by HarryT

A sensible precaution to take if there's any possibility of passwords being compromised.

Pretty standard stuff, yes.

[susan_cassidy]

It could also have been a phishing email.

[HarryT]

Originally Posted by susan_cassidy

It could also have been a phishing email.

Amazon's email was genuine; the fact that it appeared in the "Message Centre" on Amazon's website is proof of that. Only messages from Amazon go there.

[Froide]

I didn't get that message from Amazon but recall that ComiXology, LinkedIn, and some other apps have done that in the past, in the face of suspected security breaches. Better safe than sorry.

[Fluribus]

Just in case some folks don't know. Amazon now allows two-factor authentication on accounts. Can use either text message or authenticator app. Requires a backup for recovery using either text message or automated voice call. I didn't see any option for recovery codes to be printed in advance and stored away.

[HarryT]

Originally Posted by Fluribus

Just in case some folks don't know. Amazon now allows two-factor authentication on accounts. Can use either text message or authenticator app. Requires a backup for recovery using either text message or automated voice call. I didn't see any option for recovery codes to be printed in advance and stored away.

Where is this, please? I see no mention of it in my Amazon account.

[ProDigit]

As time progresses, hardware improves.
Just to give you an idea,
With rainbow tables, it was entirely possible in 2008 to hack an 8 digit password with numbers and letters within 10 minutes. And that was on a simple intel dual core 1.6Ghz processor.
Rainbow tables are pre-calculated passwords, where a massive pc often spends an entire year generating passwords in a file, and compresses them to fit a dvd.
The computer using the dvd, with the right software, could literally process in 10 minutes, the passwords that took a very fast pc 1 year to generate.

Rainbow tables reduce hacking time by a factor of almost 1000x shorter.

At current, our limitation is 8 characters (letters, numbers, and symbols), or a combination of 13 letters and numbers.

I don't forsee hardware becoming much faster in the future, as Intel is working on lowering the power envelope, and heat emissions of cpus, rather than increased speeds.
However I do see increased speeds on server side, through the use of more multicores
It might be entirely possible that a future server could hack 15 digit passwords within a reasonable amount of time, while with current technology, 13 digit passwords with symbols, still take almost a full year to crack.

[ProDigit]

The phone verification is a fluke, and the reason I quit PayPal.
My old cell number was invalid, and I tried using paypal from an unregistered (public) device,
So PayPal denied the transaction, and I removed PayPal just as I have removed Facebook for the same type of shit (registered users).
PayPal was a pain in the bunghole from the very first start, with their registered addresses.

I'm just not too fond of putting in too much sensitive data online.
Next thing you know, is sales websites want your full SSN.
I'm ok with that. Not with the hackers somehow getting a hold of their databases, and getting access to countless names, addresses, credit card numbers, and SSNs as well... Just saying...

Most websites, including MSN hotmail, facebook, and Amazon Store Card, use a set of registered devices.
That means if your laptop (or pc) breaks, and you haven't updated your cellphone, you'll have quite the PITA, trying to gain access to your account!

[HarryT]

Originally Posted by ProDigit

PayPal was a pain in the bunghole from the very first start, with their registered addresses.

PayPal (in the UK at least) are a bank, and so need to follow the security standards that all banks do for online transactions. I welcome their stringent security.

[Froide]

Originally Posted by HarryT

Where is this, please? I see no mention of it in my Amazon account.

Jim Moynihan | Gear | November 19, 2015 | "How to Enable Amazon’s Two-Step Authentication"

Here’s how to locate the options and switch them on.

1. Click on Your Account in the top nav bar.

2. On the Your Account page, click on Change Account Settings.

3. On the Change Account Settings page, click Edit on Advanced Security Settings. This brings you to an explainer page for two-factor authentication. Click Get Started.

4. Choose whether to receive authentication codes via text message or via an authenticator app. If you choose text messages, you’ll need to input your phone number. If you choose an authenticator app, you’ll need to launch it on your phone and scan an on-screen barcode to sync it.

5. Next, Amazon will require you to enter backup contact info to receive codes. Here’s where that second phone number or authenticator app comes into play.

6. Next, you’ll get to a page that explains how two-factor authentication works. You can elect to have the codes disabled for commonly used devices at the bottom of the page.

And you’re set! Two-factor does add the minor inconvenience of a slightly longer sign-in process, but it’s well worth it for the extra peace o mind.

[HarryT]

Thanks. "Advanced Security Settings" doesn't appear to be there on Amazon UK. Perhaps this facility isn't available in the UK yet?

[bullet]

Originally Posted by HarryT

Where is this, please? I see no mention of it in my Amazon account.

Makes sense to me. I changed my pw and implemented 2 stage via Google Authenticator as soon as the cat was out of the bag yesterday.
I like it. I am using Google to protect my Amazon account. Life is good.