Security on Kobo Accounts

[davidfor]

Originally Posted by JSWolf

Are you saying that you can change the password & log out of the account and the Reader will still be logged in and able to browse the store?

Yes. Or at least this was the case in the past. I haven't tested recently.

And it is probably not a firmware issue but a server issue. A key is generated on the device when you do the setup. That is used for authentication when connecting to the server later. If the password of the account is changed, that should invalidate all keys in use and the next time the device connects to the server it should fail and the user would need to login to the device again. This wasn't case the last time I tested it.

[HRHReadsALot]

I think my point was that anyone can pick up your reader and instantly access your account, change the password and hijack your entire library. I get that I don' t have to leave my credit card info or real birth date in the billing/profile section. That does make the process of purchasing a little more cumbersome. However, there is nothing to stop the loss of access to my library. That would really hurt. Having said all that, I thank you all for responding. I have to say that it was a little disconcerting to receive responses that were so dismissive of an issue that shoud be of more concern to anyone with a reader, whether Kobo or Kindle. Didn't your momma ever tell you that if you didn't have anything good to say, don't say anything at all?

[petercreasey]

H, just do like I do and have your Kobo synced to a very limited email address account which is an account with no books and no credit card info.

I can't think of any way my KA1 in the wrong hands can be harmful to me.

Or am I missing something?

[Cinisajoy]

Originally Posted by HRHReadsALot

I think my point was that anyone can pick up your reader and instantly access your account, change the password and hijack your entire library. I get that I don' t have to leave my credit card info or real birth date in the billing/profile section. That does make the process of purchasing a little more cumbersome. However, there is nothing to stop the loss of access to my library. That would really hurt. Having said all that, I thank you all for responding. I have to say that it was a little disconcerting to receive responses that were so dismissive of an issue that shoud be of more concern to anyone with a reader, whether Kobo or Kindle. Didn't your momma ever tell you that if you didn't have anything good to say, don't say anything at all?

Are you saying someone would steal your kobo and delete all your books?
In that case, might I recommend you back up all your books on a computer.

[davidfor]

Originally Posted by HRHReadsALot

I think my point was that anyone can pick up your reader and instantly access your account, change the password and hijack your entire library. I get that I don' t have to leave my credit card info or real birth date in the billing/profile section. That does make the process of purchasing a little more cumbersome. However, there is nothing to stop the loss of access to my library. That would really hurt. Having said all that, I thank you all for responding. I have to say that it was a little disconcerting to receive responses that were so dismissive of an issue that shoud be of more concern to anyone with a reader, whether Kobo or Kindle.

I don't think anyone was being dismissive of your concerns. The problem is that only one person knew what they were - You. You didn't say what the problem was, just "Security on Kobo Accounts". Until you told us what the problem was as you saw it, we didn't know. The only dismissive post I can see is because they didn't know about the problem.

And yes, there is a problem. And I agree it is serious. Have you told Kobo about it? Have you told Kobo how important it is to you? If you haven't, then you shouldn't be surprised that the problem hasn't been fixed. If no-one tells them about a problem, then there is no reason for them to fix it. And yes, the moment I worked out what was happening, I told Kobo about it. But everyone who is concerned should raise it so they know it is important and not just one or two crackpots.

Didn't your momma ever tell you that if you didn't have anything good to say, don't say anything at all?

Didn't you momma always tell you to tell her what the problem was when complaining? And there is a bit of pot-kettle here.

[koboy]

Originally Posted by HRHReadsALot

I think my point was that anyone can pick up your reader and instantly access your account, change the password and hijack your entire library. I get that I don' t have to leave my credit card info or real birth date in the billing/profile section. That does make the process of purchasing a little more cumbersome. However, there is nothing to stop the loss of access to my library. That would really hurt. Having said all that, I thank you all for responding. I have to say that it was a little disconcerting to receive responses that were so dismissive of an issue that shoud be of more concern to anyone with a reader, whether Kobo or Kindle. Didn't your momma ever tell you that if you didn't have anything good to say, don't say anything at all?

i completely agree with every word, it should be a no brainer to be able to have the choice to password protect your Kobo e-reader if you want to, the option is readily available on a Kindle.

best wishes koboy

[davidfor]

Originally Posted by Cinisajoy

Are you saying someone would steal your kobo and delete all your books?
In that case, might I recommend you back up all your books on a computer.

Actually no, they can't. If someone has your device, they can download to the device any of your books. They can buy books new books, and download them. But, the delete will only put them in the archive section of the library. I can't see a way to delete them completely from the account using the device.

Thinking about this, if you don't store the credit card, the worse thing that someone can do is criticise your taste in books. And maybe mess up the recommendation by buying something you wouldn't read. Actually, the worse thing they can do is mess with the annotations and collections for the purchased books.

[HRHReadsALot]

As indicated, I am new to this forum thing. My original post had a header "Security Issues on Kobo Accounts" and in the body of the message, I didn' t repeat it because I thought you would all read the header and carry on. My bad.
I think my message made it clear that my issue was with accessability to my books and personal information and the fact that Kobo does nothing to give people options to secure their accounts. I have, in fact, contacted Kobo and made my unhappiness known. By posting on this website, I had hoped to inspire enough other people to get as outraged about it as I am and then maybe Kobo would sit up and pay attention. Other than a couple of responses here, I am getting the idea that people are a bit laissez-faire about it all, so Kobo will see it has nothing to worry about!
It is of interest to me that someone posted that Kindle does have security options, so maybe it is time to dump Kobo and go with Kindle.

[robko]

Originally Posted by HRHReadsALot

I think my point was that anyone can pick up your reader and instantly access your account, change the password and hijack your entire library.
........ However, there is nothing to stop the loss of access to my library. That would really hurt.

I don't believe that it's actually possible to change your password on the device itself so you don't need to worry being locked out of your account that way. In fact I just went into "Accounts" setting on the device and it specifically says "To view OR CHANGE your account settings or payment info, please sign in to www.kobo.com and select My Account"

[robko]

And to answer the other part of your post, I will admit that I am pretty laissez-faire about it. My worst case is that someone could see my taste in books and I don't care. I realize that some people might not want people to know what they were reading or want kids to see what they have on it, but I don't care. I also don't worry about the infinitesimally small chance that some who steals my e-reader or finds it if I lost it is both a hard core reader and a crook. If they are, maybe they're going to run up my book tab, but I just don't see the odds of it happening as being big enough for me to think about let alone worry about.
It's been talked about here before from other people that like you would like a password. Based on the fact that it hasn't happened, obviously Kobo doesn't feel there is a big enough return to them for them cost of adding it and dealing with the people who will inevitably manage to lose their password and not want to factory reset etc to get the device working again. If having a password is a key requirement for your e-reader needs, then maybe Kindle is a better option currently.

[Ripplinger]

I'm also unconcerned about it. Like robko, I don't care if they see my taste in books (if I had an email associated with purchasing on the reader, which I don't). But even if I had a legit account with billing info on the reader, I could still call Kobo and explain and get them to delete those illegally purchased books and refund my account and change the password since only I would have my complete billing info that would be on the reader to verify that I'm the real owner.

I'm much more concerned about losing the reader itself, there's no one you can call to get your money back there. And having a password will do absolutely no good, all the thief would have to do is do a factory reset which wipes the password (all mobile devices work the same in that regard), and they have a nice new reader.

Access to my account and books really isn't a worry to me because that can be fixed. The lost reader cannot.

[MGlitch]

Things someone can do if they steal your Kobo

1) Read your books
2) Move your books to archive status
3) Buy more books

You can instantly prevent number 3 by removing the credit card on file. Once that is done there are no funds tied to the account.

You can (very likely) prevent 1 and 2 by contacting Kobo and letting them know. They certainly don't want you to not be able to easily purchase books, nor for your account to not be secure. As I've stated they should be able to blacklist the stolen Kobo using its serial number. So the person may be able to read the books on the device, but they should be prevented from archiving anything and receiving new books you purchase.

Adding a password feature as an option to the Kobo would be a step they could take to prevent this. However these forums are user forums. Kobo occasionally might read them, but generally not in an official manner. As others have noted it's best to take your fully realized and explained issue to Kobo. Giving them as much detail as possible, rather than assuming they can connect the dots with your concerns.

[davidfor]

Originally Posted by HRHReadsALot

As indicated, I am new to this forum thing. My original post had a header "Security Issues on Kobo Accounts" and in the body of the message, I didn' t repeat it because I thought you would all read the header and carry on. My bad.
I think my message made it clear that my issue was with accessability to my books and personal information and the fact that Kobo does nothing to give people options to secure their accounts. I have, in fact, contacted Kobo and made my unhappiness known. By posting on this website, I had hoped to inspire enough other people to get as outraged about it as I am and then maybe Kobo would sit up and pay attention. Other than a couple of responses here, I am getting the idea that people are a bit laissez-faire about it all, so Kobo will see it has nothing to worry about!
It is of interest to me that someone posted that Kindle does have security options, so maybe it is time to dump Kobo and go with Kindle.

Sorry, but no it wasn't clear. The subject was clear. And the post then told me you were worried about something, but not what. Were you worried about the physical security of the device, or did you know of a way to hack the Kobo server? Or maybe you knew that someone had stolen all the account details from Kobo.

As to our attitude towards it, "laissez-faire" is probably about right. I looked at it the last time this came up and wasn't that worried. I have looked at it a bit more, and am even less worried. Yes, it isn't good and it is something Kobo should change, but the loss if I lose my device is going to be device, nothing else.

[DNSB]

Originally Posted by HRHReadsALot

I think my point was that anyone can pick up your reader and instantly access your account, change the password and hijack your entire library.

Hmmmm....

Not quite sure what you mean by accessing my account? The ereader has limited access to your account mostly to purchase/remove books. Changing most of the account information involves logging into Kobo's website.

Changing the account password? I'm not aware of how you could change your password from your ereader.

Hijacking my library? The ereader would be able to access any books in the Library section of your Kobo account but not in the Archive section. You still have access to those ebooks from the web or by adding another Kobo device and/or app to your account. I think there was a limit of 6 devices/apps but that may have changed.

Since Kobo will email you for any non-free book purchases, you will know your ereader is being used by another person. I've never needed to but Kobo customer service should be able to disconnect the stolen ereader from your account and reverse any charges.

[JSWolf]

What is the best way to contact kobo about this security issue?