Amazon orders reset for some customers' passwords

Amazon.com has required an undisclosed number of customers to reset passwords to their online accounts after the company said some passwords "may have been improperly stored" on devices.

Several Amazon customers reached out to tech-news site ZDNet, saying they received emails from Amazon that the passwords needed to be reset.

Amazon representatives did not return requests for comment.

In the email sent to affected customers, Seattle-based Amazon said it did not believe passwords were exposed but was acting "out of an abundance of caution."

The issue, whether it is a serious problem or not, comes at an inopportune time for Amazon - just days before the start of the busiest shopping season of the year.

But it's unlikely Amazon's system was breached, said Lars Harvey, CEO of IID, an Internet security company in Tacoma, Wash. Rather, Amazon probably realized that a mobile device or a third-party app that people use to access the online store was not storing or transmitting passwords securely, he said.

"A fair number of do not engage in a way that keeps passwords totally safe," Harvey said. "Sometimes are not transmitted over encrypted protocol."

Amazon likely discovered the problem with the third-party device or app and decided to notify all customers that have used that service, he said

"They're pretty vigilant looking to protect their customers," Harvey said.

Security with many third-party apps is a widespread issue, he added.

In fact, there are security companies that specialize in seeking out and testing apps for security flaws.

Twitter user Lindsay Shaerf posted a picture of the email she got from Amazon UK.

"We recently discovered that your Amazon.co.uk password may have been improperly stored on your device or transmitted to Amazon in a way that could potentially expose it to a third party," the email reads, in part.

"We have corrected the issue to prevent this exposure. While we have no reason to believe your password was improperly disclosed to a third party, out of an abundance of caution, we have assigned a temporary password to your account," it said.

Amazon introduced two-factor authentication to boost security to its U.S. customers last week.

If customers choose, they can require that a code sent to them via text be entered along with their password.


Explore further

Amazon opens first physical bookstore

©2015 The Seattle Times
Distributed by Tribune Content Agency, LLC.

Citation: Amazon orders reset for some customers' passwords (2015, November 25) retrieved 19 July 2019 from https://phys.org/news/2015-11-amazon-reset-customers-passwords.html
This document is subject to copyright. Apart from any fair dealing for the purpose of private study or research, no part may be reproduced without the written permission. The content is provided for information purposes only.
6 shares

Feedback to editors

User comments

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more