DVD Planet's Automatic Account Creation Raises Security, Privacy Issues
Joel says when he ordered a disc from DVD Planet via Amazon, the company automatically created an account for him on their website. The problem is that the default password they used was so easy to guess that he figured it out on the second try, and he suspects it's the same password they use on every account. Once you guess it, you can see the customer's past orders and credit card billing address. When Joel contacted them to have the account removed, he was told that wasn't possible.
Here's Joel's letter:
I've encountered a problem with an online retailer's weak privacy practices that I would like to make other consumers aware of.
I recently made a purchase from Digital Eyes/DVD Planet through Amazon's Marketplace. When the company emailed me to confirm my order, they also informed me that they had created an account for me at their website, dvdplanet.com. While I find it irritating enough that someone would create an account under my name without my permission, I was surprised to discover that the password for this account was extremely easy to guess. It wasn't even indicated in the email they sent me, and it only took me two tries to log in to my new account (it's the same password they give to all of their customers who purchase through Amazon - go ahead, try to guess what it is).
Until I logged into this account that I didn't ask for and changed the password, anyone who knows my email address and has half a brain could have logged into the account, where they would have found my credit card billing address (useful for identity thieves) and DVD purchase history with the company (a plain old breach of my privacy).
I frequently overlook the order confirmation messages I get from Marketplace sellers, since they're all essentially the same. I'm sure there are plenty of others out there who do the same thing. If any of them have ever purchased from Digital Eyes/DVD Planet, they may not even know that they've had an account created in their name with a password a monkey could figure out, and which contains their billing information. I think they should know their private information could be exposed to virtually anyone.
When I emailed the company to have my account deleted (amazon@digitaleyes.net), customer service twice attempted to tell me that accounts cannot be deleted once they've been created. After I pointed out that this situation is not possible, they've informed me that my request has been forwarded to the appropriate department. Although I plan to follow through to make sure my account is erased once and for all, there was no indication in the correspondence I had with customer service that the company might be willing to consider that this practice is maybe a bad idea.
(Photo: Darwin Bell)
Post a comment
Comments:
There is nothing I hate more than companies who won't delete your account. E-Trade will forever be my enemy for the practice.
i guess we can chalk this up to bad programming... same stupidity as the guy who use a client-side javascript to check if password matches a table of passwords given to the client....
Two words - Contact Amazon.
If this is an amazon marketplace account, then their are restrictions in place on the retailer, especially in how they can use your data. Basically, it can only be used for order fulfillment.
What they have done is a violation of their terms for the Amazon Marketplace, and presents a clear information security hazard. \
They will fix the problem really fast once the threat of losing their marketplace account is in front of them.
password==amazon ?
I'm assuming that this isn't a concern for those who already have an account...with their own password?
Can't trust Amazon anymore.
@taking_this_easy: Well, sort of.
The problem with setting the passwords and deleting the account might just be poor programming, but this ignores the fact that such an account should never have been created without the customer's explicit approval.
Yes, the company needs to have the customer's data on file somewhere, but it should be on a private server, not simply shoved onto an account that is available to anyone who can guess a straightforward password.
telling you they cant delete an account is a load of bs and so is making an account automaticly. contact amazon
My mom went through this last fall. She bought a video from them and a month later found a charge of $14.95 for a "membership fee" for DVD Planet. She called DVD Planet who told her she was a member and they couldn't delete her account.
Amazon didn't help saying that if she'd read the fine print when she bought a DVD from them, she would have seen that a purchase entitled them to automatically create a membership account. She went to her credit card company, Amex, and explained the situation. They took care of it.
Don't buy from DVD Planet!
Have had issues with Amazon Marketplace vendors and have discontinued using the service. Amazon takes no responsibility for these vendors and open a avenue for these vendors to take advantage of people trusting in the Amazon name.
Yea obviously there is no database housing all your info. It's hanging out in space somewhere, that's why it can't be removed.
/sarcasm
I dunno... Your name and address aren't really that private, or important, anyway. You can get that info from the phone book. Or any number of free websites. As long as Amazon isn't supplying them the credit card number I wouldn't worry too much. On the other hand, it could be pretty embarrassing to have your order history potentially available to anyone snooping about what kind of movies you like.
As an Amazon Marketplace seller myself, let me just tell you that Amazon will give you ZERO HELP here. Amazon is not interested in getting involved. They're interested in setting up a hands-off system where they can make lots of money with as little work as possible. They will just repeat over and over that you should work it out with the seller. Unfortunately it works both ways too. We've had people sell homemade versions of our products on Amazon as "authentic" and when we buy the products that are obviously fake and send them to Amazon, Amazon just tells us to "work it out with the other seller.". As if illegal counterfeiting is something we can just casually work out.
Uh, I've placed an order for a DVD from dvdplanet.com, too through Amazong or Ebay. Several months ago. So, I just tried to log in on dvdplanet.com with the password I *think* the original poster is hinting at, and it didn't work. That's when I realized I probably bought the DVD through this seller on Ebay, not on Amazon. However, I put in my email address in the "Forgot Your Password?" section, and immediately, it told me that my password's been emailed to me.
Lo and behold, I got the email. WITH my password listed in the text of the email. And the #*&@ing password is -- you guessed it -- Ebay.
So, I log in, and MY credit card billing address is there too.
I'm going to email them too to tell them to delete my account. The "welcome" email I got from them months ago says to email orders@dvdplanet.com. Here I go.
Retailers! Listen up, politicians are looking pretty bad these days and if you keep up practices like these, they will look at you as an opportunity to make themselves look good, if you get my drift.
@johnfrombrooklyn: Isn't there a government agency that works with merchandise counterfeiting. Get them invovled and I'm sure Amazon's ears will perk up a bit.
Your address is not private information. It's publicly available to anyone who wants it.
@I_am_Awesome: Even if your credit card billing address is different than your mailing/domicile address?
Yahoo is just as bad. I ordered from a yahoo store and even though I unchecked the "add my credit card to the yahoo wallet" I later found out it was there and someone else had used it for porn sites. Yahoo not only refused to deleted the account but also refused to work with the local law enforcement when I filed the police report for the stolen credit card #.
"Your address is not private information. It's publicly available to anyone who wants it."
Not when its connected to credit card billing info. Giving someone info that I have an American Express card and the billing address is 123 Sesame Street is asking for ID theft.
Its also NOT anyone's business which DVDs I order.
In the past I've been pretty comforttable using amazon's marketplace, it seems secure since the vendor doesn't get my credit card... but if amazon permits this sort of activity, that detracts pretty seriously from my feelings that using marketplace is secure. Amazon ought to have rules about how information given for marketplace purchases can be used. and those rules should be rigidly enforced.
@JGKojak:
Well, for most people, the billing address is usually their house, or if not, their work place, or in much rarer instances, some sort of P.O. Box. Getting someones billing address would take about as much skill as, I don't know, calling them and asking them...
My first marriage was EXACTLY like this....