Hacker News Reader

Comment by jiveturkey | Hacker News Reader

based on spam email i have received, that i clearly should not have, i believe this was an exposure to marketplace sellers from whom you have bought a product.

I am very careful with my email. i’m not just guessing here. i actually reported it to amazon security. (no answer from them of course.)

View on HN

eBay are particularly careless in that regard.

There's no reason that a seller should ever see the customer's actual e-mail address on such a site but I'm up to ebay5@ on my mail server due to direct spam from sellers from whom I bought one item in the past.

No, sellers, I did not 'opt in' to your spam just because I bought something. But why does eBay ever give them the address?

Oddly I've never had a problem with random Chinese sellers, it's always Euro or US ones.

Chinese sellers have been very pleasant to deal with IME, including obviously hand-written niceties, handwritten thank you notes (maybe not in the best English but the sentiment is there) for a bunch of stuff. Occasionally small 'gift' items, have gotten Chinese fun-size snacks too.

There are US sellers that have resulted in 27+ emails _within one day of purchase_, one seller has managed to sign my ebay_a10f9@ alias up for five separate companies reselling third party warranties / affiliate spam for the above. What the fuck?

I have a different point of view as a longtime eBay user on both the buying and selling side. The more the company acted to "re-intermediate" buyer-seller interaction by doing things like restricting auction content, channeling communication through their own messaging system, concealing identities in feedback to prevent buyers and sellers from doing reasonable due diligence on each other, prohibiting various payment methods in order to shove PayPal down everyone's throats, and so on, the less interested I became in using eBay in general.

There was a strong sense of community on eBay in the company's early years that gradually went away over the years, and I still miss it. eBay is now dominated by medium-to-high volume corporate sellers, and that was not how it was originally supposed to work.

They intentionally provide this information to marketplace sellers. It's arguably poor design but it's definitely not an unintentional security flaw. Marketplace/FBA sellers have talked about strategies for utilizing customer email address for years [1]

[1] https://sellercentral.amazon.com/forums/t/how-to-access-all-...

Also, your Amazon profile is public by default, especially any wishlists.

This is incredibly creepy. A few months ago I realized this and was able to find some friend's profiles and see their reviews. I hate implicit sharing/suggested friends/etc in services especially non-social services. For instance, my friend is following me on a tech shopping site I use... something I have 0 interest in. I've started attaching pseudo anonymous sites to a backup email address for this reason. If I want to friend someone I'll find them.

Wow. That's incredible. I would say this is completely against what I would assume the expected behavior would be.

It kind of makes sense for wishlists.

No, the email address listed there is an @marketplace.amazon.com address that forwards messages to the customer while adding an Amazon footer, not the actual user email address. If the latter was shared with sellers somewhere, that was not intentional.

Great reason to setup wildcard e-mails so you can do something like amazon@yourdomain.com!

I would assume that's how OP knows the leak came from amazon (assuming the address was more obscure than amazon@whatever.com)

Might not be best idea to use exact word amazon, have gotten this email before -

> use of Amazon trademarked words, images, or reviews which may include variations or misspellings and this is a violation of our Trademark Guidelines

> [...]

> An example of the above violation can be found here: amazon@[mydomain]

I would be surprised if that was enforceable, it sounds more like an effort to ensure they're proactive about their trademark.

Well it's certainly enforceable in that you won't be able to use it for your Amazon account. They are free to reject any email address they like.

I would also not suggest using the exact company name/URL in the email address used to sign up. One time I couldn't log in to my password manager service and after a _lot_ of back and forth it turned out that after some years my email was somehow scraped from their DB for using their domain name in my email... So now I always go with something obscure but still traceable back to the service it was used for.

No it's the other way around. I am a marketplace seller and I have started receiving phishing links to my unique amazon email account.

Sellers have been exposed not buyers.

I'm not a seller and I got the email.

Some AI laughed at your email, put a +1 on a category threshold counter and then deleted it. I hope you didn't put too much effort into it.

Do Perl scripts qualify as AI?

Reply on news.ycombinator.com