Hacker News Reader

Comment by vanadium | Hacker News Reader

"Amazon does check your [...] MAC address"

How, perchance, does Amazon manage _that_ feat, exactly?

That would be pretty damned impressive. I ran into that line and stopped reading, but the thrust of this is that there are fake reviews on the Internet. Who knew.

The real mystery is...how does something like this wind up on the front page of HN?

"The real mystery is...how does something like this wind up on the front page of HN?"

Why are you dismissing this as HN-unworthy news?

Amazon is well known for their sophisticated internal monitoring systems. They often will take down reviews if they are fake and generated from the same IP or MAC addresses. The point of this article is that a band of sellers have managed to hack the Amazon iron curtain and how they did it is the $64000 question. It is not about saying "this is nothing new" -- it is about being curious about "how is this being exploited (i.e. hacked) and taken advantage of and why is this being allowed to persist given the almighty Amazon resources and their goal to make it a safe marketplace".

MAC address - always wondered how they manage to grab the MAC address from the browser.

"Amazon does check your [...] MAC address" -- this is well known -- but still does not explain how these sellers are getting away with submitting fake reviews en masse.

I think you're getting confused. MAC addresses aren't passed up-stream (in IPv4). There are many ways for websites to uniquely identify users. A MAC address isn't one of them.

You are wrong. They are passed up. Can't send you the screen shot at this moment - but trust me... I have inspected the URL and it includes the mac address - for real, no lie. Anyone who knows how to do this please share.

The above commenter was saying that there is no way to find a user's MAC address by looking at their IP packets alone. MAC addresses are used by link layer protocols (ethernet), but an IP address is used for identification in higher levels. In short, your router knows your MAC address, but Amazon.com only knows your IP. If any website on the internet could get your MAC address that would be very troubling, because a well-behaved MAC address is a quasi-unique identifier for your network hardware.

This is only possible if there is software installed on the machine that is collecting the MAC address and sending it (browsers don't do this). You are likely confusing a MAC address with a unique (random) identifier assigned to your browser by Amazon.

Dude, it is the mac address they grab.

I ran ifconfig en1 | grep ether and the mac address showed up on my URL omnibar when I firebugged it.

I've even noticed this happening at Starbucks whenever you use their WiFi - they will sniff your MAC address and it shows up in the URL omnibar when you agree to the WiFi terms.

Will the real hackers please chime in on how this (grabbing MAC address) can be achieved...

Yes, this happens at Starbucks because your MAC address is captured when you connect to their wifi network (this happens on virtually any captive portal, not hard). I, for one, cannot find my MAC address in a long list of history because it is simply not passed via web requests.

You can get the MAC address of anyone who is connected to the same network - but that's it.

Amazon just needs to sustain a cookie in between times that they do have a chance to collect your MAC address. I wouldn't be surprised if certain plugins could detect it, like flash or amazon streaming plugins. Also, kindle on your home network could grab it.

I don't think Flash has that ability, but Java can if you accept the numerous prompts you'll get...

Reply on news.ycombinator.com