Dick Morrell ✔️.
For those who trust me:
Goto your Amazon account, sign out of all your devices, everything, everywhere all your Echos (yes I know it's a pain), reset your password, delete 2FA and any tokens and reset them. Now.
That doesn't include Fido / Yubikeys but does include Auth tokens.
Do it now.
As much a pain as it is to reset Echo and all smart devices, trust me, please do it.
I can't tell you more yet, but I am being ethical and you need to actually realise I have a clue.
It's been a scary day
varx/tech
@Cloudguy @topher It's at least a little bit vague. :-) I used to have the same login for the ecommerce and AWS sites, but I don't any more; I don't recall what happened, but I think they've separated them, or encouraged people to separate them.
For people with *AWS-only* accounts, does anything need to be done? Because that's the bigger lift.
feld
Dick Morrell ✔️.
@topher Its not vague
It's a blanket, sign out of everything, reset your password, turn off 2FA then immediately turn it back on and regen Auth QRs or whatever you use, Yubikey not affected
Topher 🌱🐧💚
This is a bit vague. Is this applicable to strictly Amazon accounts with devices e.g. Echos? All Amazon accounts whatsoever, including those only used for shopping and never connected with any "smart" devices like Echos or vacuum cleaners? Does this apply to AWS? I understand you can't divulge any specific details, but it would be helpful to know what you're suggesting is impacted to know what to preventatively lock down and redo 2FA.
Fediverse Contractor
meso
Sexy Moon
shrimps!
Dushman
Dushman
Johnny Peligro :cirno:
Dushman
Mr. Bacon
Fediverse Contractor
feld
feld
varx/tech
@Cloudguy @feld This is quite a rude response to a reasonable inquiry.
You're making some grand claims, and leveraging limited social capital to do so. (I've never heard of you, and you haven't made it easy to verify you.) Posting insults is not making it any easier to take your word on faith.
Dick Morrell ✔️.
@feld this is the biggest load of shit I've seen.
Please please don't post stuff online that has no relevance in polite and intelligent company
feld
Dick Morrell ✔️.
@feld @varx the very very worst thing about the security community is that some will rely on years of experience and understanding responsible ethical disclosure react politelty.
Then there are others who will attempt to gain position or amplify an issue which they should know are not going to form the basis of a response out of respect for a vendor.
Politely and with respect
You are in distinguished company. Enjoy the community and don't throw rocks in the water.
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.