PSA: The Amazon wishlist doxing threat is much greater and more immediate than folks might realize. Attack works like this:
Stalker who wants your address opens an Amazon seller account and lists themselves as a third party seller for any item on your public wishlist. Then, they order the item from themselves as a gift for you. Bam, they have your address.
In particular, attack does not depend on an existing third party seller having poor PII handling hygiene, like the articles have implied.
That would be nice, but a lot of people are using them as teachers for classroom supplies now or charities using them to get donations of supplies they need.
@raymaccarthy @darwinwoodka @dalias
That's.... what a "wishlist" _is_.
@raymaccarthy @darwinwoodka The idea of a wishlist and the store letting you buy items on someone else's wishlist for them is that it's privacy-preserving for the recipient. They don't have to give their address out to people they want to be able to receive gifts from. Only the store that they already shop at and that already knows their address gets to see it.
What Amazon has done is broken that promise - the whole purpose of the wishlist system - by letting third-party sellers (to whom Amazon needs to disclose the recipient address for shipping purposes) in on wishlists. Now anyone wanting to get your address just needs to sign up as a third-party seller.
Cassandrich
Ray McCarthy
Darwin Woodka
Matthew Miller
Erik