CassandrichFeb 26

PSA: The Amazon wishlist doxing threat is much greater and more immediate than folks might realize. Attack works like this:

Stalker who wants your address opens an Amazon seller account and lists themselves as a third party seller for any item on your public wishlist. Then, they order the item from themselves as a gift for you. Bam, they have your address.

In particular, attack does not depend on an existing third party seller having poor PII handling hygiene, like the articles have implied.

Show threadCassandrichFeb 26
The only mitigations are refraining from using public wishlists entirely (set any wishlists you may have to private) or using a PO box or reshipping service to conceal your real physical/final address.
Show threadRay McCarthyFeb 26
@dalias
Never make a "wishlist" public, or share it.
Show threadErikFeb 26
@raymaccarthy @dalias true and even if this is how 'streamers' and 'content creators' grift, this is also used as a tool for mutual aid.
Show threadCassandrich
@erikcats @raymaccarthy I'm not sure how accepting gifts from ppl who enjoy you entertaining them is "grift".
Feb 26 at 4:41pmWeb
Show threadErikFeb 26
@dalias @raymaccarthy i'm sorry, probably too jaded - milking parasocial relationships goes into the grift pigeonhole immediately. Your phrasing is a lot more generous, you're right