rrdotFeb 27
Cassandrich

PSA: The Amazon wishlist doxing threat is much greater and more immediate than folks might realize. Attack works like this:

Stalker who wants your address opens an Amazon seller account and lists themselves as a third party seller for any item on your public wishlist. Then, they order the item from themselves as a gift for you. Bam, they have your address.

In particular, attack does not depend on an existing third party seller having poor PII handling hygiene, like the articles have implied.

Feb 26 at 2:43pmWeb
Show threadCassandrichFeb 26
The only mitigations are refraining from using public wishlists entirely (set any wishlists you may have to private) or using a PO box or reshipping service to conceal your real physical/final address.
Show threadCassandrichFeb 26
Note that even PO boxes are not particularly safe against a dedicated stalker. They can stake out the PO for someone picking up a distinctive package once they know what PO it's at.
Show threadKat the LeopardessFeb 26

@dalias I live in a rural area of my state. This means that everyone living here has to get a USPS PO Box

We get the double edged sword of

...dealing with entities and online vendors that do not accept our PO Box address as valid.

...but also that we are still suceptible to the privacy issues despote that our mail doesnt come to our physical location.

Show threadtoerrorFeb 26
@dalias Or just mail you a tracker.
Show thread✧✦Catherine✦✧Feb 26
@toerror @dalias this. even my stalkers are not dedicated enough for potentially multi-week stakeout, but an apple tag is super easy
Show threadErik JohnsonFeb 26
@dalias Thanks for the heads up on this. Deleted all my wishlists and set the default to private.
Show thread a HOT Rubie Feb 28

@dalias

For those interested, USPS has an optional service for PO box holders to use the post office street address to receive packages from Amazon, UPS, FedEx, couriers, etc.

Amazon accepts a post office street address, as well as a PO box, for deliveries, as do most, if not all other carriers and couriers. The exceptions to this may be for insured, bonded, recipient-only, or other such restricted deliveries.

Some Amazon sellers do not ship to PO box addresses but the post office street address seems to be acceptable.

The post office acts as agent to sign for packages if necessary and packages are held for pickup at the post office for some number of days.

The packages are delivered to the post office and do not go to the regional sorting facility. As far as I know the USPS does not permit forwarding of packages to other addresses.

Many post office box lobbies are visible from the outside, where people can loiter and watch a box or boxes of interest for people to collect their mail. Loiterers are usually easy to spot.

And that is about as much as I know about it.

Show threadRay McCarthyFeb 26
@dalias
Never make a "wishlist" public, or share it.
Show threadDarwin WoodkaFeb 26

@raymaccarthy @dalias

That would be nice, but a lot of people are using them as teachers for classroom supplies now or charities using them to get donations of supplies they need.

Show threadRay McCarthyFeb 26
@darwinwoodka @dalias
They can share what they need as an item that the donor buys? No need to share an account's "wishlist".
Show threadMatthew MillerFeb 27

@raymaccarthy @darwinwoodka @dalias

That's.... what a "wishlist" _is_.

Show threadCassandrichFeb 27

@raymaccarthy @darwinwoodka The idea of a wishlist and the store letting you buy items on someone else's wishlist for them is that it's privacy-preserving for the recipient. They don't have to give their address out to people they want to be able to receive gifts from. Only the store that they already shop at and that already knows their address gets to see it.

What Amazon has done is broken that promise - the whole purpose of the wishlist system - by letting third-party sellers (to whom Amazon needs to disclose the recipient address for shipping purposes) in on wishlists. Now anyone wanting to get your address just needs to sign up as a third-party seller.

Show threadaxolotl solidarioFeb 26
@dalias id go a step further and recommend people stop making Jeff Bezos richer in general.
Show threaddraNgNonFeb 26

@dalias so to be clear, just setting the lists private is an immediate mitigation?

I haven't touched this feature since... apparently 2020 (and have only ordered one thing from Amazon since WaPo declined to endorse Harris and I dropped Prime like a hot potato). if I can take it private now and reconsider the existence of these lists entirely when I have more time to do so, that is better for me.

Show threadCassandrichFeb 26
@draNgNon That's my understanding.
Show threadOoze 𓁟Feb 27
@dalias Deleting your account will 100% solve the problem.
Show threadCassandrichFeb 27
@Ooze It will but I'm offering up missing critical information on safety not my opinions on their life choices. And "deleting your account" is one form of "refraining from using public wishlists entirely" anyway.
Show threadDent, Arthur DentFeb 26
@dalias Thank you for sharing this.
Show threadMx. Eddie RFeb 26
@dalias
It appears the change will roll out in Canada in March.
I've deleted all my public wishlists.
Show threadAndrew ZonenbergFeb 26
@dalias was this not already possible? like i'm not sure how wishlists would work if the seller didn't know how to ship the product?
Show threadCassandrichFeb 26
@azonenberg Previously you could select that you only accept gifts fulfilled by Amazon. They just took away that ability.
Show threadAndrew ZonenbergFeb 26

@dalias aha, ok.

I miss when amazon was a way to buy books directly from them and that was it...

Show threadAndrew ZonenbergFeb 26
@dalias (and I also hate the tendency of everything from walmart to digikey to turn into a "marketplace" lately. At one point you could buy oscilloscope software options on walmart's website because TEquipment had a storefront there)
Show threadAndrew ZonenbergFeb 26
@dalias just make a store to sell your products, and let me know i'm buying from you, a company i presumably trust to some extent. that's it, do one thing, do it well
Show threadRexo the Trans Bus 🏳️‍🌈🏳️‍⚧️🚌Feb 26
@azonenberg @dalias why would they take that away 😨
Show threadCassandrichFeb 27
@rexo @azonenberg To improve wishlist metrics and appeal to third party sellers.
Show threadAlex RFeb 26
@dalias every single engineer I've seen talking about this has immediately identified this attack, so it's guaranteed that this will be exploited right away if it goes ahead (and also that Amazon absolutely knows about it)
Show threadCassandrichFeb 26
@alex They obviously knew about it since the beginning. That's why gifts were limited to fulfilled-by-Amazon. Then some piece of shit manager with no understanding of safety wanted to make the sketchy marketplace more lucrative to sellers to compete in race to bottom.
Show threadAlex RFeb 26
@dalias exactly. They could also have trivially made wishlists with that setting private, which would at least limit the immediate harm, but that doesn't goose the wishlist metrics
Show threadMason Loring BlissFeb 26

@dalias I'm hoping we can use this opportunity to get people off of Amazon.

https://partychickens.net/@mason/116128064084123138

Mason Loring Bliss (@[email protected])

Public service announcement: Amazon hurts people. If you use Amazon, you're okay hurting people. Here are some references. There are many, many more. 2024: Why Amazon Is Bad for Society: Examining the Hidden Costs of Convenience https://www.historytools.org/consumer/why-is-amazon-bad-for-society 2023: Exclusive: ‘I Feel Like I’m Drowning.’ Survey Reveals the Toll of Working For Amazon https://time.com/6248340/amazon-injuries-survey-labor-osha/ 2023: 41 Percent of Amazon Workers Have Been Injured On the Job, New Report Finds https://cued.uic.edu/pain-points/ 2024: Amazon’s Biggest Delivery: Millions of Pounds of Plastic Pollution https://www.foodandwaterwatch.org/2024/07/03/amazon-plastic-pollution/ 2019: 10 Ways Amazon Violates Human Rights https://greenamerica.org/blog/10-ways-amazon-violates-human-rights 2025: Why So Many People Are Boycotting Amazon: 11 Major Complaints Explained https://www.marketingscoop.com/consumer/why-do-people-hate-amazon/ 2023: The Local Harms of Amazon and What State Lawmakers Can Do About Them https://www.economicliberties.us/our-work/the-local-harms-of-amazon/# 2025: Amazon's Environmental Impact: Unpacking The Harmful Effects On Our Planet https://shunwaste.com/article/why-is-amazon-bad-for-the-environment 2024: Amazon workers struggle with injuries and low pay despite company’s profits https://prismreports.org/2024/06/05/amazon-workers-struggle-injuries-low-pay/ #amazon #boycott

Mastodon
Show threadNu ModularFeb 26
@dalias A couple of guys I trained with in martial arts, are in a paramilitary group, and are now planning a para-doxing welcoming committee.
Show threadThe Shaking EarthFeb 26
@dalias holy shit, wow. I appreciate that heads up. Thank you.
Show threadSonLiteFeb 26
@dalias With all of the current digital surveillance we are subjected to, that should not have been possible
Show threadJamesFeb 26
@dalias wait, does this coincide with the Mail I got from Amazon about third party sellers being allowed. Guess I'll delete my wishlist now. Haven't used it in years anyway 😬😬
Show threadSonLiteFeb 26
@dalias Again I Think logistic companies coming as intermediaries can serve to shield our Addresses since only their addresses will be given
Show threadPasswordsarehard4Feb 26
@SonLite @dalias if they hide an AirTag inside the box it will track the whole route. They just need the places it stopped, one of them will be where you opened the box and then threw it away. It might not be where you live but it’s probably where you’re sleeping.
Show threadRootbrianFeb 26
@passwordsarehard4 @SonLite @dalias Airtags can be reprogrammed if they were found in a box (I don't just throw away boxes without checking for tech or magnets).
Show threadRagashingoFeb 26

@dalias I would have expected that wish listing something would mark that exact product from that exact seller as the thing you want. Like... I want this known authentic doodad from this known reputable seller.

Is that not the case?

Show threadGavinFeb 26

@Ragashingo @dalias that's what they're taking away, as I understand it. So I think it's the case _now_, it will shortly _not_ be the case.

So if you're lucky, you can now get the same thing from a third-party seller. If you're mid-lucky, you can get something passing itself off as the same listing from a third-party scammer. If you're unlucky, your address gets leaked to a third-party stalker.

Clearly I wasn't the only person who read that mail this morning and thought "oh no".

Show threadCassandrichFeb 26

@_calmdowndear @Ragashingo Amazon should have been stopped in their tracks when they first allowed third parties to link their counterfeit items as just being a different seller for the same genuine item, rather than a separate product listing.

The whole late-capitalist fascist hell we're in is a consequence of letting companies do things that were long-illegal and would have been prosecuted as racketeering if not for "with computers" tacked on to the business plan.

Show threadSamantaz FoxFeb 28

@Ragashingo @dalias Amazon puts all the items they consider similar in the same bins, and ships similar items that are near you, so even if you order from a specific seller, you might end up with a counterfeit from a completely different vendor.

That's why it's also extremely dangerous to order products that can cause a health risk (like adult toys) on there, as counterfeits are commonplace.

Show threadRagashingoFeb 28

@SamantazFox @dalias Oh, sure! I've had the counterfeit thing happen. Ordered 3 hand crank flashlight/radios, and got 3 slightly different variations that didn't fully match the description. (Different types of USB ports, for instance)

I don't particularly trust Amazon to ship me what I order, I just think it sounds... incorrect... that someone can specifically create a new 3rd party seller then order you something off your wishlist to that new seller to get your address.

Show threadUtarg of Utarg 🔬🇪🇺🇸🇪🇬🇧🇺🇦Feb 26
@dalias Thanks for this. Does this apply to Audible too?
Show threadCaptain ButtonFeb 27

@toxy @dalias

I just looked at my Audible wish list and couldn't find any private/public status of the list anywhere. Nor could I find any way to delete the list itself, so I just settled for deleting all the items in the list.

Show threadWorkshopshedFeb 26
@dalias fixed and told the family
Show threadTrimTab 🇺🇦Feb 26

@dalias
Come on guys, we sit on mastodon lamenting the sorry state of the world, and then everyone signs into an amazon account??? If our actions are to give money to an organization that aggressively works to destroy the middle class and liberal democracies world wide, then our words are meaningless... :-/

Quoting The Disposable Heroes of Hip-Hopricy: hypocrisy is the greatest luxury....

Show threadCassandrichFeb 26
@TrimTab We're not "lamenting" it. We're doing safety outreach to get information to people who might suffer real harms if they don't know about it.
Show threadDr Ro SmithFeb 27

@TrimTab @dalias The middle-class ableism is strong with this one. Amazon is evil, but often the only way for disabled people or people in rural areas to get affordable items without leaving the house.

Going out to a store is a luxury for those with the time and physical ability.

Postage is a disability tax.

And an Amazon wishlist has for a long time been the easiest way for people to buy things for others without them giving out their address. It is a form of mutual aid. It is not our>

Show threadDr Ro SmithFeb 27

@TrimTab @dalias >fault that Amazon has become a behemoth, eating up more ethical competition.

Campaign for regulations instead of blaming the most vulnerable members of society for using what little tools they have to live.

Show threadTrimTab 🇺🇦Feb 27

@Rhube @dalias Good points. If the usa has gone so far that a segment of the populous has no option than amazon, than yeah, ,that's tragic and i don't blame the amazon user. I had no idea the US was THAT eff'd... Or that everyone on mastodon was disabled and economically thus challenged.

I take back what i said.

Show threadrugkFeb 26
@dalias ah that was the mail Amazon sent. They have sent and explained that in a mail…
Show threadCassandrichFeb 26
@rugk They didn't explain that "third-party sellers" means "anyone who signs up for a seller account, possibly the same person as the 'buyer' who just wants to get your address".
Show threadJohan Pelck OlsenFeb 26
@dalias I don’t understand why anyone would ever want a public wishlist, even disregarding stalkers and the like. Seriously, how is it of public interest that you’d like a new bathrobe?
Show threadCassandrichFeb 26
@jpkolsen It's a way for fans to compensate people whose work they appreciate who can't easily take payment. AIUI one big place this comes up, and where doxing is a huge threat, is sex work. But really for anyone doing things where there's a parasocial relationship with an audience the same applies.