[Nabeshin]

You posted a lot of truth, but a couple notes:
- websites cannot access your MAC address, although apps may, so if you use the Amazon app to make purchases then wipe your phone and reinstall it, they can still see it's the same device. Newer phones connect to wifi networks with a fake MAC address to prevent this
- password can (and should) be encrypted in the DB but since they DO know your password whenever you try to login, they could easily attempt a login on another (supposedly linked) account with the same inputted password and see if it returns a successful login as well, without ever needed to decrypt anything

[Defeat]

So guys I'm tweaking a method on Amazon but I get my acc banned.
This method requires multiple accounts a day to be created and used, and need to be anonymous ofc.
Up until now they have stated that I didn't follow their terms and agreements and once about linking the account to an already blocked one.

I am fully aware that the company in question is one of the wealthiest and most developed, but I have a vague understanding as to how they may be linking the accs and banning them.

IP Address
- This one is tricky with them, apparently you can't use a VPN because your payment method gets blocked instantly. Using Socks5 is apparently also bad because you get flagged or something.
So I changed my IP Address by restarting my internet modem and according to IP checkers it changed the IPv4 and IPv6.

Cookies
- For this one I think a CCleaner should be sufficient after the creation of a new acc, just clean the browser and I should be good to go again.

Mac Address
-I want to use a tool here after every acc created.

Account  Names and Passwords
-Apparently Amazon's security system can cross reference acc names and pass and should be able to find you because of the repetition of these values.

My question here is do you guys know of some Information that can be used to track me down and connect the accounts together?

Thanks in advance

Some of my own experiences:
I've used VPNs to order off Amazon no problem, that's usually only the case with gift cards when you're using a VPN from another country (only case I've seen it an issue)
Account names, ok that makes sense, but passwords?  Someone who's more knowledgeable when it comes to encryption, maybe @vittring can comment on that.  If they truly can cross check passwords, doesn't that mean they can decrypt them?  Might sound super dumb but my understanding is encryption is not meant to be identical so if they can cross-check passwords, that either means they can see them or decrypt them?  Clearly I'm not well versed in this sort of security

Your IP can easily correlate services using the same IP to access them. That's why it's recommended to use a VPN, so the services aren't using the same IP. VPN's provide this to the user but this is not to be confused with anonymity. You are not anonymous using a VPN, because the VPN provider still knows you and what you're doing unless you signed up by paying cash and using a fake name and other information, it's directly traceable back to you. Some services automate the blocking of clients on their apps, websites, etc. The ISP can see what clearweb services you sign up to and this information, you can guess, will be logged indefinitely. It can be requested by officials seeking to check your service usage across multiple accounts. An easier way to check for "alt" accounts is by checking their own database for accounts using IP's in the same range or net block. Changing your IP generally does not provide any form of anonymity and your accounts are being correlated by net range, third party tracking and cookies, etc. What method are you using to create these accounts? If you're using a VPN that just means you're now using that VPN net range for every service further deanonymizing you. You lose all OPSEC because now an attacker knows you use that VPN on everything. A VPN is not Tor, and most VPNs use 128 or 256 bits to encrypt your data, which isn't much anyway. My VPN setup on my home network is giving me 256 bits encryption which is then wrapped in multiple layers of encryption via Tor, then coming out of the exit node still encrypted. I use a daily setup of Tor > VPN > Tor. You can also do VPN over Tor or Tor over VPN, just Tor, etc.

Moreover, you are able to purchase goods from services and vendors in general while using a VPN. But you may be flagged if you use multiple different IP addresses in one account or IP's that are already on a block list, because this looks "suspicious" to the provider of the service. This process is usually automated and places you on a short- or long-term shadowban list that is set to stop fraudulent activity at Amazon and others.

Cookies (LSO cookies, especially) are very tricky and can be used to not only track your usage of the service but also track your usage of other services across the internet. There are such things as long term cookies that only sanitizing your OS in specific areas. Cookies are generally stored inside your machine in various places to make it harder to remove them. You are better off cleaning your entire OS using a clean install to completely remove their presence. You must sanitize your browser per session, and you must also prioritize compartmentalizing your different tasks. Something that helps is Qubes, but it is very technical and requires a lot of RTFM hours.

MAC is another tricky one. Generally speaking, your MAC is a hardware identifier and is logged by every router you access, because it ideintifies your device on the network. It is propogated across your entire network because if your network is not properly compartmentalized, your data is spoken from one device to the next, especially IoT devices. Smart devices are a huge proponent of the evil that is cross-device tracking. If you access your TV to watch YouTube, it sends the usage statistics including all hardware identifiers, down to serial number, to the service provider and YouTube. Your in-home activites are monitored and tracked by companies to build a profile of you in their various databases. The IAO is collecting all information and aggregating data simply because it can, but also because this is how data brokers make money.

Account names are easy to address. Just don't use the same (even remotely similar) usernames across services. Use something like fakenamegenerator to do this for you. This way, you will never have to worry about being correlated across services. It's good to use random names that look real, but even then, it can still be circumvented with automated services that are setup to demand your PII for further use of the account. Twitter, Facebook, Instagram, all require basic IRL identifiers like an ID or phone number, while also blocking those accounts that sign up using fake emails, phone numbers (VIOP as well, even if it's legitimate and not used for fraud).

Your passwords are usually not stored in clear text, at least, not by any service living in the modern age. These sites get flagged as unsafe and should never be used by any means. Passwords are usually stored in encrypted format. That said, when stored encrypted (and salted, hopefully), the passwords that are saved across services can only be seen by people with authorized access to the data such as developers, administrators, and site owners. You're safe as long as you use a strong passphrase, both cryptographically and logically. Never use the same passwords or passphrases or pins across multiple services, especially your important accounts, to prevent one hack turning into a full identity takeover. If someone gains access to your email account, they have access to every service which uses that email for password resets and authorization. That includes your bank account, your cell provider, all accounts using that email for access. It would be catastrophic to use one weak password across 5 services. If one is hacked, it can end up in a database, your password can be added to a dictionary of hacked passwords, etc. It's bad, in short. Always use a strong master pass phrase that protects your other passwords in your password manager, protected by multi factor authentication (MFA).

That said, most providers will already have access to your passwords as stated above. Do not mistake database encryption to mean your account passwords are invisible to the owners of the service. It's easily viewable internally, so you're trusting the service to store it. Again, another reason you shouldn't use the same one on another account on a separate service. It's very bad OPSEC to use one password on multiple accounts.

Thank you so much for the detailed answer. I actually learned something new. I thought by law they couldn't keep copies of your password anywhere, but I guess you're right at some level it muss be accessible. @Oni you know my pass?

[Nabeshin]

Thank you so much for the detailed answer.  I actually learned something new.  I thought by law they couldn't keep copies of your password anywhere, but I guess you're right at some level it muss be accessible.  @Oni you know my pass? 

I'm not entirely sure on that password thing tho
Password are hashed and salted, and the result is then saved in the DB, so the only time they have your password (HOPEFULLY) is when you input it in the login form, once it arrives on the server it'll undergo the same procedure as above and then the 2 encrypted passwords are compared, if they match you're in (which MAY lead to collisions, where 2 completely different passwords generate the same hash)
There's no way to revert an hash back to its plain text version.. well, there are rainbow tables (basically huge lists of "this word + this encryption = this hash", so you basically reverse-search on it starting from the hash), but if you add salt then it's way more safe
So no, I doubt the admin here knows your password, if he did his job right

Of course, any website could log your password in plain text / the developer could dump your login info to a plain text file / they could use an unsafe encryption / etc, but that's not how it should be in the norm

[ConcernedCitizen]

Thank you so much for the detailed answer.  I actually learned something new.  I thought by law they couldn't keep copies of your password anywhere, but I guess you're right at some level it muss be accessible.  @Oni you know my pass? 

I'm not entirely sure on that password thing tho
Password are hashed and salted, and the result is then saved in the DB, so the only time they have your password (HOPEFULLY) is when you input it in the login form, once it arrives on the server it'll undergo the same procedure as above and then the 2 encrypted passwords are compared, if they match you're in (which MAY lead to collisions, where 2 completely different passwords generate the same hash)
There's no way to revert an hash back to its plain text version.. well, there are rainbow tables (basically huge lists of "this word + this encryption = this hash", so you basically reverse-search on it starting from the hash), but if you add salt then it's way more safe
So no, I doubt the admin here knows your password, if he did his job right

Of course, any website could log your password in plain text / the developer could dump your login info to a plain text file / they could use an unsafe encryption / etc, but that's not how it should be in the norm

Just to reiterate my point, the passwords are stored in encrypted format, so they are salted with a 1:1 or more length of the resulting hash and then stored by the database, not allowing anybody on the site to read your clear text passwords even if the database is leaked. That said, there are some programs criminals will use that systematically check hashes on public database leaks to find one that is derived from a weak password. This allows them to gain initial access to accounts. in the event of a security breach, but any compromised passwords are unintelligible to the bad actor. As a result, the theft of this information is considerably more difficult. Also, thanks for mentioning collisions, because they are possible. It results from a password being hashed and returning the same value as another.

Salting passwords is much more secure and you will usually see bcrypt or SHA being used for the process. bcrypt is the same algorithm used to hash your server passwords on your Linux machines. Salting and having a collision is very unlikely but it's irrelevant when you consider the use for hashing is mainly to prove the authenticity of something. Digests for verification are not as important as password storage. Files with two different hashes could be malicious but it's highly unlikely considering again the difficulty of the method. You would need to do expensive computational attacks and if the algorithm is strong it will take more effort than it's worth.

sinister.li no doubt uses bcrypt for hashing:

Code:

$hash = password_hash($password, PASSWORD_BCRYPT);

This method can be made cryptographically stronger using as strong hashing algorithm on the result again, if necessary. But most forums use SHA1 or bcrypt. Also note that salting will not protect you against dictionary attacks as they are performed on the password level as opposed to the hashed level. You should also not be relying entirely on password + salt to keep you secure. Use MFA where possible and even with the correct password, account takeovers are unlikely.

[Beethoven]

So guys I'm tweaking a method on Amazon but I get my acc banned.
This method requires multiple accounts a day to be created and used, and need to be anonymous ofc.
Up until now they have stated that I didn't follow their terms and agreements and once about linking the account to an already blocked one.

I am fully aware that the company in question is one of the wealthiest and most developed, but I have a vague understanding as to how they may be linking the accs and banning them.

IP Address
- This one is tricky with them, apparently you can't use a VPN because your payment method gets blocked instantly. Using Socks5 is apparently also bad because you get flagged or something.
So I changed my IP Address by restarting my internet modem and according to IP checkers it changed the IPv4 and IPv6.

Cookies
- For this one I think a CCleaner should be sufficient after the creation of a new acc, just clean the browser and I should be good to go again.

Mac Address
-I want to use a tool here after every acc created.

Account  Names and Passwords
-Apparently Amazon's security system can cross reference acc names and pass and should be able to find you because of the repetition of these values.

My question here is do you guys know of some Information that can be used to track me down and connect the accounts together?

Thanks in advance

Some of my own experiences:
I've used VPNs to order off Amazon no problem, that's usually only the case with gift when you're using a VPN from another country (only case I've seen it an issue)
Account names, ok that makes sense, but passwords?  Someone who's more knowledgeable when it comes to encryption, maybe @vittring can comment on that.  If they truly can cross check passwords, doesn't that mean they can decrypt them?  Might sound super dumb but my understanding is encryption is not meant to be identical so if they can cross-check passwords, that either means they can see them or decrypt them?  Clearly I'm not well versed in this sort of security

Your IP can easily correlate services using the same IP to access them. That's why it's recommended to use a VPN, so the services aren't using the same IP. VPN's provide this to the user but this is not to be confused with anonymity. You are not anonymous using a VPN, because the VPN provider still knows you and what you're doing unless you signed up by paying cash and using a fake name and other information, it's directly traceable back to you. Some services automate the blocking of clients on their apps, websites, etc. The ISP can see what clearweb services you sign up to and this information, you can guess, will be logged indefinitely. It can be requested by officials seeking to check your service usage across multiple accounts. An easier way to check for "alt" accounts is by checking their own database for accounts using IP's in the same range or net block. Changing your IP generally does not provide any form of anonymity and your accounts are being correlated by net range, third party tracking and cookies, etc. What method are you using to create these accounts? If you're using a VPN that just means you're now using that VPN net range for every service further deanonymizing you. You lose all OPSEC because now an attacker knows you use that VPN on everything. A VPN is not Tor, and most VPNs use 128 or 256 bits to encrypt your data, which isn't much anyway. My VPN setup on my home network is giving me 256 bits encryption which is then wrapped in multiple layers of encryption via Tor, then coming out of the exit node still encrypted. I use a daily setup of Tor > VPN > Tor. You can also do VPN over Tor or Tor over VPN, just Tor, etc.

Moreover, you are able to purchase goods from services and vendors in general while using a VPN. But you may be flagged if you use multiple different IP addresses in one account or IP's that are already on a block list, because this looks "suspicious" to the provider of the service. This process is usually automated and places you on a short- or long-term shadowban list that is set to stop fraudulent activity at Amazon and others.

Cookies (LSO cookies, especially) are very tricky and can be used to not only track your usage of the service but also track your usage of other services across the internet. There are such things as long term cookies that only sanitizing your OS in specific areas. Cookies are generally stored inside your machine in various places to make it harder to remove them. You are better off cleaning your entire OS using a clean install to completely remove their presence. You must sanitize your browser per session, and you must also prioritize compartmentalizing your different tasks. Something that helps is Qubes, but it is very technical and requires a lot of RTFM hours.

MAC is another tricky one. Generally speaking, your MAC is a hardware identifier and is logged by every router you access, because it ideintifies your device on the network. It is propogated across your entire network because if your network is not properly compartmentalized, your data is spoken from one device to the next, especially IoT devices. Smart devices are a huge proponent of the evil that is cross-device tracking. If you access your TV to watch YouTube, it sends the usage statistics including all hardware identifiers, down to serial number, to the service provider and YouTube. Your in-home activites are monitored and tracked by companies to build a profile of you in their various databases. The IAO is collecting all information and aggregating data simply because it can, but also because this is how data brokers make money.

Account names are easy to address. Just don't use the same (even remotely similar) usernames across services. Use something like fakenamegenerator to do this for you. This way, you will never have to worry about being correlated across services. It's good to use random names that look real, but even then, it can still be circumvented with automated services that are setup to demand your PII for further use of the account. Twitter, Facebook, Instagram, all require basic IRL identifiers like an ID or phone number, while also blocking those accounts that sign up using fake emails, phone numbers (VIOP as well, even if it's legitimate and not used for fraud).

Your passwords are usually not stored in clear text, at least, not by any service living in the modern age. These sites get flagged as unsafe and should never be used by any means. Passwords are usually stored in encrypted format. That said, when stored encrypted (and salted, hopefully), the passwords that are saved across services can only be seen by people with authorized access to the data such as developers, administrators, and site owners. You're safe as long as you use a strong passphrase, both cryptographically and logically. Never use the same passwords or passphrases or pins across multiple services, especially your important accounts, to prevent one hack turning into a full identity takeover. If someone gains access to your email account, they have access to every service which uses that email for password resets and authorization. That includes your account, your cell provider, all accounts using that email for access. It would be catastrophic to use one weak password across 5 services. If one is hacked, it can end up in a database, your password can be added to a dictionary of hacked passwords, etc. It's bad, in short. Always use a strong master pass phrase that protects your other passwords in your password manager, protected by multi factor authentication (MFA).

That said, most providers will already have access to your passwords as stated above. Do not mistake database encryption to mean your account passwords are invisible to the owners of the service. It's easily viewable internally, so you're trusting the service to store it. Again, another reason you shouldn't use the same one on another account on a separate service. It's very bad OPSEC to use one password on multiple accounts.

I know I'm late but I finally decided I should get back into SEing cause I love that shit ngl, So I appreciate you dropping all this free game. A lot of this info is a gem. Definitely gave me some ideas..