Is amazon.com allowing authentication based on browser cookies only?

Question

So I found out a couple of days ago that amazon.com has changed its behavior when trying to make a purchase. For years and up until recently, I could open a browser, log into amazon, close the browser. When I would open the browser again and direct it to amazon, the site would know my account but not allow me to check out without providing the password first. This allowed other people in the house to watch prime videos but not abuse my account and make unauthorized purchases. This apparently changed last week. Now, if I use amazon and close the browser without logging out or clearing cookies, then whoever uses the same browser after me can make purchases without being prompted for a password! I don't have 1-click enabled anywhere, my browser doesn't have the password stored, and auto sign-in is disabled. Tried this in Firefox and Chrome to the same effect.

Has anyone else experienced this, particularly on Windows? My main concern is that this is a security issue on shared computers. Is this supposed to be a new feature (I don't want it...)?

Answer 1

This allowed other people in the house to watch prime videos ... My main concern is that this is a security issue on shared computers.

Let me rephrase this a bit differently:

• You like the behavior that the authentication is kept over browser close, since it allows you to share your computer with others so that they can watch video with your account.
• You don't like the behavior that the authentication is kept over browser close, since it makes it possible that your shared computer can be used by other to make purchases on your behave.

Isn't the real underlying problem that you share your computer and thus implicitly your account with others, while only marginally trusting these others? If you would not trust the others at all then you would not share the computer in the first place. If you would trust them fully then you would also trust them to not make purchases on your behave or you would trust them to actually make such purchases but only the ones you've agreed to.

So far you've relied on the way it was implemented (but not documented?) by Amazon to have such partial trust in exactly the way you need it possible. The changed behavior now makes it more inconvenient for you, while making it maybe more convenient for others. Security and convenience are unfortunately usually a trade-off and there is often not the single one trade-off which fits all users best.

Apart from that: it might even be that the change in behavior you see is not actually due to changes at Amazon but due to changes in the browser or browser settings or changes in your behavior. The only way to detect if a browser was closed and restarted is to use cookies with no explicit lifetime which have a lifetime until the browser closes. Only, modern browsers might actually preserve these cookies if you have session restore enabled - again, since this is more convenient and since most users actually expect to be able to continue with a restored session directly.