Privacy and Cortana

[BobArch2]

Now this is scary. First the background...

Our two grandkids live in California and both are celebrating their birthdays in November. We live in Canada.

My wife gets on her PC (running Windows 7), logs into her Amazon.com account, purchases items for each of the grandkids (separate orders) and uses her US$ credit card to pay for the orders. She does not ask that I be added to tracking advice. Shortly after placing and paying for the orders she gets an email confirming the order. So far so good.

Then the scary part hits.

I am on my PC (running Windows 10) and decide to use the Search (Cortana) function to look for a file, on my system. I click on the Search/Cortana box and this pops up...

Cortana1.gif

WTxxxxx ?

I check the Cortana Permissions and see this...

Cortana2.gif

Then continue to examine other Cortana settings and found this...

Cortana3.gif

Anyone have any ideas how this could be happening?

Great feature for spying on my wife's purchases but she who rules the house would not be happy!

[HansV]

Perhaps its possible to use the IP address for tracking? I assume that your computer and hers have the same IP address as seen from the outside world.

[StuartR]

I doubt that they would use IP address, too many of us have dynamic IP addresses, VPN, Proxy servers and so on.

Maybe they are doing this by matching the delivery address.

[BobH]

Or, possibly both your names are on the credit card account or the account is in your name and wife is an 'authorized user' with her own card. This is a wild stretch I think; so I would email Amazon security and find out. If you don't get a satisfactory answer, call them and insist on speaking to a third line CSR manager and get his/her ID. If you get no satisfactory answer from this person, cancel accounts with Amazon.

I've done this and gotten the information I wanted. I've also threatened to close accounts and pass the issue to my attorney followed up with a letter from my attorney indicating my dissatisfaction and suspicion of fraudulent or collusive activity. That has never failed to get satisfactory resolution.

I worked in the credit card industry for 25 years (among my other sins). Usually serious correspondence will get serious answers but don't expect quick miraculous response. It takes time for things to percolate and escalate, usually.

I don't use Cortana. If it is at fault, I have no clue how to proceed.

[BobArch2]

Perhaps its possible to use the IP address for tracking? I assume that your computer and hers have the same IP address as seen from the outside world.

At the time that the event occurred, my wife was connected via the Bell's dynamic address while I was connected via a VPN allocated address. Same Bell modem.

I doubt that they would use IP address, too many of us have dynamic IP addresses, VPN, Proxy servers and so on.

Sounds right to me.

Maybe they are doing this by matching the delivery address.

The ordering address is my wife's name and our address in Canada. The delivery addresses are in the name of our grandson with California address and granddaughter with California address.

Or, possibly both your names are on the credit card account or the account is in your name and wife is an 'authorized user' with her own card.

We each have our own US$ credit card with our own names on each card and with different credit card numbers. However, mine is the original account and my wife's transactions get charged, by our financial institution, to my account. Amazon would have no way of knowing this, and the package tracking information is coming via Cortana in Windows 10.

I hear what you say about contacting Amazon but unsure if they could answer why the tracking information is tied to me when they do not know me. Now, having said that, I do have my own Amazon account which of course would have the same home address as reflected in my wife's account. That would be a real stretch for them to link her tracking information with my email and Amazon account. Notwithstanding that we, individually, have been ordering from Amazon for several years and this is the first time this reporting of tracking information has occurred.

I will contact Amazon on the off chance they can shed light on this situation. However, closing the Amazon account is not really an option since this is how we sent presents to our son, DIL and GKs.

I can turn off Cortana, from what I have read, but will not do so until the tracking situation is resolved.

Thanks everyone for your comments and insight. Much appreciated.

[JoeP]

Did you receive a copy of the order confirmation or order shipment email?

Do you have an UPS My Choice account?

[BobArch2]

Did you receive a copy of the order confirmation or order shipment email?

Do you have an UPS My Choice account?

Answer to Q1: neither
Answer to Q2: no

What popped up on my PC via Cortana was package tracking advice showing order number, destination and expected delivery date.

[Leif]

x.jpg

Did you try asking Cortana if she knows?

[William]

Do you and your wife share an Office 365 subscription? I remember reading somewhere that Cortana can be connected to this.

[BobArch2]

Did you try asking Cortana if she knows?

Yup, I did ask... and her reply was...

2016-10-26_22-30-28.gif

[BobArch2]

Do you and your wife share an Office 365 subscription? I remember reading somewhere that Cortana can be connected to this.

Nope. I have Office 365 and my wife is with an earlier version of Office.

And, thanks for the input.

[BobArch2]

Late Tuesday evening I sent a message outlining the issue to the email address assigned to security and privacy issues at Amazon.com. I received a response from Amazon.com Customer Service. It is apparent from the text in their reply that they think I am the one who placed the order. Me thinks the security group just forwarded my email to customer service. In the body of their reply there was a hotlink that connected me to my order page. They also provided a 1-866 number to call and speak to Nayeem. Should be an interesting call Thursday morning!

Stay tuned!

[BobH]

Where's the popcorn smilie?

[HansV]

So it's probably not as sinister as it seemed...

[BobArch2]

So it's probably not as sinister as it seemed...

Hmmm, not sure about that. Read on...

At approximately 9:00AM (GMT-4) today, a very pleasant rep from the Amazon's Executive Customer Relations team called me and we spoke for about 8 minutes. She called to confirm the contents of my email to Amazon Security and needed a few other questions answered. She promised to get back within 24 hours. Within 1.5 hours I received an email from her explaining, and I quote:

"I believe I've found the answer to how you were able to tracking information from your wife's Amazon's orders. The information was shared over your home internet service provider. There appears to be a protocol in place called TCP/IP (Transmission Control Protocol/Internet Protocol) that allows computers to "talk" or "connect" to each other. Outside of this protocol, I was unable to determine how the information could be shared."

OK, OK... stop gasping and giggling! She included a link to visit a web page that describes the TCP/IP feature. I will not, for obvious reasons include that link here. You're welcome.

However, I started to research a bit more about Cortana's method for tracking packages. I found this.

After reading on the above site that Cortana reads incoming email in order to fulfill its tracking function, I suddenly remembered that my wife had forwarded two pieces of Amazon email confirming that parts of the orders were shipping. I then fudged a few of those emails that the wife sent me and sent them to myself. I changed the destination name and address and for one message I created a fake order number and for the second I used an Amazon order number from 3 months ago.

The incoming fake messages read in Outlook 2016 were scanned by Cortana and added to its package tracking feature. Attached is evidence of this action.

2016-10-27_18-45-21.gif

2016-10-27_18-46-21.gif

This is a quote from the article linked above as to what is searched by Cortana:

Caveats
For this automatic tracking to work, there are a few things to note:
1. Email must be routed through the Mail & Calendar app; web email does not work
2. Currently, only packages and emails from http://Amazon.com" onclick="window.open(this.href);return false;, Target, Apple, eBay, Microsoft Store, and Walmart are supported
3. Supported package carriers include USPS, FedEx, DHL, and UPS

And now you know... mystery resolved!

[HansV]

What is the world coming to? They shouldn't allow them interweb tubes to use that TCP/IP!

(Thanks! )

[BobH]

OH NO!!!!


NOT THE DREADED TCP/IP!!!!!!!!




(wishing I had a font that would drip creepy, Halloween blood down the letters . . . )

[Rudi]

Very creative detecting Bob.
For all your efforts this was a very informative and entertaining thread to read.

[StuartR]

Thank you for sharing the investigation. I really do need to get the tinfoil in my hat upgraded, this is starting to get scary!

[BobH]

I'm with Stuart on this one. I'll be working on my tinfoil hat as soon as I finish typing this.

I've installed Win10 but have not used it except to see that it works. Can Cortana be disabled?