Amazon Technologies, Inc.

Robert Ellis Lee

Jon Arron McClintock

Daniel Wade Hitchcock

Bharath Kumar Bhimanaik

David Scott Cleckley, Jr

Annabelle Richard Backman

Harnil C Rafalia

Bradley Vivian Quadros

Disclosed are various embodiments for facilitating the cancellation or reversion of unauthorized operations. An operation initiated to be executed with respect to a user account is received from a computing device that has been authenticated. A notification of the operation is sent through at least one communication channel in response to receiving the operation. The notification facilitates a reply that causes the operation to be cancelled when the reply is sent within a first time period and causes the operation to be reverted when the reply is sent within a second time period after an expiration of the first time period.

Cancellation and reversion of unauthorized operations

Disclosed are various embodiments for repurposing limited-functionality networked devices as authentication factors. In one embodiment, an authentication service identifies a limited-functionality networked device associated with an account and communicatively coupled to the network. The limited-functionality networked device is configured to perform a first function upon a predefined user interaction. The service configures the limited-functionality networked device to perform a second function based at least in part on the predefined user interaction. The service determines that the predefined user interaction has been performed by a user with respect to the limited-functionality networked device. The service authenticates the user at a client device for access to the account based at least in part on the predefined user interaction having been performed.

Repurposing limited functionality devices as authentication factors

Disclosed are various embodiments for validating that relying parties of a federated identity provider have correctly implemented sign-out functionality. In one approach, a network page is received from a network site that is operated by a relying party of a federated identity provider. It is then determined whether the network page includes code that properly implements a sign-out from the federated identity provider. An action is initiated in response to determining that the network page does not include code that properly implements the sign-out from the federated identity provider.

Validating sign-out implementation for identity federation

Disclosed are various embodiments for distributing and verifying ephemeral security credentials of variable entropy across channels of communication of variable levels of security assurance. In one embodiment, a security credential is generated for a user account. A subset of a set of communication channels associated with the user account is determined based at least in part on respective measures of entropy and/or security assurance corresponding to individual ones of the set of communication channels. The security credential is divided into multiple portions. A corresponding portion of the portions is sent across individual channels of subset of channels. A client computing device is authenticated for access to the user account based at least in part on receiving the portions of the security credential.

Growing community of inventors

Seattle, WA, United States of America

Robert Ellis Lee