This plugin might be a security risk

[gsommer]

Hi,

a few days after trying out this plugin, money was drawn from my bank account by Amazon and I definitely did not buy this stuff.

I am not 100% sure, if it was this plugin, as I also tried out the Unearthed plugin, which also reads the data from the Amazon site. But I doubt that it is a coincidence.

There are certainly the following problems:

• First I could not sign out from the settings after downloading my notes. It always responds with an error.
• So I thought uninstalling the plugin would remove my Amazon credentials, but after I discovered the fraud I reinstalled the plugin and discovered that I was still signed in and could sync books. Only after changing the password on Amazon it asked for a new login, which of course I did not do.

I would like to know how this is supposed to work and where those credentials are stored. The whole credentials dialog might be fake.

I definitely would not recommend anybody to use this plugin.

Kind Regards,
Gerhard

[hadynz]

Thanks for raising awareness about this risk — it’s worth discussing given the plugin’s ability to access your Amazon account once authenticated.

Scope of the plugin
By design, the plugin only does what it advertises: downloading your Kindle highlights. The code is open source, so this can be verified by anyone. On its own, it does not request broader access.

Potential attack vector
However, it’s theoretically possible that a malicious actor already on your machine (e.g., another Obsidian plugin or a local script) could leverage this plugin’s authenticated session to access your Amazon account. I haven’t tested whether Obsidian’s current API prevents this, so I can’t rule it out.

How credentials are handled
The plugin doesn’t store credentials directly. Instead, it opens an Electron Browser Window, and once you log in, it relies on your existing session (most likely via local cookies) to retrieve your highlights.

If you log out via Amazon’s website or the plugin UI but remain logged in, that suggests an issue in the logout flow. I haven’t been actively using it, so I can’t confirm. If you uninstall the plugin and the session persists, it likely means Obsidian does not fully clean up plugin state (e.g., cookies). This isn’t surprising since Obsidian doesn’t run plugins in isolated sandboxes. Ideally, the plugin should hook into the uninstall process and clear any Amazon cookies from disk.

Next steps
Given the seriousness, I’ll likely:
a) Make the risks clear to every user before first use.
b) Explore ways to reduce risk — e.g., automatically logging out after every sync.

That said, because Amazon doesn’t offer scoped APIs for Kindle data, there will always be some inherent risk: any Obsidian exploit could potentially piggyback on this plugin’s authenticated session.

Let me know your thoughts — especially if you’ve observed the logout/session persistence issue.

[gsommer]

Thank you for your explanation.

You did warn and suggest to log out after synchronizing, but I got an error and it did not log out. This certainly needs to be fixed. There is no other way to get rid of the login, as the user has no access to this electron browser (and where would this cookie be stored?).

I looked at the code and did not find anything suspicious, but I am not a Javascript developer, as few users of the plugin would be.

I find it very unlikely that an author of a malicious plugin would just wait and hope that I install your plugin, then detect that and gain access to my account. But of course it could theoretically be a coincidence and I also tried the Unearthed plugin, which uses a browser extension to do the same. I am having a look into this too. I guess any extension of my chrome browser could get access while I am logged in to Amazon the same way.

I was actually relying on the 2-factor login to protect my payment data. Even I cannot access those without entering aithentication again in spite of being logged in.

[gsommer]

I must apologize for the suspicion. I checked again, and there has been no fraud at all. All those deductions from the bank account on one day, which pnicked me, came from orders a week ago and the amounts were not recognizable because Amazon does partial deliveries and deducts the amount just before each delivery.

I hope you can fix the sign-out bug for other users. I would still feel uncomfortable with any plugins accessing Amazon like this. If there is no API, I guess Readwise is doing it in the same way, having access to the whole site.

[hadynz]

No need for an apology. I appreciate you raising it with me and other users of the plugin in the open so everyone is aware.

Readwise does something very similar. On the desktop at least, they have a Google Chrome addon that will use your local logged in session via cookies to access Kindle Highlights and port them to their servers.

[betazep]

Going to second the signout aspect. It does not work, and I am not sure how best to make it happen. That said... this is a great thing you have built and certainly I will be buying you some coffee soon.

[betazep]

Note that even though it states that it is signed out, it is not.