You also have to consider the possibility of an offline attack (ie: if Amazon's database were compromised and password hashes were leaked).