The following is a letter I sent today, on actual paper with an actual stamp, to the CEO of Costco.

September 26, 2025

Ron M. Vachris, CEO
Costco Wholesale Corporation
999 Lake Drive
Issaquah, WA 98027

Dear Mr. Vachris,

I am contacting you for assistance with this problem since your customer service representatives have been either unwilling or unable to resolve it.

In a nutshell: I am unable to log into your website. I have tried every possible troubleshooting step to no avail. I am having no problems logging into any other website. There is something wrong with your site, and I need you to figure out what it is and either fix it or tell me what I can do to work around it, so that I can log into your website. I have worked in tech for nearly 35 years and I can assure you that whatever the problem is, it is not “my fault,” and I am not aware of anything I can try to fix it “on my end” that I haven’t already tried.

I chatted online about this with costco.com support. They insisted there’s nothing wrong with your website, they were unable to resolve the problem and they said there was no one they could escalate it to.

Obviously, I do not expect the CEO of Costco to personally solve this problem. What I expect you to do is to put this letter into the hands of someone who has the technical knowledge and access necessary to investigate this issue and the authority to work with me directly to figure out what is going on and resolve it.

I can be reached by phone at [elided] or email at jik@kamens.us.

I have included on the following pages a detailed description of the problem I am experiencing and of the many steps I have taken in my unsuccessful attempts to resolve it myself.

I have spent nearly four hours straight of my own time trying to resolve this and/or prove that whatever is broken is not “my fault.” I expect a similar level of commitment from Costco toward helping me to resolve it.

Thank you,

Jonathan Kamens

The steps and symptoms of my inability to log in

1. I go to https://costco.com/.
2. I click “Sign In / Register”.
3. I tell my password manager to fill in my username and password.
4. Immediately after the password manager fills in my password, the window goes grey and a spinning wait animation displays briefly, and then the animation and grey go away and nothing else happens.
5. Exactly the same thing happens when I then click the “Sign In” button: grey + animation briefly, then they go away and I am still on the login screen.

When I do the above stops with the browser developer console (in Firefox) open and focused on the Network tab, I see that the browser is attempting to log me in via a URL that looks like this:

https://signin.costco.com/e0714dd4-784d-46d6-a278-3e29553483eb/B2C_1A_SSO_WCS_signup_signin_168/SelfAsserted?tx=StateProperties=eyJUSUQiOiI3YWE1NmNiMi1hZDllLTQ4OTktYTdiMS1mMDk1YWNiMTljZWIifQ&p=B2C_1A_SSO_WCS_signup_signin_168

The developer console shows that this request is failing with the error NS_ERROR_NET_INTERRUPT. In Chrome, the error in the developer console is slightly different; it’s ERR_HTTP2_PROTOCOL_ERROR. Frankly, I suspect the problem here is something at Akamai, not something on Costco’s servers; that guess may help you to figure out what’s going wrong, but it doesn’t help me log in.

Things I have tried to troubleshoot / resolve the issue

None of the following made any difference, i.e., none of them enabled me to log in successfully.

I walked all the way to my local public library and tried logging in from one of its computers with exactly the same result.

I also tried logging in from my own computer connected to the library’s WiFi.

I tried logging in with Firefox on Linux, Chrome on Linux, Firefox on Android, Firefox on macOS, Edge on Windows, and Chrome on Windows.

I tried logging in with and without my VPN enabled.

I tried logging in through my phone’s 5G internet connection rather than through my home WiFi.

I tried logging in from a private browsing window with none of my browser extensions enabled.

I tried clearing my cache.

I tried clearing all local storage including cookies.

I tried resetting my password to one that is less than 16 characters long.

I tried resetting my password to one in which the only special characters are in the list of special characters specifically recommended on your password reset form.

I tried disabling http2 in Firefox. This caused the failure to be slightly different—an eventual timeout instead of an immediate network interrupt—but it still failed eventually at exactly the same point in the login process.

I tried disabling http3 in Firefox with the same result as disabling http2.

I tried creating a brand new account with my membership number specified during account creation.

I tried creating a brand new account using an email address in my personal domain instead of an email address from addy.io, the privacy-protecting email forwarding service which I usually use.

I tried creating a brand new account using my Gmail address, without specifying my membership number during account creation.

I tried logging in through Firefox’s “Troubleshoot Mode”, which disables all extensions and many other customizations.

I tried rebooting my router.

I tried upgrading my router firmware.

I tried resetting my FIOS connection.

I tried monitoring network traffic using wireshark and did not see any evidence that either side was prematurely terminating the network connection to signin.costco.com.

I tried signing in using the Costco Android app, with the same exact result, regardless of whether my VPN or WiFi is enabled on my phone.

October 3 update: I now know what’s causing the problem, but it isn’t fixed

A few days after I sent the letter above, someone on Costco’s “Executive Escalations Team” called me. She said she was creating a “tech ticket” about my issue, you know, she did the thing which their online tech support rep said was impossible. What a surprise (not).

A few days after that, she sent me the following:

Our team has provided me an update on this case. Here is what my team have advised.

“It appears they are using disposable email addresses. Please advise them to use legitimate email domains, as Akamai is currently blocking requests based on the email domain. Due to this, all requests originating from that IP are being blocked.”

I responded as follows:

Three things:

1. The email addresses I use are not “disposable”, they are private. This is a crucial distinction. These are persistent email addresses which will continue to exist and continue to forward to my real email inbox for as long as I want them to. I use a service called Addy.io to create different email addresses for the different websites that I use. This services a number of purposes, including:
   1. It protects my real email address from spam by allowing me to deactivate or delete aliases that receive unsolicited emails.
   2. It allows me to identify who has sold my data or which sites have suffered data breaches containing my data.
   3. It protects my identity in the event of a data breach by making it difficult for hackers to cross-reference my accounts.
2. It’s really not OK that you changed your Akamai filtering to disallow logins from email addresses that worked fine for the longest time without notifying impacted users that you were doing that or giving them time to change their email addresses before implementing the change.
3. As I noted before, I want to keep my existing account because I do not want to lose my purchase history, but I can’t log into that account to change the email address because… I can’t log into the account.

I don’t think you should be disallowing the use of these email addresses at all. I think it’s wrong to do so and interferes with your customers’ ability to protect their own privacy by using whatever valid email addresses they want to sign up for accounts on your site. So I believe the right solution to this problem is for you to change your Akamai rules so you aren’t blocking logins from Addy.io domains.

Having said that, if you insist on leaving this filtering in place, then I need you to help me change the email address associated with my account so I can continue to use the account that has my purchase history in it.

Related to that, there is an additional issue that needs to be addressed, which is that in the process of troubleshooting this issue I created a new account on the site using my real email address, [address 1]. If you’re not going to disable the filtering we’re discussing, then I need to change the email address on my original account from “[address 2]”, to “[address 1]”, but I assume I can’t do that as long as there is an existing costco.com with the email address “[address 1]”. Therefore, I need that account to be deleted. I don’t see any way on the website to delete an account. And while you’re at it you should also delete the other two test accounts I created while troubleshooting this issue, the ones with the email addresses “[address 3]” and “[address 4]”.

Thank you.

October 7 update: Costco response: “because we can, fuck you”

I don’t know why, when I sent the email above to Costco, I held out any hope that they would do the right thing and fix their infrastructure to allow people to use privacy-protecting email addresses on their web site, or barring that, at least help me to regain access to my account so that I wouldn’t lose my purchase history stored there.

But apparently somewhere deep in my silly human brain I did, in fact, hope they would do the right thing, so I was of course disappointed. I received this today:

I have deleted the account under those emails. Please make sure that you are using to use legitimate email domains, as Akamai is currently blocking requests based on the email domain. If you are ever want to get a copy of your shopping history you can always reach out to our membership department and they will email you a copy. Thank you for your time, patience, and allowing us to assist you with this situation.

At this time I am going to move forward with closing this service request. If you need further assistance please reply to this email or call 1-800-955-2292 to re-open this request. Have a great rest of your day!

I sent back the following, because sometimes you just have to be petty that way:

You didn’t “assist me with this situation,” you told me to fuck off.

Thanks for nothing.