In Digital Ocean, S3-like space keys can access all your buckets
ideas.digitalocean.com
In Digital Ocean, S3-like space keys can access all your buckets
1–10 of 104 posts
Re: In Digital Ocean, S3-like space keys can access all your buckets
#2S3 (and similar storages) have caused plenty of security issues in several occasions (usually because of misconfigured buckets, making all contents available to the public). Given this, it would be expected that companies would pay a bit more attention to the security of these data storage methods.
However, in Digital Ocean, by design, you can't restrict keys to certain buckets. Once you issue a key, it can access all buckets within your project, with all operations (list, read, delete) files.
The issue has been reported and is known for a long time. It's even the top voted "idea" in the company portal.
Posting this here in hopes to bring awareness of this issue.
Re: In Digital Ocean, S3-like space keys can access all your buckets
#3S3 (and similar storages) have caused plenty of security issues in several occasions (usually because of misconfigured buckets, making all contents available to the public). Given this, it would be expected that companies would pay a bit more attention to the security of these data storage methods. However, in Digital Ocean, by design, you can't restrict keys to certain buckets. Once you issue a key, it can access al…
Things like these are why I stopped using digitalocean.
They had issues with DNS PTR records too for years. Same for initial auth tokens being global. I had hopes for them and used them exclusively at 1 time.
Re: In Digital Ocean, S3-like space keys can access all your buckets
#4I haven't used DO Spaces for a good while as I've shifted to B2 as cheaper S3-compatible storage that suits my archival workload.
However I absolutely would be using Spaces as storage alongside any apps running on DO, and would have assumed that all the usual per-bucket permissions I'm used to elsewhere were present, so thanks for the heads up!
Re: In Digital Ocean, S3-like space keys can access all your buckets
#5And DO consistently ignores requests to add this. It prevents me from seriously using Spaces and I think many others, too.
Re: In Digital Ocean, S3-like space keys can access all your buckets
#6And DO consistently ignores requests to add this. It prevents me from seriously using Spaces and I think many others, too.
DO has had a terrible attitude to security for as long as they've been around. I reported a major data leak vulnerability to them and they told me it was operating as intended, so I published it, and then they accused me of irresponsible disclosure, while simultaneously claiming that there was no security issue. This was a dozen years ago and the founders were involved in the response.
They are at the top of the list of companies with which I will never do business.
Re: In Digital Ocean, S3-like space keys can access all your buckets
#7And DO consistently ignores requests to add this. It prevents me from seriously using Spaces and I think many others, too.
DO has had a terrible attitude to security for as long as they've been around. I reported a major data leak vulnerability to them and they told me it was operating as intended, so I published it, and then they accused me of irresponsible disclosure, while simultaneously claiming that there was no security issue. This was a dozen years ago and the founders were involved in the response. They are at the top of the list…
Could you provide more details?
Re: In Digital Ocean, S3-like space keys can access all your buckets
#8S3 (and similar storages) have caused plenty of security issues in several occasions (usually because of misconfigured buckets, making all contents available to the public). Given this, it would be expected that companies would pay a bit more attention to the security of these data storage methods. However, in Digital Ocean, by design, you can't restrict keys to certain buckets. Once you issue a key, it can access al…
Things like these are why I stopped using digitalocean. They had issues with DNS PTR records too for years. Same for initial auth tokens being global. I had hopes for them and used them exclusively at 1 time.
Really? I have had no issues using them for basic hosting.
Re: In Digital Ocean, S3-like space keys can access all your buckets
#9Earlier quoted context omitted.
DO has had a terrible attitude to security for as long as they've been around. I reported a major data leak vulnerability to them and they told me it was operating as intended, so I published it, and then they accused me of irresponsible disclosure, while simultaneously claiming that there was no security issue. This was a dozen years ago and the founders were involved in the response. They are at the top of the list…
Could you provide more details?
On delete of VMs, the next user to be allocated disk would be able to read your data. There was a "scrub" feature that would bill you longer/extra to zeroize your data and not give it to the next customer. Apparently they hadn't heard of TRIM or thin provisioning.
https://github.com/fog/fog/issues/2525
Re: In Digital Ocean, S3-like space keys can access all your buckets
#10S3 (and similar storages) have caused plenty of security issues in several occasions (usually because of misconfigured buckets, making all contents available to the public). Given this, it would be expected that companies would pay a bit more attention to the security of these data storage methods. However, in Digital Ocean, by design, you can't restrict keys to certain buckets. Once you issue a key, it can access al…
Isn't this usually solved through some form of IAM policies? Does DO not have this?