91–100 of 227 posts
Earlier quoted context omitted.
I am not sure this would be in agreement with these policies, or at least the spirit of them: https://aws.amazon.com/security/penetration-testing/
OP's article said they consulted with Amazon's security team before publishing, so I imagine they know what's allowed in this case.
Slightly related - CloudFlare account_id and zone_id are safe to be public https://github.com/cloudflare/cloudflare-docs/issues/474 https://community.cloudflare.com/t/api-zone-id/355566 > The Zone ID and Account ID are not sensitive. Sensitive data like account API Key, Secrets etc. can all be revoked, rotated or changed. See the comment 36 below on the Wrangler repo: as per our security team, it’s completely Fine to…
Earlier quoted context omitted.
Seems like at least in the digital world, there is either public or private information, and that's it. We don't really have a good concept of privilege or protected information. For example, my home address is technically public, but I most certainly wouldn't want it lambasted across the interstate with a picture of my family next to it advertising where I live. It's handed out on a need-to-know basis, and I mostly…
One huge mistake that Google did when they were integrating youtube with Google+, was the idea of sharing people's youtube comments with their G+ friends. Youtube comments have always been public, but there was huge customer pushback, forcing them to revert them for this idea, since there is in people's mind a huge difference between public and publicized comments.
Earlier quoted context omitted.
> Put another way: there’s a difference between “I don’t do this thing” and “I rely on not doing this thing for my safety”. That was my point. The fact that some organizations consider AWS account IDs sensitive is independent of whether they rely on it being sensitive or not. I might have taken all precautions against an assassin attack, yet I won't make the assassin's job easier by announcing my PII to them. The fac…
If an organization considers it sensitive, that implies they’re putting some level of reliance on it being so. Otherwise there would be no point in considering it sensitive. There’s a difference between “making it easier for an attacker” and using it as a security control, even if it’s not the only security control. The point is that even if you don’t go around wearing a shirt with your address on it, that should nev…
> While account IDs, like any identifying information, should be used and shared carefully, they are not considered secret, sensitive, or confidential information. https://docs.aws.amazon.com/accounts/latest/reference/manage...
What does this mean? If they're not secret, sensitive, or confidential, then why must they be shared carefully?
https://docs.aws.amazon.com/whitepapers/latest/data-classifi...
> While account IDs, like any identifying information, should be used and shared carefully, they are not considered secret, sensitive, or confidential information. https://docs.aws.amazon.com/accounts/latest/reference/manage...
What does this mean? If they're not secret, sensitive, or confidential, then why must they be shared carefully?
The other attack vector is from insiders. Many organizations "shield" identifiable information behind UUIDs or some other scheme. In the event of a breach, the UUID might mean nothing to most (it's not foolproof, though), but opens more doors for an insider.
Slightly related - CloudFlare account_id and zone_id are safe to be public https://github.com/cloudflare/cloudflare-docs/issues/474 https://community.cloudflare.com/t/api-zone-id/355566 > The Zone ID and Account ID are not sensitive. Sensitive data like account API Key, Secrets etc. can all be revoked, rotated or changed. See the comment 36 below on the Wrangler repo: as per our security team, it’s completely Fine to…
For CF accounts, I use the gmail `+ feature` to make a totally unique email address that cannot be easily guessed. Not perfect, but adds another layer of abstraction.
Earlier quoted context omitted.
OP's article said they consulted with Amazon's security team before publishing, so I imagine they know what's allowed in this case.
It says he consulted but does not say what was their answer. I can't imagine it was a thumbs up, probably an embarrassed silence?
Earlier quoted context omitted.
OP's article said they consulted with Amazon's security team before publishing, so I imagine they know what's allowed in this case.
It says he consulted but does not say what was their answer. I can't imagine it was a thumbs up, probably an embarrassed silence?
"Kid Tested. Mother Approved."
Kids tested it but we don't know if they approved it. We don't know if mothers tested it; we only know they approved it.
How might this matter? A obvious one: Given a production bucket, it’s now possible to find development buckets for that same org, which is not expected behavior IMO.