Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bucketsquatting is finally dead

onecloudplease.com

Post reply on HN
Print view View original

141–150 of 187 posts

Re: Bucketsquatting is finally dead

#141

Post by kg »

throwaway173738 wrote: post #62
xmcqdpt2 wrote: post #54

Earlier quoted context omitted.

I wonder if it's related to the fact that Windows as such weird rules about allowed file names. Like not directly obviously, more like culturally inside microsoft.

I’m pretty sure Azure was built out with Hyper-V, which was built into the Windows kernel. So everything that relied on virtualization would’ve had bizarre case insensitivity and naming rules. I’ve lost track of servers in Azure because the name suddenly changed to all uppercase ave their search is case sensitive but whatever back-end isn’t.

Isn't case insensitivity a Win32 thing only? I would not expect it to impact stuff in Hyper-V or the windows kernel. AFAIK for example NTFS is case-sensitive.

Re: Bucketsquatting is finally dead

#143

Post by pfortuny »

charcircuit wrote: post #138
arielweisberg wrote: post #136

Earlier quoted context omitted.

This can be implemented without storing it. They could store a hash. No idea what they actually do.

A hash of a public identifier like an email is personally identifiable data.

You can always encrypt with a public key instead of hashing.

Re: Bucketsquatting is finally dead

#144

Post by ksenzee »

mhurron wrote: post #121
noahmasur wrote: post #60

Earlier quoted context omitted.

You can always use plus-addressing if your email provider supports that. AWS considers plus-addressed root emails to be unique.

Or you don't have employees using their personal email to open corporate accounts. Still on Amazon to clearly tell people it is this way so they can properly plan for it, but employee's email addresses really shouldn't be used for the root account.

That’s not what’s being described here. What OP described is the much more common situation where employees use a personal phone for MFA. Sure, some places issue hardware dongles and disallow authenticator apps on your personal phone, but IME most places default to just having people use their phone.

Re: Bucketsquatting is finally dead

#145

Post by jounker »

charcircuit wrote: post #138
arielweisberg wrote: post #136

Earlier quoted context omitted.

This can be implemented without storing it. They could store a hash. No idea what they actually do.

A hash of a public identifier like an email is personally identifiable data.

Isn’t the entire point of a cryptographically secure hash that you can’t derive the original information?

Re: Bucketsquatting is finally dead

#146

Post by erikerikson »

etothet wrote: post #55

Speaking of unique names within AWS, I learned the other day that even after you delete an AWS account, you can’t reuse the root user email addresses (it’s documented, but I wasn’t aware). Someone at my org used their main company email address for a root user om an account we just closed and a 2nd company email for our current account. We are past the time period where AWS allows for reverting the account deletion.…

I would expect the SSO configuration to map the IdP's given email into a role appropriate for the identity. What does "forever attached to the deleted AWS account root user" mean here? What is the mechanism blocking use?

Re: Bucketsquatting is finally dead

#147

Post by nradov »

a2tech wrote: post #94
etothet wrote: post #55

Speaking of unique names within AWS, I learned the other day that even after you delete an AWS account, you can’t reuse the root user email addresses (it’s documented, but I wasn’t aware). Someone at my org used their main company email address for a root user om an account we just closed and a 2nd company email for our current account. We are past the time period where AWS allows for reverting the account deletion.…

AWS support seems to be struggling. I just came to help a new customer who had a rough severance with their previous key engineer. The root account password was documented, but the MFA went to his phone. We've tried talking to everyone we can, opening tickets, chats, trying to talk to their assigned account rep, etc, no one can remove the MFA. So right now luckily they have other admin accounts, but we straight up ca…

I won't attempt to defend AWS here, but if any company has such incompetent IT management as to allow an individual employee to have that level of control then they kind of deserve what they get. Life is hard when you're stupid.

Re: Bucketsquatting is finally dead

#148

Post by charcircuit »

jounker wrote: post #145
charcircuit wrote: post #138

Earlier quoted context omitted.

A hash of a public identifier like an email is personally identifiable data.

Isn’t the entire point of a cryptographically secure hash that you can’t derive the original information?

You can't derive the original better than guessing. With public identifiers you can just take a list of them and guess with those. If someone asks for your email they can hash it themselves and compare it against whatever databases.

Re: Bucketsquatting is finally dead

#149

Post by silversmith »

shmolyneaux wrote: post #101
etothet wrote: post #55

Speaking of unique names within AWS, I learned the other day that even after you delete an AWS account, you can’t reuse the root user email addresses (it’s documented, but I wasn’t aware). Someone at my org used their main company email address for a root user om an account we just closed and a 2nd company email for our current account. We are past the time period where AWS allows for reverting the account deletion.…

That seems like a GDPR violation waiting to happen. It shouldn't be possible for them to store an email address like that forever and be in compliance.

GDPR says you are not allowed to store my data just because. If you have a good enough reason, everything is allowed.

Re: Bucketsquatting is finally dead

#150

Post by lokar »

etothet wrote: post #55

Speaking of unique names within AWS, I learned the other day that even after you delete an AWS account, you can’t reuse the root user email addresses (it’s documented, but I wasn’t aware). Someone at my org used their main company email address for a root user om an account we just closed and a 2nd company email for our current account. We are past the time period where AWS allows for reverting the account deletion.…

You should not have the root account be a human anyway. Make that a special account, secure the credentials and only ever use them when you screw something up really badly.
Post reply on HN