Live data from Hacker News

Amazon Is Downloading Apps From Google Play and Inspecting Them

blog.rajbala.com

111–113 of 113 posts

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#111
post #37
post #6

This seems to be the natural outcome of Amazon's excellent customer service policy, where they have on numerous occasions[0] refunded costs for hacked instances. When they commit to that policy, they have a huge incentive to limit customer security breaches. I love examples like that where a company's policies result in incentives that are so well-aligned with those of their users. Does anyone have other good example…

Credit card companies are a good example of the this too. Since they're responsible for fraudulent charges, there's a huge incentive for them to detect them.

They are not financially responsible. If there's a chargeback, stolen credit card, etc they reverse the charge on the merchant. In other word the merchant pays for the items purchased with stolen credit cards. All the credit car companies need to do is keep theft low enough so that the perception on them is good. Make no mistake the crest card companies do NOT pay for items purchased with stolen credit cards, the merchants do.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#112
post #72

I'm being dumb. I can see that it is preferable to embed credentials for a restricted IAM acct, not your root/master AWS account. But how does using a TVM improve the situation? Surely you still need to embed creds which allow the app to use the TVM? In that case, an attacker can extract those creds, and ask the TVM for a time-limited token any time they like. How does using a TVM improve security over embedding the…

Your token service would authenticate users using their credentials for your system.

Still not sure how that helps. In both cases, we have creds embedded in the app which can be used (and only used) for access to the AWS resource.

In one case directly (via an IAM limited account), in another via a token they can request. In both cases, the acct is limited to one specific AWS resource. In both cases, the creds can be revoked centrally. In both cases the creds are embedded in the app.

Smart people who build these things (AWS) seem to think a TVM is a better solution. I don't understand why.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#113

Earlier quoted context omitted.

NOOOOOOOOOOO But seriously, treat them like passwords. Don't have the service store the secrets, have the service store hashes of the secrets with a regex for prefiltering (because hashing every word everywhere would be prohibitively expensive).

> Don't have the service store the secrets Why not? You can use the service to make sure it doesn't leak its own secrets so it's safe ;-) But seriously yes I really like your approach. You could even provide a second set of API to do the opposite: given a block of text see if there's any sensitive string inside. Google & co could use it before publishing an app in their Store.

Either way you still have to trust another third party to keep your secrets safe. Even if the secrets weren't publicly leaked, any comrpomise to this service affects any service whose keys you have stored there.
Post reply on HN