If only they had some kind of charge limiting on accounts like their customers have been asking for years now.
Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
11–20 of 110 posts
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#12The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#13I deleted my AWS account yesterday. It is obviously catered towards large organisations - very complicated tools and pricing that I couldn't really fit into my use case. I tried to just shut down the services that were using money but wasn't even sure I had found them all so I just closed the whole account. I don't even like the idea of any of this stuff. I want to run my own little raspberry pi server or whatever, i…
I shutdown the credit card i was using. They're intentionally making it hard and I decided it was less work to update payment methods on everything else.
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#14their hardware MFA functionality is worse than useless
it only permits a single hardware token to be registered to an account
so good luck if you misplace or break your hardware token
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#15I deleted my AWS account yesterday. It is obviously catered towards large organisations - very complicated tools and pricing that I couldn't really fit into my use case. I tried to just shut down the services that were using money but wasn't even sure I had found them all so I just closed the whole account. I don't even like the idea of any of this stuff. I want to run my own little raspberry pi server or whatever, i…
Yep, the only way to do this is using aws-nuke [0], and the billing is such a mess for small use cases.
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#16The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.
If you were "hacked" (ie password reuse), the attacker can just relimit this.
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#17I migrated off AWS in December and closed my account. With the outages, they are likely looking at revenue shortfalls. Outages don't scare me, but their billing practices are already uncomfortable. This may make them prone to be more stingy about bill forgiveness. Bill forgiveness is inherent in the unsafe billing model which makes even having the account open even more of a huge liability.
I'm done.
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#18their hardware MFA functionality is worse than useless it only permits a single hardware token to be registered to an account so good luck if you misplace or break your hardware token
I did not like that limitation either and get around it by using the Yubico Authenticator app with three separate hardware tokens configured with the same shared TOTP seed. There's also path to reset your root account access, btw.
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#19their hardware MFA functionality is worse than useless it only permits a single hardware token to be registered to an account so good luck if you misplace or break your hardware token
When setting up the token you can scan the QR with multiple devices. E.g YubiKey and Authenticator App. This at least allows for a backup in case one goes missing. I agree it is kind of incredible that multiple tokens are not supported.
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#20their hardware MFA functionality is worse than useless it only permits a single hardware token to be registered to an account so good luck if you misplace or break your hardware token
The point is to block unauthorized access. It is not less than useless. It absolutely does that. You really think if your lost your token Amazon would lock you out forever? Wrong assumption
Besides, just use AUTHY if that's your concern