Why can't Amazon protect you from Bitcoin mining on your account?

https://news.ycombinator.com/item?id=8817299

"When I woke up the next morning, I had four emails from Amazon AWS and a missed phone call from Amazon AWS."

So Amazon clearly did have some very clear fraud signals.

I agree with you that my lack of knowledge isn't a guide, which is why I phrased it in the form of a question and asked HN. Your current comment is in fact the only actual (and perfectly sufficient) answer.

---

EDIT: regarding 4), out of curiosity, if they could legally and were allowed to tell programmatically if miner proceses were running and stop these for you, would you want them to? [preauthorize them to check and not allow it unless/until you lift this]. I would do so personally, as an added measure of security simply due to the incentive people have to steal my keys for this reason, and the fact that as a practical matter it does happen - as in the write-up, in which a .gitignore was ignored.

>so I installed the Figaro gem (a rails API key security gem), and trusted it to keep my API key off of git when I pushed. I opened the console and git push origin master to send the new version of my app, Shriek to Heroku.

>Figaro pops up on the command line as usual, but this time instead of saying “created application.yml, created .gitignore” It just said “created application.yml”.

It certainly sounds like something that could happen to me, or anyone, and does every day. but it sounds like you would not opt in to this? just curious.

I think it's wrong to analyze this as stolen goods. It's an opportunity cost. Unless they are fully utilized, the cost is power, cooling, and depreciation on the hardware. Not the market price of what that CPU time would have been sold for. Based on http://www.geekwire.com/2014/heres-startup-dumped-amazon-web... the internal cost might be 50% or even less than market price.

You have a habit of positing that because you wouldn't do something means that others wouldn't as well. You can sue a bank for acting in bad faith, which "does not necessarily involve furtive or evil motives, but has a commercial sense of disregard of and refusal to learn the facts when available; and that the circumstances and conditions may be so cogent and obvious that to remain passive amounts to bad faith" - http://caselaw.findlaw.com/ky-court-of-appeals/1496975.html#... .

Bear in mind that it's very difficult to extrapolate from a regulated bank to an unregulated company. there are also a lot of banking laws put into place define exactly what bad faith means. For example, it used to be that you were liable for stolen credit card misuse until the time it was reported. The law changed to limit your liability, which placed more emphasis on the bank to do fraud detection.

The parallel here is obvious; if as a matter of principle they decided to assume 100% liability, then this gives them inventive to improve fraud detection, which can be done through things like usage analysis. While assuming no liability gives them less inventive to go after fraud. If Amazon wants happy customers, then great service helps - no principle needed.

(In addition, the US government requires additional reporting and oversight of your bank account. For example, the bank can be in trouble if they decline to notice a pattern of structuring your transactions to be under the $10,000 reporting limit to the government.)