Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bucketsquatting is finally dead

onecloudplease.com

Post reply on HN
Print view View original

101–110 of 187 posts

Re: Bucketsquatting is finally dead

#101

Post by shmolyneaux »

etothet wrote: post #55

Speaking of unique names within AWS, I learned the other day that even after you delete an AWS account, you can’t reuse the root user email addresses (it’s documented, but I wasn’t aware). Someone at my org used their main company email address for a root user om an account we just closed and a 2nd company email for our current account. We are past the time period where AWS allows for reverting the account deletion.…

That seems like a GDPR violation waiting to happen. It shouldn't be possible for them to store an email address like that forever and be in compliance.

Re: Bucketsquatting is finally dead

#102

Post by kevin_thibedeau »

a2tech wrote: post #94
etothet wrote: post #55

Speaking of unique names within AWS, I learned the other day that even after you delete an AWS account, you can’t reuse the root user email addresses (it’s documented, but I wasn’t aware). Someone at my org used their main company email address for a root user om an account we just closed and a 2nd company email for our current account. We are past the time period where AWS allows for reverting the account deletion.…

AWS support seems to be struggling. I just came to help a new customer who had a rough severance with their previous key engineer. The root account password was documented, but the MFA went to his phone. We've tried talking to everyone we can, opening tickets, chats, trying to talk to their assigned account rep, etc, no one can remove the MFA. So right now luckily they have other admin accounts, but we straight up ca…

This is why you either issue corporate phones or key dongles.

Re: Bucketsquatting is finally dead

#104

Post by gnopgnip »

etothet wrote: post #55

Speaking of unique names within AWS, I learned the other day that even after you delete an AWS account, you can’t reuse the root user email addresses (it’s documented, but I wasn’t aware). Someone at my org used their main company email address for a root user om an account we just closed and a 2nd company email for our current account. We are past the time period where AWS allows for reverting the account deletion.…

I thought it worked the other way, you can have multiple accounts with the same username as long as they have different passwords

Re: Bucketsquatting is finally dead

#105

Post by echoangle »

Bridged7756 wrote: post #103

I think I'm not getting it. What's the problem if someone else can claim that bucket name? If it's deleted wouldn't the data be deleted too? Or is it there something I'm missing.

I think you can put malicious data in the bucket and „impersonate“ the deleted bucket, so old code referencing the bucket uses your data instead of throwing an error (?).

Re: Bucketsquatting is finally dead

#106

Post by etothet »

gnopgnip wrote: post #104
etothet wrote: post #55

Speaking of unique names within AWS, I learned the other day that even after you delete an AWS account, you can’t reuse the root user email addresses (it’s documented, but I wasn’t aware). Someone at my org used their main company email address for a root user om an account we just closed and a 2nd company email for our current account. We are past the time period where AWS allows for reverting the account deletion.…

I thought it worked the other way, you can have multiple accounts with the same username as long as they have different passwords

IAM users get usernames - they don’t log in with an email address. Root users log in with their email address.

Re: Bucketsquatting is finally dead

#107

Post by NetMageSCW »

a2tech wrote: post #94
etothet wrote: post #55

Speaking of unique names within AWS, I learned the other day that even after you delete an AWS account, you can’t reuse the root user email addresses (it’s documented, but I wasn’t aware). Someone at my org used their main company email address for a root user om an account we just closed and a 2nd company email for our current account. We are past the time period where AWS allows for reverting the account deletion.…

AWS support seems to be struggling. I just came to help a new customer who had a rough severance with their previous key engineer. The root account password was documented, but the MFA went to his phone. We've tried talking to everyone we can, opening tickets, chats, trying to talk to their assigned account rep, etc, no one can remove the MFA. So right now luckily they have other admin accounts, but we straight up ca…

What happens when someone loses their phone?

Re: Bucketsquatting is finally dead

#108

Post by kstrauser »

shmolyneaux wrote: post #101
etothet wrote: post #55

Speaking of unique names within AWS, I learned the other day that even after you delete an AWS account, you can’t reuse the root user email addresses (it’s documented, but I wasn’t aware). Someone at my org used their main company email address for a root user om an account we just closed and a 2nd company email for our current account. We are past the time period where AWS allows for reverting the account deletion.…

That seems like a GDPR violation waiting to happen. It shouldn't be possible for them to store an email address like that forever and be in compliance.

If user foo@gmail.com violates our ToS and I suspend them, I can keep that email address forever to keep them from signing up again. They can’t just say “GDPR! You have to forget me, tee-hee!”

Re: Bucketsquatting is finally dead

#109

Post by etothet »

otterley wrote: post #89
zenoprax wrote: post #76

Earlier quoted context omitted.

> email addresses are immutable 1. Use "admin@domain.com" 2. Let the domain registration lapse 3. Someone else registers the domain and now can't create an AWS account. Rare but not impossible.

Sure they can. Use any other email address at domain.com to register.

Yes. There are solutions to all of these issues, but what often happens is these situations come about through the natural course of companies changing over time - different people managing accounts, different providers, etc. The happy path is easy, but the happy path is rarely the one we find ourselves walking down when we inherit a previously made decision.

Re: Bucketsquatting is finally dead

#110

Post by NetMageSCW »

mirashii wrote: post #74
vhab wrote: post #9

> For Azure Blob Storage, storage accounts are scoped with an account name and container name, so this is far less of a concern. The author probably misunderstood what "account name" is in Azure Storage's context, as it's pretty much the equivalent of S3's bucket name, and is definitely still a large concern. A single pool of unique names for storage accounts across all customers has been a very large source of frust…

> especially with the really short name limit of only 24 characters. And with no meaningful separator characters available! No dashes, underscores, or dots. Numbers and lowercase letters only. At least S3 and GCS allow dashes so you can put a little organization prefix on them or something and not look like complete jibberish.

Use 1 for your separator.
Post reply on HN