Live data from Hacker News

AWS Support able to access any S3 object due to permission change

twitter.com

121–130 of 134 posts

Re: AWS Support able to access any S3 object due to permission change

#121

Earlier quoted context omitted.

This seems very binary / black-and-white to me - it’s not “you either trust them or don’t”. I may trust AWS to keep the cloud running, but I may not want to trust all their stuff with access to my private data. If a provider puts themselves in a position that they’re entirely unable to access my data, or it being extremely difficult, that would actually increase my trust in them. If having all customer’s private S3 d…

> If a provider puts themselves in a position that they’re entirely unable to access my data, or it being extremely difficult, that would actually increase my trust in them. This is never possible if you're using KMS / server side encryption or no encryption at all. Your data on these services is always visible if they were to try to read it, whether that be forging KMS requests to decrypt data or passively snapshott…

Of course, that’s why I said “extremely difficult” — it’s never completely impossible. I was thinking about Apple, who made iCloud reasonably e2e encrypted: of course, they can still push malicious updates targeting specific devices, but that needs to be a deliberate action by the organization, not a single rogue employee.

It’s not entirely unlikely that AWS was hacked / socially engineered in order to get this privilege in there, perhaps because some specific s3 buckets were being targeted.

As an organization, you need to have a high enough level of protection that these things are just not possible.

So maybe this whole idea of managed IAM policies being installed in all customers’ accounts is just a fundamentally bad idea, and should just be given on a case by case basis.

Re: AWS Support able to access any S3 object due to permission change

#124
post #115

Earlier quoted context omitted.

>I find this insulting as a customer. Is AWS usually contemptuous of its customers? Oh come off it. We've all seen the idiotic things that "users" can do. Someone complains something isn't working. Then you go through the steps to see what they have done, and you think "why would you ever do that?" We've all been there, and if you haven't been there then you just haven't had much interaction with "users". "Take it ea…

because it’s a complex product, and having empathy for customers is far more helpful than having contempt.

having empathy does not exclude that you can't also still think the users are not smart. you're empathy can come from them being total ID10T users.

Re: AWS Support able to access any S3 object due to permission change

#126
post #45

Such concerns specifically led to my decision of only uploading sensitive data to S3 with client side encryption. Since the aws cli tool only supports server side encryption with keys stored on amazon servers (where the non-default managed keys cost like 1 USD per month), I decided to simply symmetrically encrypt the backup of my syncthing data volume with AES256 using gnupg and only then pushing it to the S3 bucket.

When the Australian Cyber Security Centre did their security assessment of AWS, they actually recommended that Australian government agencies not do this. Their recommendation was for agencies to use KMS. They considered that if agencies managed encryption keys themselves, the risk of them misplacing their keys and losing access to their data was too high.

Re: AWS Support able to access any S3 object due to permission change

#128

Earlier quoted context omitted.

They started the Schwarz Group Cloud (Stackit), 8000 developers and yet not a single production ready service yet.

where do you got that 8000 developer number from? Sounds like a lot

No post body was provided.

Re: AWS Support able to access any S3 object due to permission change

#130
post #65
post #55

Earlier quoted context omitted.

this should be the default user behaviour for any cloud storage. Don't put unencrypted (company) data on a cloud infrastructure you don't have full control over. Also reminds me of the (hyped?) "outrage" when a former facebook developer stated that they used to have a "default password" that allowed fb devs to log into every account and the media were like "omg they could have logged in and seen your photos". I mean.…

> yeah they're the developers they could always do that even without the password Not really. Obviously facebook the company can always access your data. Weather or not an individual developer can do the same, which developers can do it, how they can do it, and under what level of supervision this would be is a design choice. It is possible to design a system with very high level of security and ones with none too. A…

> Weather or not an individual developer can do the same

This was early-early facebook. Like under 10 developers back in the day. But obviously today a facebook frontend developer should not and probably has no access to the database

Post reply on HN