Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bucketsquatting is finally dead

onecloudplease.com

Post reply on HN
Print view View original

181–187 of 187 posts

Re: Bucketsquatting is finally dead

#181

Post by efitz »

Arrowmaster wrote: post #180
zikduruqe wrote: post #114

Earlier quoted context omitted.

You print the MFA QR code, and give it to an executive that locks it up in a safe or offsite storage. In a past life, we printed the MFA QR code and the head of finance put it into a safe.

You know that QR code is just text you can read right? It's just an otpauth:// URI you can copy and paste into most password managers. We even have these amazing things that securely share passwords or other secret data between multiple authorized users. Seriously just scan the QR code and put it in any password manager that supports TOTP and it will start outputing codes.

That's precisely why you want it in a safe.

Re: Bucketsquatting is finally dead

#182

Post by kay_o »

peanut-walrus wrote: post #99

Why the hell is this a name suffix instead of just using subdomains? myapp-123456789012-us-west-2-an vs myapp.123456789012.us-west-2.s3.amazonaws.com The manipulations I will need to do to fit into the 63 char limit will be atrocious.

Certificate is only one level. One *.us-west-2.s3 can cover all of region.

Re: Bucketsquatting is finally dead

#183

Post by zikduruqe »

Arrowmaster wrote: post #180
zikduruqe wrote: post #114

Earlier quoted context omitted.

You print the MFA QR code, and give it to an executive that locks it up in a safe or offsite storage. In a past life, we printed the MFA QR code and the head of finance put it into a safe.

You know that QR code is just text you can read right? It's just an otpauth:// URI you can copy and paste into most password managers. We even have these amazing things that securely share passwords or other secret data between multiple authorized users. Seriously just scan the QR code and put it in any password manager that supports TOTP and it will start outputing codes.

Yes, I am very familiar with zbarimg and qrencode. But, other people might not be, and that's why just scanning a QR code works. Not everyone has Bitwarden, 1Password, Pass, keepass, etc.... also these tools may not be approved by your security teams.

And we are talking about the root account for your production AWS account. No need to get fancy. Just print the QR code, and put it in a safe hoping you never need it.

Re: Bucketsquatting is finally dead

#184

Post by xxs »

tosti wrote: post #84
xxs wrote: post #44

Earlier quoted context omitted.

that doesn't help either. 'Salt' is public and usually different/unique per entry/name. If you mean to use a "secret" prefix (i.e. pepper) then, that would generate effectively globally unique names each time (and unpredictable too) but you can't change the pepper and it's only a matter of time it'd leak.

Random pepper. Or just, y'know, randomly generate the effing string. Can't be that hard.

Of course, any UUIDv4 would do it (or any random stuff in general). I suppose the idea was having a naming scheme, instead of sharing the paths explicitly (and having an internal mapping for them)

Re: Bucketsquatting is finally dead

#185

Post by [deleted] »

INTPenis wrote: post #50
Galanwe wrote: post #22

Earlier quoted context omitted.

This is all good and we'll on the IaC side,yes. But at the end of the day, buckets are also user facing resources, and nobody likes random directory / bucket names.

That's a contradiction, a bucket name being treated as a secret in IaC, while being a user facing resource. So no, they're not user facing resources. If anyone wants them to be user facing resources, then treat them as such, and ensure they're secure, and don't store sensitive info on them. Otherwise, put a service infront of them, and have the user go through it. The S3 protocol was meant to make the lives of progra…

[deleted]
Post reply on HN