Amazon insiders sound alarm over security • Hacker News Board

Re: Amazon insiders sound alarm over security

#31

Post by rurban » Thu, Feb 25, 2021, 6:19 AM UTC

croes wrote: post #22

ekianjo wrote: post #16

Earlier quoted context omitted.

> So 3 employees involved with security and not 1 employee. Also, they were pushed out AFTER alerting about security issues. How much credibility do you put in such testimonies though? Especially if everyone is a "anonymous source", you can basically invent just about anything and publish it and pretend for it to be a genuine article without any fact under the hood.

You get sued, because such claims are business damaging.

Good, because then you can verify your claims in court. Which Amazon will not be able to counter. So they will fear the light. Like their friends, secret services doing their illegal things, but they are protected by "National Security" claims, Amazon not.

Re: Amazon insiders sound alarm over security

#32

Post by yashap » Thu, Feb 25, 2021, 6:28 AM UTC

ActorNightly wrote: post #10

Every time I read articles like these, I get dissapointed about the state of the internet. The only thing you know that is likely to be true is that someone got fired from Amazon, and thats it. You don't know if they are telling the truth. You don't know if they were in the right. You don't know if Amazon was fixing the problem, and they decided to be an asshole and go over their bosses because they felt that not eno…

Yeah, Amazon is a massive target for hackers, but hasn’t had any particularly bad breaches that I can remember. I’m sure their security/privacy is far from perfect, but it seems to be pretty effective.

FWIW I’ve never worked for Amazon, but I have quite a few friends and former coworkers at AWS. We’ve had discussions about security and privacy, and the general sense I got from them is that Amazon has more of a focus on security and privacy than any tech company they’ve previously worked for.

Re: Amazon insiders sound alarm over security

#33

Post by pseudalopex » Thu, Feb 25, 2021, 6:31 AM UTC

WalterBright wrote: post #24

nowherebeen wrote: post #6

Somehow I am not surprised given all the talk about toxic culture at Amazon from current and past employees.

I personally know a couple ex-Amazon people who thought it was a good place to work and thrived there. Of course, that's not worthy of writing a newspaper article about :-/ I'm not saying it is or it isn't. But ask yourself, which viewpoint sells more newspapers?

They didn't say they read about it.

Re: Amazon insiders sound alarm over security

#34

Post by [deleted] » Thu, Feb 25, 2021, 6:45 AM UTC

devindotcom wrote: post #28

ekianjo wrote: post #16

Earlier quoted context omitted.

> So 3 employees involved with security and not 1 employee. Also, they were pushed out AFTER alerting about security issues. How much credibility do you put in such testimonies though? Especially if everyone is a "anonymous source", you can basically invent just about anything and publish it and pretend for it to be a genuine article without any fact under the hood.

Journalists do check the credentials of the people they include in articles like this. They don't just take randos at their word. These people are anonymous to you but not to the journalist. If you simply don't believe the writer that's a totally different issue - but people at major outlets like Politico don't just invent sources and stories out of whole cloth like you suggest.

[deleted]

Re: Amazon insiders sound alarm over security

#35

Post by Johnny555 » Thu, Feb 25, 2021, 6:59 AM UTC

throwawaysea wrote: post #9

nothasan wrote: post #8

Earlier quoted context omitted.

And how does this solve the problem of information security?

Moving away from a few megacorps would mean consumers have choice in selecting an alternative provider who takes privacy and security more seriously. Today that choice doesn’t exist because Google, Amazon, Facebook, and other big tech companies don’t face competition either due to a traditional monopoly/oligopoly traits, extreme capital advantages, or network effects.

Customers have the choice to not use Amazon today, but how would you give them visibility into who takes privacy and security more seriously? Is Walmart safer? Target? How about my local retailer that only takes orders by phone and types them into a spreadsheet on a poorly protected computer?

Re: Amazon insiders sound alarm over security

#36

Post by ajsharp » Thu, Feb 25, 2021, 7:00 AM UTC

"The quality of the controls that Amazon has in place is appalling. We found hundreds of thousands of accounts where the employee is no longer there but they still have system access..."

Yikes. Not exactly confidence-inspiring.

Re: Amazon insiders sound alarm over security

#37

Post by croes » Thu, Feb 25, 2021, 7:06 AM UTC

wellCrafted wrote: post #26

croes wrote: post #21

Earlier quoted context omitted.

The only way to prove it, would be a massive data leak.

The fact there have been no data leaks should tell you more then some anonymous sources

There is no fact that there is no data leak because it's impossible to prove. If the hackers don't go public to make money from the data you just don't know.

Re: Amazon insiders sound alarm over security

#38

Post by croes » Thu, Feb 25, 2021, 7:07 AM UTC

rurban wrote: post #31

croes wrote: post #22

Earlier quoted context omitted.

You get sued, because such claims are business damaging.

Good, because then you can verify your claims in court. Which Amazon will not be able to counter. So they will fear the light. Like their friends, secret services doing their illegal things, but they are protected by "National Security" claims, Amazon not.

That's why I think the claims are not completely bogus otherwise Amamzon would have sued immediately.

Re: Amazon insiders sound alarm over security

#39

Post by mike_d » Thu, Feb 25, 2021, 7:11 AM UTC

vmception wrote: post #12

Its good they are sounding the alarm, for example, Crypto AG had their cryptographer employees continually find security flaws only to have upper management tell them to work on something else, only to find out after 50 years that it was a CIA operation selling backdoored products to nation states. With nothing being outside the realm of possibility, removing the need for trust should be priority number one.

> Crypto AG had their cryptographer employees continually find security flaws only to have upper management tell them to work on something else

I would be very interested if you could share accounts of this happening.

From the declassified documents I have studied the Crypto AG "backdoor" consisted of misleading customers that less complex models (with smaller keys) would be suitable for their communications, working with the NSA to word end user documentation in a way that makes it unclear how important specific settings are, and providing technical designs to the NSA for review.

At no point do I believe there was a security flaw that an employee would have found that would have compromised the operation, since it was simply a series of steps that weakened the strength of the encryption from "mathematically impossible" to "requires a purpose built supercomputer." This route provided plausible deniability to everyone involved (remember that other cryptographers also evaluated Crypto AG products and would work to secretly exploit any flaws they found "for the bad guys").

Interestingly before the CIA/BND deal, the French attempted to secretly buy the company and do the exact same thing.

Re: Amazon insiders sound alarm over security

#40

Post by patrick451 » Thu, Feb 25, 2021, 7:14 AM UTC

ekianjo wrote: post #16

papaf wrote: post #13

Earlier quoted context omitted.

The only thing you know that is likely to be true is that someone got fired from Amazon. From the article: > The warnings about privacy and compliance failures at Amazon come from three former high-level information security employees — one EU-based and two from the U.S. So 3 employees involved with security and not 1 employee. Also, they were pushed out AFTER alerting about security issues.

> So 3 employees involved with security and not 1 employee. Also, they were pushed out AFTER alerting about security issues. How much credibility do you put in such testimonies though? Especially if everyone is a "anonymous source", you can basically invent just about anything and publish it and pretend for it to be a genuine article without any fact under the hood.

You're getting downvoted a lot, but these days I too place very little confidence in a story that cites anonymous sources, regardless of whatever supposed gravitas the publication is supposed to carry.