Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS doesn’t know who I am

ben11kehoe.medium.com

Post reply on HN
Print view View original

41–50 of 123 posts

Re: AWS doesn’t know who I am

#41

Post by blunte »

nikanj wrote: post #24

The downside of One True Identity is getting your startup data deleted from account A because account B was booted from Google for unclear TOS violation. Usually these issues can only get resolved by getting your blog post to HN

Do they? We heard the cries for help, and we assume in most cases a Googler here on HN champions the caller.

In fact, I'd like to see some metrics, a transparency report of false positive blocks/deletions which were reversed.

But indeed, I absolutely do not want my personal projects to be related in any way to my work projects, nor vice versa.

Re: AWS doesn’t know who I am

#42

Post by bluehatbrit »

psanford wrote: post #34

Sounds like a problem if you are an AWS Serverless Hero, but for the rest of us I think there is comfort in the fact that AWS identities are not a massive privacy invasion.

This was exactly my thinking when I read through it. I don't even really care about shared pinned services, my day job and side projects use different services for the most part. None of the benefits explored will have much impact to me, and I use AWS almost every day for one reason or another.

If anything it just gives me another place where I can't keep work and home separate. I don't want another "Atlassian" where suddenly my work own my account because I had a work email attached to it, and can close it at will.

Re: AWS doesn’t know who I am

#43

Post by mastazi »

amelius wrote: post #37
yarcob wrote: post #25

It's good that every service has separate credentials. For a counterexample, consider Apple and how they try to restrict you to a single Apple ID. They want everything to be tied to a single person. Every service you use is tied to your Apple ID. It just doesn't match the way that people use computers. For example, I get my computer games and business software billed to the same card, and there's no easy way to chang…

Yes, Apple ID is like a cookie that you can't delete. My solution: use Linux :)

Are you using a Linux phone by any chance? Could you share some details? I've been thinking about it but I didn't pull the trigger because the alternatives I've been looking at all have shortcomings. Curious to hear more.

Re: AWS doesn’t know who I am

#44

Post by thanksforfish »

blunte wrote: post #41
nikanj wrote: post #24

The downside of One True Identity is getting your startup data deleted from account A because account B was booted from Google for unclear TOS violation. Usually these issues can only get resolved by getting your blog post to HN

Do they? We heard the cries for help, and we assume in most cases a Googler here on HN champions the caller. In fact, I'd like to see some metrics, a transparency report of false positive blocks/deletions which were reversed. But indeed, I absolutely do not want my personal projects to be related in any way to my work projects, nor vice versa.

Surely there are people getting banned from Google who are not HN users. Social media outcry is not a good solution as its not accessible to everyone.

Agreed about wanting to see more transparency.

Re: AWS doesn’t know who I am

#45

Post by Galanwe »

YPPH wrote: post #10

Some of these are legitimate grievances but it seems quite reasonable to have separate accounts for work and play. What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. They aren't equals. The services share the name of a rainforest and a very rich CEO but that's about where the similarities end for my part. I'd rather not have to plug in my AWS root account crede…

> What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials.

This bite me hard last year... I lost my phone and with it my MFA for the root account, and of course forgot to properly backup the MFA seed.

Now when calling AWS support to get back my accesses, they ask me to prove ownership of my Amazon.com account with the same email... Which is like 15 years old. I changed phone number, address, country dozens of times since then.

Apparently I would have to get back to my home country and ask a notary to sign a paper asserting I am really me to get back my accesses. Nightmare.

Re: AWS doesn’t know who I am

#46

Post by mcherm »

waf wrote: post #22
YPPH wrote: post #17

Earlier quoted context omitted.

Hm, well they're the same for me and I get redirected to Amazon.com to edit certain pieces of AWS account information. Perhaps it's because my account is very old - possibly having been created near the inception of AWS. I have no memory of creating the account.

Right, AWS accounts created before September 2017 are coupled to amazon.com retail accounts. Accounts created after this are separate.

For those of us with coupled accounts, is there any way to separate them?

Re: AWS doesn’t know who I am

#47

Post by skinkestek »

nl wrote: post #39
anilakar wrote: post #26

Earlier quoted context omitted.

It's also possible to get your personal GMail account banned after someone at your company breaks Google ToS: https://www.reddit.com/r/tifu/comments/8kvias/tifu_by_gettin... For the few Google products we use at work, like Calendar, we make sure that people do not register with their existing personal accounts but use their work email address.

That story doesn't seem very believable. Why are other people's personal accounts getting banned too? One possible explanation is that the exit IP for the company has had malware hosted on it, so that IP is getting banned from Google services. If they go home or turn off WiFi on their phones it will probably work.

> That story doesn't seem very believable. Why are other people's personal accounts getting banned too?

Fully believable.

In some cases people don't even have the slightest clue.

In this case there is at least an explanation even if it is bad.

PS: I don't hate everything Google do or any employees specifically, I just try to shine a light on the places where they fail like lack of transparency or even basic communication or their abuse of market power to try to kill competing browsers.

They have done good work in other areas it seems like standing up against dragnet surveillance etc.

Re: AWS doesn’t know who I am

#48

Post by danpalmer »

yarcob wrote: post #25

It's good that every service has separate credentials. For a counterexample, consider Apple and how they try to restrict you to a single Apple ID. They want everything to be tied to a single person. Every service you use is tied to your Apple ID. It just doesn't match the way that people use computers. For example, I get my computer games and business software billed to the same card, and there's no easy way to chang…

How does Apple restrict you to a single Apple ID?

I use my personal Apple ID for personal things, my work one for work things, and as an admin of our Apple Business Manager account I can create new Apple IDs for anyone in the company as necessary.

To my knowledge Apple doesn't even have a policy of requiring one account, I've certainly been told to set up separate accounts by Apple support teams.

Facebook does have this problem, they have a policy that you must not have separate IDs, they police this heavily with a lot of automated bans, and they also require a Facebook account to do development with Facebook.

Re: AWS doesn’t know who I am

#49

Post by jffry »

andrewnicolalde wrote: post #20
YPPH wrote: post #10

Some of these are legitimate grievances but it seems quite reasonable to have separate accounts for work and play. What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. They aren't equals. The services share the name of a rainforest and a very rich CEO but that's about where the similarities end for my part. I'd rather not have to plug in my AWS root account crede…

Is this the case for you? Mine are totally different. How did they get tied together?

Up until 3-4 years ago, if you created an AWS account with the same email address as your amazon.com shopping account, Amazon would automatically link the two together, without warning and without a setting to undo this. Changing the password on one changed the other too. This connection persisted for accounts made after AWS stopped doing this, probably for backwards compatibility reasons.

At least when I dealt with this mess a couple years ago, AWS support did not have reassuring answers. They claimed they could separate it, but if something went wrong we were on our own without spending large amounts of money on premium support.

Lucky for me most of our resources were already in child AWS accounts and the rest could be migrated, so I was able to create a _new_ top-level AWS account, re-parent the child accounts, and delete the old parent account instead. At least with that process we could create a throwaway child account and test every step before doing it for real with production.

Re: AWS doesn’t know who I am

#50

Post by quickthrower2 »

koolba wrote: post #19
YPPH wrote: post #10

Some of these are legitimate grievances but it seems quite reasonable to have separate accounts for work and play. What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. They aren't equals. The services share the name of a rainforest and a very rich CEO but that's about where the similarities end for my part. I'd rather not have to plug in my AWS root account crede…

> I'd rather not have to plug in my AWS root account credentials when I get the urge to impulse buy a robotic vacuum cleaner. Clearly the solution to this is for the retail site to support IAM roles.

Yeah make it so confusing nobody buys anything!
Post reply on HN