4 ms·

Amazon has just made it easier to pick what devices to purchase: None of theirs.

freehunter 11y ago
It makes it harder to know what other devices and software to buy, though. If you (like some comments in here imply they do) assume that the entirety of Amazon is compromised, you'll have to stop using Netflix, since they're hosted at Amazon. You'll have to stop using Reddit, since they're at Amazon. You'll have to stop using almost all the popular apps, since they're most likely on Amazon. And if Amazon is compromised by an external attacker, you have to assume AWS is compromised as well. It's more difficult to drop Amazon than you might think.
- zokier 11y ago
  OP was talking about devices, not services.
  - freehunter 11y ago
    Obviously. But where is the difference? If the NSA is reading your texts through the physical phone hardware or reading them off the wire, it's the same thing. In fact it's scarier if there is an encryption backdoor on their software, since it could be read remotely much easier. If Amazon hardware is compromised, there's no reason to assume their AWS platform isn't compromised. And that puts a backdoor in a lot of web applications.
- tehwebguy 11y ago
  There's a wide difference between my Netflix habits and every bit of personal data on my device, but that gap is probably closing as more sites use AWS
- ajross 11y ago
  That's sort of misunderstanding the threat model. Data in the "cloud" has always been subject to surveillance and seizure. It's not covered by the "encryption" stored on your local device (except in specific ways for specific apps). No one is saying "drop amazon" in this context, because the stuff you're mentioning can't be secured by any user action, even in theory. The issue with the FBI-vs-Apple encryption situation is that the device itself can be secured, at least in theory, if the user memorizes a strong key (pay no attention to the "secure enclave" style of key escrow authenticated with a PIN or fingerprint, that's snake oil and will always be backdoorable!) and the hardware doesn't intercept the key entry (which, yeah, is sort of a hole). And devices that refuse to implement any encryption at all, like Amazon's, need to be avoided.
- toyg 11y ago
  That depends on how services use data -- if they encrypt every bit touching an EC2 instance, then the NSA only gets a whole lot of very-hard-to-crack files. But I agree with the overall feeling. European developers already know (or should know) that the AWS model was tarnished by the PATRIOT Act pretty much since its inception, from a legal standpoint. If your data is handled by a US company, be it on US soil or anywhere else, the US government can get it at any time (without even the need to involve NSA-level skills) and nobody will be allowed to tell you. To be fair, in any other circumstance your data is just fair game for any NSA operation, so in practice you're basically screwed no matter what, but at least you can try to give them a challenge.

It makes it harder to know what other devices and software to buy, though. If you (like some comments in here imply they do) assume that the entirety of Amazon is compromised, you'll have to stop using Netflix, since they're hosted at Amazon. You'll have to stop using Reddit, since they're at Amazon. You'll have to stop using almost all the popular apps, since they're most likely on Amazon. And if Amazon is compromised by an external attacker, you have to assume AWS is compromised as well. It's more difficult to drop Amazon than you might think.

zokier 11y ago
OP was talking about devices, not services.
- freehunter 11y ago
  Obviously. But where is the difference? If the NSA is reading your texts through the physical phone hardware or reading them off the wire, it's the same thing. In fact it's scarier if there is an encryption backdoor on their software, since it could be read remotely much easier. If Amazon hardware is compromised, there's no reason to assume their AWS platform isn't compromised. And that puts a backdoor in a lot of web applications.
tehwebguy 11y ago
There's a wide difference between my Netflix habits and every bit of personal data on my device, but that gap is probably closing as more sites use AWS
ajross 11y ago
That's sort of misunderstanding the threat model. Data in the "cloud" has always been subject to surveillance and seizure. It's not covered by the "encryption" stored on your local device (except in specific ways for specific apps). No one is saying "drop amazon" in this context, because the stuff you're mentioning can't be secured by any user action, even in theory. The issue with the FBI-vs-Apple encryption situation is that the device itself can be secured, at least in theory, if the user memorizes a strong key (pay no attention to the "secure enclave" style of key escrow authenticated with a PIN or fingerprint, that's snake oil and will always be backdoorable!) and the hardware doesn't intercept the key entry (which, yeah, is sort of a hole). And devices that refuse to implement any encryption at all, like Amazon's, need to be avoided.
toyg 11y ago
That depends on how services use data -- if they encrypt every bit touching an EC2 instance, then the NSA only gets a whole lot of very-hard-to-crack files. But I agree with the overall feeling. European developers already know (or should know) that the AWS model was tarnished by the PATRIOT Act pretty much since its inception, from a legal standpoint. If your data is handled by a US company, be it on US soil or anywhere else, the US government can get it at any time (without even the need to involve NSA-level skills) and nobody will be allowed to tell you. To be fair, in any other circumstance your data is just fair game for any NSA operation, so in practice you're basically screwed no matter what, but at least you can try to give them a challenge.