3 ms·

Maybe it's in the context of a malware?

mtgx 10y ago
It's possible, but I think they could've been a lot more clear about that. With what they're saying now, they're leaving things in a pretty grey area, which is not good for developers thinking of building "good" apps that use encryption. An app like Cryptomator may use Amazon Drive APIs to encrypt data before it arrives in the Amazon Drive. Does that cover Cryptomator? Well, we don't know, because it's so vague. It could also very well be a purposeful thing, if Amazon wants to data mine all the backed-up data. Plus, it may want to make it easier to give the data to law enforcement (or not get in trouble itself for having that data stored in an encrypted form), and so on.
- roflchoppa 10y ago
  Is that within the T&C for using Amaxon cloud services? Do you give up your clients privacy for amazon to be able to read and use information that hits their disks?
informatimago 10y ago
No, it's in the context of Amazon Drive applications: "With our updated RESTful API and SDKs for Android and iOS, Amazon Drive is moving to an invite-only developer offering to ensure we can provide a consistently viable service available for supported use-cases." Clearly, they want to be able to spy user data. You can easily summary this list of restrictions to: DO NOT WRITE Amazon Drive APPLICATIONS! (At least if you care for your customer). Personnaly, I would never write an application that would not encrypt user data, including user credentials. Basically, most services don't even need to know who their users are (unless you implement dumb password recovery scheme that requires you to send an email to the user, you just don't need ever to know anything more than a hash instead of an email in the clear!).
- rileytg 10y ago
  what's a not dumb scheme?
- rileytg 10y ago
  what's a not dumb scheme?
ashark 10y ago
It's probably: 1) they'd rather encryption didn't become widespread on the service because they want to spy on users (users encrypting things themselves is still fine, they say) 2) they don't want support calls from people who've lost really important files because your crappy app lost their key, and/or because the user lost it, because typical users cannot and never will be able to handle manual key management, but if you encourage them to do it they might try.
- cwilkes 10y ago
  I also wonder if it could also be that if Amazon is subpoenaed for your files and they hand over an encrypted binary the government will then ask for it to be unencrypted. When Amazon says they can't do it they will ask for the source code or a vulnerability for the software that encrypted it. That will get bounced to the developer. Does Amazon want to get into that business of selling out the people making software for them?

mtgx 10y ago

It's possible, but I think they could've been a lot more clear about that. With what they're saying now, they're leaving things in a pretty grey area, which is not good for developers thinking of building "good" apps that use encryption. An app like Cryptomator may use Amazon Drive APIs to encrypt data before it arrives in the Amazon Drive. Does that cover Cryptomator? Well, we don't know, because it's so vague. It could also very well be a purposeful thing, if Amazon wants to data mine all the backed-up data. Plus, it may want to make it easier to give the data to law enforcement (or not get in trouble itself for having that data stored in an encrypted form), and so on.

roflchoppa 10y ago
Is that within the T&C for using Amaxon cloud services? Do you give up your clients privacy for amazon to be able to read and use information that hits their disks?

informatimago 10y ago

No, it's in the context of Amazon Drive applications: "With our updated RESTful API and SDKs for Android and iOS, Amazon Drive is moving to an invite-only developer offering to ensure we can provide a consistently viable service available for supported use-cases." Clearly, they want to be able to spy user data. You can easily summary this list of restrictions to: DO NOT WRITE Amazon Drive APPLICATIONS! (At least if you care for your customer). Personnaly, I would never write an application that would not encrypt user data, including user credentials. Basically, most services don't even need to know who their users are (unless you implement dumb password recovery scheme that requires you to send an email to the user, you just don't need ever to know anything more than a hash instead of an email in the clear!).

rileytg 10y ago
what's a not dumb scheme?
rileytg 10y ago
what's a not dumb scheme?

ashark 10y ago

It's probably: 1) they'd rather encryption didn't become widespread on the service because they want to spy on users (users encrypting things themselves is still fine, they say) 2) they don't want support calls from people who've lost really important files because your crappy app lost their key, and/or because the user lost it, because typical users cannot and never will be able to handle manual key management, but if you encourage them to do it they might try.

cwilkes 10y ago
I also wonder if it could also be that if Amazon is subpoenaed for your files and they hand over an encrypted binary the government will then ask for it to be unencrypted. When Amazon says they can't do it they will ask for the source code or a vulnerability for the software that encrypted it. That will get bounced to the developer. Does Amazon want to get into that business of selling out the people making software for them?