3 ms·
> in the entire history of the bucket no request was logged other than from the intended clients This sounds sort of like dumb luck. It just means no one was l
by alpha_squared 9y ago
> in the entire history of the bucket no request was logged other than from the intended clients
This sounds sort of like dumb luck. It just means no one was looking for it, that doesn't mean it's secure. This all reminds of me of the xkcd about making passwords that are easy for computers to guess and hard for people to remember[0].
Your security on buckets should be the bucket policy/permissions themselves, not the arbitrary naming of them. Security by obscurity is rarely secure and more about the illusion of security.
[0] https://xkcd.com/936/ https://xkcd.com/936/
- jcims 9y agoI couldn't agree more with your second point, but risk is usually considered the product of likelihood and impact. If I name my bucket 'bestbuy' vs '4fc6-43b0-bc19-75fe07e06133', the likelihood that some random is going to find my bucket increases dramatically.
- onion2k 9y agoThe chance of it being found by someone guessing the name would increase dramatically. The chance of it being found by someone running a script that searches for buckets using DNS logs, code searches, etc would be the same. Hackers don't often try to guess things. They run scripts. That's why it doesn't matter what you call the bucket.