4 ms·

Isn't this just shifting partly your trust from Slack to Amazon?

by amaccuish 8y ago

bastawhiz 8y ago
If Slack is hosted on AWS to begin with, you were already trusting Amazon.
- 420codebro 8y ago
  I see your point but it is slightly flawed. Slack has a relationship with a customer. AWS in theory does not.
sbjustin 8y ago
While the encryption keys would be at amazon the slack data would be on "slack's servers" (AWS or elsewhere) meaning that both slack and AWS location of the keys would have to be compromised and then somehow associated to each other.
fearbeer 8y ago
I think it's very smart of Slack. AWS Encryption SDK[1] is a well designed, battle tested data encryption library. Amazon KMS is a well audited service used by AWS to manage all sorts of keys and even supports external HSM integration. For slack to build all this from the ground up would be time consuming. Hard part being 3rd party validation, penetration testing and certification. [1]: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/introduction.html https://docs.aws.amazon.com/encryption-sdk/latest/developer-...
- jcims 8y ago
  Yeah I don't really care about Slack, it's banned at work. However, this pattern is good and IMHO should be adopted by SaaS orgs that want to appeal to enterprise/regulated customers. We have a few vendors that we're sort of pressing in this direction, and a few have come to us with similar architectural proposals to address GDPR. Specific to AWS it would be even better of the service allowed for the customer to host the CMK in their own account so they can choose to import key material if they like. This has some downstream implications on what you can do with the key vs. Amazon-generated CMK which may be advantages in some cases.
  - dlgeek 8y ago
    > Specific to AWS it would be even better of the service allowed for the customer to host the CMK in their own account so they can choose to import key material if they like. Looks like it does, based on https://aws.amazon.com/blogs/apn/control-access-to-your-data-with-slack-enterprise-key-management-and-aws-kms/ https://aws.amazon.com/blogs/apn/control-access-to-your-data... "With Slack EKM, you can use KMS in your own AWS account to create a Customer Master Key (CMK) that always stays under your control. Then, using key policies, you grant Slack access to use your CMK to generate and decrypt data keys."
    - jcims 8y ago
      That's cool! Thank you for digging into it.
- cheeze 8y ago
  Amazon isn't perfect, but I sure as hell trust Amazon KMS more than most others out there.
- jiveturkey 8y ago
  > Hard part being 3rd party validation, penetration testing and certification. Hard part?? That's just the laborious part. The hard part is in building an actually secure service.
sullivanmatt 8y ago
Enterprise customers want the ability to pull their keys and walk away from a platform, sometimes with very little notice. A made-up example: assuming Brexit occurs, EU customers of a London-based SaaS chat service may no longer wish to keep that data outside of the EU. The easiest way to wipe it out quickly? Pull the key. Or perhaps your government is trying to compel you to produce data that you believe they have no right to. Some companies would rather have the option to destroy it and face the consequences, whatever they may be.

Isn't this just shifting partly your trust from Slack to Amazon?

bastawhiz 8y ago

If Slack is hosted on AWS to begin with, you were already trusting Amazon.

420codebro 8y ago
I see your point but it is slightly flawed. Slack has a relationship with a customer. AWS in theory does not.

sbjustin 8y ago

While the encryption keys would be at amazon the slack data would be on "slack's servers" (AWS or elsewhere) meaning that both slack and AWS location of the keys would have to be compromised and then somehow associated to each other.

fearbeer 8y ago

I think it's very smart of Slack. AWS Encryption SDK[1] is a well designed, battle tested data encryption library. Amazon KMS is a well audited service used by AWS to manage all sorts of keys and even supports external HSM integration. For slack to build all this from the ground up would be time consuming. Hard part being 3rd party validation, penetration testing and certification. [1]: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/introduction.html https://docs.aws.amazon.com/encryption-sdk/latest/developer-...

jcims 8y ago
Yeah I don't really care about Slack, it's banned at work. However, this pattern is good and IMHO should be adopted by SaaS orgs that want to appeal to enterprise/regulated customers. We have a few vendors that we're sort of pressing in this direction, and a few have come to us with similar architectural proposals to address GDPR. Specific to AWS it would be even better of the service allowed for the customer to host the CMK in their own account so they can choose to import key material if they like. This has some downstream implications on what you can do with the key vs. Amazon-generated CMK which may be advantages in some cases.
- dlgeek 8y ago
  > Specific to AWS it would be even better of the service allowed for the customer to host the CMK in their own account so they can choose to import key material if they like. Looks like it does, based on https://aws.amazon.com/blogs/apn/control-access-to-your-data-with-slack-enterprise-key-management-and-aws-kms/ https://aws.amazon.com/blogs/apn/control-access-to-your-data... "With Slack EKM, you can use KMS in your own AWS account to create a Customer Master Key (CMK) that always stays under your control. Then, using key policies, you grant Slack access to use your CMK to generate and decrypt data keys."
  - jcims 8y ago
    That's cool! Thank you for digging into it.
cheeze 8y ago
Amazon isn't perfect, but I sure as hell trust Amazon KMS more than most others out there.
jiveturkey 8y ago
> Hard part being 3rd party validation, penetration testing and certification. Hard part?? That's just the laborious part. The hard part is in building an actually secure service.

sullivanmatt 8y ago

Enterprise customers want the ability to pull their keys and walk away from a platform, sometimes with very little notice. A made-up example: assuming Brexit occurs, EU customers of a London-based SaaS chat service may no longer wish to keep that data outside of the EU. The easiest way to wipe it out quickly? Pull the key. Or perhaps your government is trying to compel you to produce data that you believe they have no right to. Some companies would rather have the option to destroy it and face the consequences, whatever they may be.