17 ms·

If this was the case, I think we would have had some amazon whistleblower already blow this info and would be widely reported on.

taormina 8y ago
I'm not accusing Amazon or anyone else of anything in particular. I'm just reminding people that even if you encrypt all of your data at rest, that at a minimum, every service provider of something like AWS is collecting plenty of metadata about your data. They have to. How else can they tell where your data is and track how much they need to charge you?
- NicoJuicy 8y ago
  In short, you have nothing to prove it. Sorry, but : > How else can they tell where your data is and track how much they need to charge you? You say companies need to track metadata for pricing and they don't know where your data is without tracking? Huh. I mean, that answer is surreal. I thought you had a console to set everything up and pricing is based on cost + wanted profit. AWS was like something of 33% profit. Nothing of their pricing is based on GA :p ( like wtf)
- busymom0 8y ago
  > How else can they tell where your data is and track how much they need to charge you? Are you being serious with this question? Regardless of whether they look at your data behind the scenes without telling you or not, you don't need to know what type of exact data and metadata you have to charge you. My AWS bill charges me for CPU hours uptime for the server, network requests, load balancing etc. None of this needs them to know your data or even exactly much metadata (other than what domain and server to route to obviously but that's public information anyway). By your logic, if someone is using end to end encryption, are you saying Amazon wouldn't be able to charge them because they can't look at the encrypted data?
  - taormina 8y ago
    I was thinking more about S3, where I know for a fact that are charging on a per-request basis and a volume basis. Amazon can and should absolutely charge them irrespective of the contents of the blob of data, and regardless of whether they read it or not, my point is encrypt it if you're worried.
    - busymom0 8y ago
      Oh yea, I totally agree with the "encrypt it if you're worried" part. In my opinion, if you have any user sensitive info, you should absolutely use end to end encryption and ssl etc.
luckylion 8y ago
I agree, it probably hasn't happened. Yet, that is. It might next year, and we might have a whistle blower then.
- busymom0 8y ago
  I agree with that. Something like that could happen. Question is, how do we stop it? This reminds me of when Facebook owned Parse dot com and a lot of developers used parse for storing user data. Given Facebook's track record with privacy, I won't be surprised if they used it.
  - luckylion 8y ago
    My personal stance it to just make it harder. Encrypt the data, use your own server so there's less metadata. Of course, even then, if the data center company really wanted to and really was happy to break the law and really went deep into the attack, they could probably find a way to get to the data. But it's much harder, much more illegal and even they will certainly think longer before doing that vs "just copy the data and don't tell anyone" if it's in plain text on their machine. It's more work to do it this way and forsake the convenience provided by Amazon & Co, but I prefer it. Plus I learn lots of things while doing it which I would've outsourced otherwise. There's also the problem that Amazon might stay 100% truthful and trustworthy and never access my data. But their employees might not. The NSA's surveillance data was misused by employees to stalk romantic interests, so there's no reason to believe that an Amazon employee couldn't wrongfully do the same. They might be fired for it, but the damage is done, privacy has been compromised.

taormina 8y ago

I'm not accusing Amazon or anyone else of anything in particular. I'm just reminding people that even if you encrypt all of your data at rest, that at a minimum, every service provider of something like AWS is collecting plenty of metadata about your data. They have to. How else can they tell where your data is and track how much they need to charge you?

NicoJuicy 8y ago
In short, you have nothing to prove it. Sorry, but : > How else can they tell where your data is and track how much they need to charge you? You say companies need to track metadata for pricing and they don't know where your data is without tracking? Huh. I mean, that answer is surreal. I thought you had a console to set everything up and pricing is based on cost + wanted profit. AWS was like something of 33% profit. Nothing of their pricing is based on GA :p ( like wtf)
busymom0 8y ago
> How else can they tell where your data is and track how much they need to charge you? Are you being serious with this question? Regardless of whether they look at your data behind the scenes without telling you or not, you don't need to know what type of exact data and metadata you have to charge you. My AWS bill charges me for CPU hours uptime for the server, network requests, load balancing etc. None of this needs them to know your data or even exactly much metadata (other than what domain and server to route to obviously but that's public information anyway). By your logic, if someone is using end to end encryption, are you saying Amazon wouldn't be able to charge them because they can't look at the encrypted data?
- taormina 8y ago
  I was thinking more about S3, where I know for a fact that are charging on a per-request basis and a volume basis. Amazon can and should absolutely charge them irrespective of the contents of the blob of data, and regardless of whether they read it or not, my point is encrypt it if you're worried.
  - busymom0 8y ago
    Oh yea, I totally agree with the "encrypt it if you're worried" part. In my opinion, if you have any user sensitive info, you should absolutely use end to end encryption and ssl etc.

luckylion 8y ago

I agree, it probably hasn't happened. Yet, that is. It might next year, and we might have a whistle blower then.

busymom0 8y ago
I agree with that. Something like that could happen. Question is, how do we stop it? This reminds me of when Facebook owned Parse dot com and a lot of developers used parse for storing user data. Given Facebook's track record with privacy, I won't be surprised if they used it.
- luckylion 8y ago
  My personal stance it to just make it harder. Encrypt the data, use your own server so there's less metadata. Of course, even then, if the data center company really wanted to and really was happy to break the law and really went deep into the attack, they could probably find a way to get to the data. But it's much harder, much more illegal and even they will certainly think longer before doing that vs "just copy the data and don't tell anyone" if it's in plain text on their machine. It's more work to do it this way and forsake the convenience provided by Amazon & Co, but I prefer it. Plus I learn lots of things while doing it which I would've outsourced otherwise. There's also the problem that Amazon might stay 100% truthful and trustworthy and never access my data. But their employees might not. The NSA's surveillance data was misused by employees to stalk romantic interests, so there's no reason to believe that an Amazon employee couldn't wrongfully do the same. They might be fired for it, but the damage is done, privacy has been compromised.