9 ms·

AWS doesn’t know who I am

125 points by kiyanwang 5y ago

yellow_lead 5y ago
I'm not sure this is actually a good idea. Do I want AWS to contact me about my work account via my personal account? Do I want to get my personal card charged for work expenses or vice versa? I don't see what types of configuration would be useful to keep across accounts.
aoms 5y ago
No thank you
Canada 5y ago
I don't agree at all. I don't want to use the same account across multiple organizations.
- jon-wood 5y ago
  And even if you did, that can be done via federated auth in IAM.
saba2008 5y ago
Idea of some grouping tool, orthogonal to security and account managment, used to store personal preferences/notification settings/social network links sound reasonable. Idea of 'identity for the human' reeks of ghastly surveillance and control. AWS has no business with 'the human', only with client - it's not my family, it's not my friend, it's not a law enforcing state with monopoly for violence.
zamaterian 5y ago
Madness, if you get blocked by aws in one of their accounts. Wave good by to all the other accounts
- goforbg 5y ago
  Exactly. I don't want this for the exact same reason.
- anilakar 5y ago
  It's also possible to get your personal GMail account banned after someone at your company breaks Google ToS: https://www.reddit.com/r/tifu/comments/8kvias/tifu_by_getting_google_to_ban_our_entire_company/ https://www.reddit.com/r/tifu/comments/8kvias/tifu_by_gettin... For the few Google products we use at work, like Calendar, we make sure that people do not register with their existing personal accounts but use their work email address.
  - bbarnett 5y ago
    Isn't having more than one Gmail account a violation too?
    - sokoloff 5y ago
      I don’t think so. We have a family gmail account (mostly for a shared calendar) and Google has explicit ways to use more than one account. https://support.google.com/accounts/answer/1721977?co=GENIE.Platform%3DAndroid&hl=en https://support.google.com/accounts/answer/1721977?co=GENIE....
    - nl 5y ago
      It's not a violation to have more than one Google Account - there is the (pretty horrible) account switcher for that scenario.
      - bbarnett 5y ago
        Do you mean the login screen with a list of accounts, used from the browser? Or Android's multiple accounts ability? That doesn't mean more than one account per person is OK though. Just the reality than more than one person may share a device.
StreamBright 5y ago
Sorry, but I disagree. The less any of these FAAMNG companies know about me or the identities I use is the better.
cagataygurturk 5y ago
The author is looking for Google Cloud‘s IAM architecture.
- larrybud 5y ago
  Or Azure Active Directory (AAD)
YPPH 5y ago
Some of these are legitimate grievances but it seems quite reasonable to have separate accounts for work and play. What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. They aren't equals. The services share the name of a rainforest and a very rich CEO but that's about where the similarities end for my part. I'd rather not have to plug in my AWS root account credentials when I get the urge to impulse buy a robotic vacuum cleaner.
- Galanwe 5y ago
  > What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. This bite me hard last year... I lost my phone and with it my MFA for the root account, and of course forgot to properly backup the MFA seed. Now when calling AWS support to get back my accesses, they ask me to prove ownership of my Amazon.com account with the same email... Which is like 15 years old. I changed phone number, address, country dozens of times since then. Apparently I would have to get back to my home country and ask a notary to sign a paper asserting I am really me to get back my accesses. Nightmare.
  - danielheath 5y ago
    As you have learned, setting up 2fa for an important service isn’t something to be done lightly. My current setup is two yubikeys (one in storage, one in my computer) and OTP on my phone. Failure is still possible but it’s unlikely enough for me.
    - smt88 5y ago
      I'd love to do this, but many services still only support SMS or don't support multiple hardware keys.
- imwillofficial 5y ago
  These are two different sets of Creds, or should be.
lexicality 5y ago
This is very interesting because it comes from the perspective of someone who cares so much about what they do at work that it bleeds into their personal life. > never hear about WorkDocs rolling out a feature to the Frankfurt region — unless you’re using WorkDocs in Frankfurt Personally I'd hate that. Send that info to my work email account for sure, but my private one? No way! If I'm not currently being paid to think about my job, nothing should be trying to remind me of its existence.
justincormack 5y ago
We overuse identity as an important thing in computing. AWS does have problems with IAM of course, but we need to accept that adding human identities everywhere in what is largely a system of computers and applications talking to each other is a security mistake, we need the fine grained delegation of access control, and capabilities. Just because I control some aspect of a program does not imbue it with any sense of my identity. Roles, capabilities, all these are more important than identities. They should be able to talk to you as a person for marketing or conferences yeah, thats a different thing.
politelemon 5y ago
Article fails to explain why that's a problem. From a security standpoint, this separation is necessary and beneficial.
nikanj 5y ago
The downside of One True Identity is getting your startup data deleted from account A because account B was booted from Google for unclear TOS violation. Usually these issues can only get resolved by getting your blog post to HN
- blunte 5y ago
  Do they? We heard the cries for help, and we assume in most cases a Googler here on HN champions the caller. In fact, I'd like to see some metrics, a transparency report of false positive blocks/deletions which were reversed. But indeed, I absolutely do not want my personal projects to be related in any way to my work projects, nor vice versa.
  - thanksforfish 5y ago
    Surely there are people getting banned from Google who are not HN users. Social media outcry is not a good solution as its not accessible to everyone. Agreed about wanting to see more transparency.
  - profmonocle 5y ago
    The fact that these stories go viral as often as they do suggests false positives are pretty common, and that the standard support channels are really, really bad at dealing with them. Whenever I read a story like this, complaining on social media was the company/user's desperate last resort, not their first step. For every user who gets saved by someone at Google seeing their story on HN or Twitter, how many users stay permabanned because they just aren't social media savvy enough (or lucky enough) to get traction? I would guess that the majority of false positive bans never get resolved.
- profmonocle 5y ago
  There was a horror story on Reddit a few years back, cross-posted to HN, where a single employee got their entire company's G Suite account banned for violating some Play Store policy using their work account. (as a consumer, not a dev) The horrifying part was that Google went on to ban every employee's personal account as well because they were "linked" to an account that was banned for TOS violations. Imagine losing access to your email, Android apps, and photo library because a coworker you may not even know broke some TOS. A Google employee entered the thread and said they were investigating, but notably ignored anyone asking "is it really Google's policy to ban people's personal accounts if their employer gets banned?" I was pretty happy when my company switched from G Suite to Office 365. (Amazon allegedly isn't free of these "guilt by association" practices - I've heard stories of people getting permabanned from Amazon because their roommate or family member returned too much stuff, since the delivery address was the same.)
yarcob 5y ago
It's good that every service has separate credentials. For a counterexample, consider Apple and how they try to restrict you to a single Apple ID. They want everything to be tied to a single person. Every service you use is tied to your Apple ID. It just doesn't match the way that people use computers. For example, I get my computer games and business software billed to the same card, and there's no easy way to change that. Somehow the app store "helpfully" installed a baby monitor app that I use at home on my work computer. We set up a Mac as build server in the office. It's shared by multiple people. I need to log in with my personal credentials to download software from the Mac App store. My girlfriend bought an iPad for the kids to watch TV. It's shared by a couple of people. She had to log in with her Apple ID to set it up, and now her personal iMessages and emails are on it. It's stupid. Some of these problems can be fixed, but it's really annoying.
- e40 5y ago
  My son wanted to login to the desktop AirBnB because I wanted a PDF of a receipt, which he couldn't get on mobile. He logged in using his Google account on his phone. On his Windows and Mac laptops, with Chrome and Firefox he got errors. He just couldn't login. We cleared cookies, everything. Rebooted. Nothing would fix it. Of course, to start a chat with aBnB you need to login... So, I agree. Every service should have separate credentials.
- wisty 5y ago
  Or see people who "spammed" emotes into a Youtube livestream getting caught by spam detection and locked out of gmail.
  - teddyh 5y ago
    And, IIRC, they only did it because the YouTube streamer (i.e. the channel host) asked them to do it!
- amelius 5y ago
  Yes, Apple ID is like a cookie that you can't delete. My solution: use Linux :)
ggm 5y ago
Whatever the identity tuple is with Amazon it's deeply confusing. I think it's possible to have: frobiz@example.com password A frobiz@example.com password B Work, and be two different accounts. It's scary.
- scrollaway 5y ago
  Because they're namespaced by which AWS account you connect to, same as Slack and many more enterprise products. You don't have an AWS account. You have an IAM identity and credentials for an AWS account. Except for the root account where what you described is never the case.
  - ggm 5y ago
    I absolutely do think that reasonable ordinary people find this situation confusing. As do password managers. IAM identity is not exactly a widespread understood concept. I doubt if most people entirely "get" the distinction. Google (our instance) pretty much forbids crossbinding like this. I've had non google accounts refused as bootstrap identity in ads and gke because they were just used elsewhere on Google for authorising access. I'm reluctant to delete duplicate Amazon entries in 1password and bitwarden in case I still need them, for some distinct IAM.
    - scrollaway 5y ago
      You should be deleting IAM identities you do not use. At the source, not just from the password manager but actually deleting the accounts/secret keys/passwords/whatever. Also AWS isn't exactly for "reasonable ordinary people", it's a tool that requires some minimum amount of training. Yes the concept isn't super widely used for end user applications (although 1Password is a good example of another such "you have an account on an instance, that is unrelated to your account with the same email on another instance" concept). And yeah I do wish password managers would handle that better, but for anything that uses subdomain-level separation (example.1password.com vs amazon's signin.aws.amazon.com with multiple fields), it generally works out fine.
- justincormack 5y ago
qxmat 5y ago
As an independent software contractor I could say the same about Microsoft's Partner Network. Unless I sit a myriad of different exams I can't advance my competency to Silver or Gold. This means my MPN default "Partner" benefit is restricted Azure AD Basic and I can't take a parallel Azure DevOps build with me to a new project. Worst still, if I leave my MS Gold Partner for a start-up I'll lose access to the enterprise elements of Azure AD (SCIM integration, Azure AD Application Proxy etc). If I'm called out to support something I delivered I'll need to absorb the cost of upgrading my Azure AD subscription.
DominikD 5y ago
I'm reading the comments and it looks like many people forgot to read the piece before commenting on it. Yes, separate credentials are good, he states that in the article. That's not what he's asking for either. He's aware of IAM, he's a user, and it's also stated in the article on several occasions.
psanford 5y ago
Sounds like a problem if you are an AWS Serverless Hero, but for the rest of us I think there is comfort in the fact that AWS identities are not a massive privacy invasion.
- bluehatbrit 5y ago
  This was exactly my thinking when I read through it. I don't even really care about shared pinned services, my day job and side projects use different services for the most part. None of the benefits explored will have much impact to me, and I use AWS almost every day for one reason or another. If anything it just gives me another place where I can't keep work and home separate. I don't want another "Atlassian" where suddenly my work own my account because I had a work email attached to it, and can close it at will.
blunte 5y ago
Hope you get what you want, but I hope it's an opt-in because I do not want it. Depending on the service, I probably do not want to be ME + sub-identities. While a good sleuth (or algorithm) with enough data can probably connect me to all the different services I use/manage, I don't necessarily want that information to be public. And if it exists in a database somewhere, it will likely eventually become public.
tyingq 5y ago
I especially don't want AWS to tie my personal stuff to my work stuff. That would mean my work would then credibly have some rights over my personal stuff.
selfhoster11 5y ago
Absolutely no. I present different facets of my personality in different circumstances, because not everyone needs to know, or wants to know, everything about me. Work, family, public profiles, private chat and entirely personal spaces are separate for a reason. I don't talk about tech in too much depth with most of my family, and neither do I share my home address with everyone who checks my LinkedIn page. Binding these personality facets into a single person also has the disadvantage that if my account gets banned in one social context, the repercussions will touch the other contexts too. Will an oversensitive PC/abuse filter on one service ban me from all my Amazon-based access? I don't know, let's YOLO and find out.
- kalium-xyz 5y ago
  They wont as of yet.
- SilasX 5y ago
  Yes! This was exactly the premise of my April Fools joke this year, where I imagined that Google would stop doing authentication challenges, because they already know who you are and which identities you use from all that tracking: http://blog.tyrannyofthemouse.com/2021/04/leaked-google-initiative-no-more.html http://blog.tyrannyofthemouse.com/2021/04/leaked-google-init...
toss1 5y ago
Yes, that's a lovely idea. EXCEPT for the absolutely abysmal "customer service" and "issue resolution" provided by the likes of Amazon, Google, FB, etc. (as if those so-called services even rise to the level of the ordinary defnitions). IFF they provided real humans, with real time and authority to look into and resolve issues, this might be a good idea. But since, in the real world, their business model is obviously to provide only the most superficial figment of anything resembling an ability to resolve issues, any such linkage would be absolutely terrifying. Any inadvertent slipup, or even getting innocently hacked already result in disastrous loss of access to your own data and privs. Just today, there's an HN story of such an unrecoverable loss on FB & Oculus [1] The only solution in light of these hostile policies on the part of FAANGs and other big tech companies is maximum fragmentation/segmentation/sharding of accounts. (I've already passed on invitations for an Amazon Biz acct, despite the fact that it might be quite useful for my biz, for exactly these reasons.) Edit: add ref for [1] https://news.ycombinator.com/item?id=28249977 https://news.ycombinator.com/item?id=28249977
turminal 5y ago
More megacorps knowing who I am? No thanks.
lovetocode 5y ago
I disagree. I think compartmentalization is important.
deleted 5y ago
[deleted]
zomiaen 5y ago
This is essentially the classic "internet ID" proposal that's been floated around for a few years, which universally has been regarded as a bad idea.
kodah 5y ago
AWS doesn't deserve that kind of responsibility, no tech giant does. I'm surprised anyone would propose that without considering the consequences of this statement: The richest man in the world now controls the idea of your identity. I will give crayons to every angry third grader willing to color all over that idea until it is unrecognizable. Real cryptography based identities with derived keys are possible. PGP allows this today. With some organization you could use PGP with twice derived keys for various identities that can be corralled under a single identity. Again, all possible today for the aspiring entrepreneur. What I think will be infinitely tricky is creating an organization that is international to manage them without influence. They can't be beholden to a single nation or continent. Being able to be influenced by any nation would need to be a P1 bug in the corporate architecture. You'd need a stupidly secure facility with offline data gaps, the kind that are proposed for things like SCADA. Anyway, I've thought about this problem a good bit over the years. I'm interested in others thoughts.
0xbadcafebee 5y ago
For those not reading the article: the purpose is to have better customer engagement, not to affect security or privacy in any way. They have a fractured ecosystem (customer-wise) and it makes people's lives annoying. (It's also a missed opportunity to simplify business intelligence) The benefit to you, the consumer, is deeper connection to the AWS ecosystem. Your contributions can be tracked on a dashboard and added to a virtual resume, so you don't have to list every god damn service and account you've worked with in your resume. You can more easily contact support across accounts and services, forums, etc. If you've ever gone, "shit, in what account/region did I use that one S3 feature before?", you could look it up in your global user history. It's the same thing as having one GitHub account that lists all your contributions across orgs/repos. You can always create another GitHub account linked to another key/email/identity. Solving this is a good idea, and can be done without much technical work, but it won't be, because of their business model. This is what Google already does: all your "stuff" is linked to a Google account across all their products/services, because their bread and butter is knowing who "you" are everywhere, so they can make money off "you". AWS doesn't care who "you" are because (outside of Amazon Prime) they don't make money off "you", they make money when you pay them. Very different business model. There's effectively no business case to track "you" everywhere, so they're not going to put in the work. But actually, this could be solved easily with PGP keys and a database of databases. Add your public key to every system that AWS has (or they can add it for you, based on your email address). They can look up your general information in any public key server. And if they need verification of who you are, just send them a signed E-mail or file or something. It would be tedious to do this manually for every service, so they can architect some internal service to map public keys to internal services to hopefully get the human validation part down to just one time.
nitwit005 5y ago
Every service that knowns something about your identity has the potential to leak it due to a security problem. It's better to just not have access. This also seems like an IT headache. If you tie an identity to some test user, it has to get cleaned up somehow if you leave the job.
ed-209 5y ago
I clicked this wanting to ensure that AWS continues not knowing who I am. Apparently this person's issue is being too anonymous in the eyes of Bezos...a strange complaint indeed.
Sanguinaire 5y ago
To see how this can go tragically badly, try using MS Teams with one login address across multiple client accounts.
mvaliente2001 5y ago
I've always thought that AWS conceptual model and implementation is a big mess. Root accounts different from other account, big numbers & ARNs exposed to the user, meaningless names for services, multiple names for same concepts (do I need to say Ireland-1 or is it eu-east-1?). It's inhuman and overly complex. I assume people hasn't revolted because that baroque and unnecessary obfuscation feeds a lot of consultants whose time could have been cut significantly have Amazon had someone to think before implementing such monstrosity.
jiggawatts 5y ago
A lot of people are comparing AWS identities to G Suite or Apple ID. A better, more apples-to-apples comparison would be Azure Active Directory. A single AAD account enables access to: Azure DevOps, Microsoft 365 collaboration apps, remote desktop logins to servers, virtual desktops, and a bunch of other stuff. It certainly is very convenient, but the downside is that a global outage of AAD takes down a lot of things all at once. For example, AAD system-managed identities are used as a type of "service account" in Azure. This means that web apps can lose access to their HTTPS certificates stored in Key Vault because AAD is down, causing massive outages. In theory, AAD has a "read-only delayed replica" as a fallback, but in practice this hasn't worked. This is actually one of the core "philosophical" differences between AWS and Azure. The former values completely distinct services with no (or minimal) interdependencies, the latter values integrated, cohesive architectures. In my experience Azure's approach is more convenient but more fragile. Conversely, AWS is more robust but can be super irritating for end-users.
liquidexil 5y ago
I feel like this doesn't consider the massive upside to IAM roles as identities. Once a user is a top-level concept, there will be things that only users can do. When everything is a role, an action can be taken by a user or an autonomous system in the exact same way. I don't think this was an accident. Internally, Amazon traditionally had very different methods for authenticating and authorizing users versus systems, and it was a massive pain. Switching to IAM roles relieved some massive pain-points.

125 points by kiyanwang 5y ago

I'm not sure this is actually a good idea. Do I want AWS to contact me about my work account via my personal account? Do I want to get my personal card charged for work expenses or vice versa? I don't see what types of configuration would be useful to keep across accounts.

aoms 5y ago

No thank you

Canada 5y ago

I don't agree at all. I don't want to use the same account across multiple organizations.

jon-wood 5y ago
And even if you did, that can be done via federated auth in IAM.

saba2008 5y ago

Idea of some grouping tool, orthogonal to security and account managment, used to store personal preferences/notification settings/social network links sound reasonable. Idea of 'identity for the human' reeks of ghastly surveillance and control. AWS has no business with 'the human', only with client - it's not my family, it's not my friend, it's not a law enforcing state with monopoly for violence.

zamaterian 5y ago

Madness, if you get blocked by aws in one of their accounts. Wave good by to all the other accounts

goforbg 5y ago
Exactly. I don't want this for the exact same reason.
anilakar 5y ago
It's also possible to get your personal GMail account banned after someone at your company breaks Google ToS: https://www.reddit.com/r/tifu/comments/8kvias/tifu_by_getting_google_to_ban_our_entire_company/ https://www.reddit.com/r/tifu/comments/8kvias/tifu_by_gettin... For the few Google products we use at work, like Calendar, we make sure that people do not register with their existing personal accounts but use their work email address.
- bbarnett 5y ago
  Isn't having more than one Gmail account a violation too?
  - sokoloff 5y ago
    I don’t think so. We have a family gmail account (mostly for a shared calendar) and Google has explicit ways to use more than one account. https://support.google.com/accounts/answer/1721977?co=GENIE.Platform%3DAndroid&hl=en https://support.google.com/accounts/answer/1721977?co=GENIE....
  - nl 5y ago
    It's not a violation to have more than one Google Account - there is the (pretty horrible) account switcher for that scenario.
    - bbarnett 5y ago
      Do you mean the login screen with a list of accounts, used from the browser? Or Android's multiple accounts ability? That doesn't mean more than one account per person is OK though. Just the reality than more than one person may share a device.

StreamBright 5y ago

Sorry, but I disagree. The less any of these FAAMNG companies know about me or the identities I use is the better.

cagataygurturk 5y ago

The author is looking for Google Cloud‘s IAM architecture.

larrybud 5y ago
Or Azure Active Directory (AAD)

YPPH 5y ago

Some of these are legitimate grievances but it seems quite reasonable to have separate accounts for work and play. What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. They aren't equals. The services share the name of a rainforest and a very rich CEO but that's about where the similarities end for my part. I'd rather not have to plug in my AWS root account credentials when I get the urge to impulse buy a robotic vacuum cleaner.

Galanwe 5y ago
> What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. This bite me hard last year... I lost my phone and with it my MFA for the root account, and of course forgot to properly backup the MFA seed. Now when calling AWS support to get back my accesses, they ask me to prove ownership of my Amazon.com account with the same email... Which is like 15 years old. I changed phone number, address, country dozens of times since then. Apparently I would have to get back to my home country and ask a notary to sign a paper asserting I am really me to get back my accesses. Nightmare.
- danielheath 5y ago
  As you have learned, setting up 2fa for an important service isn’t something to be done lightly. My current setup is two yubikeys (one in storage, one in my computer) and OTP on my phone. Failure is still possible but it’s unlikely enough for me.
  - smt88 5y ago
    I'd love to do this, but many services still only support SMS or don't support multiple hardware keys.
imwillofficial 5y ago
These are two different sets of Creds, or should be.

lexicality 5y ago

This is very interesting because it comes from the perspective of someone who cares so much about what they do at work that it bleeds into their personal life. > never hear about WorkDocs rolling out a feature to the Frankfurt region — unless you’re using WorkDocs in Frankfurt Personally I'd hate that. Send that info to my work email account for sure, but my private one? No way! If I'm not currently being paid to think about my job, nothing should be trying to remind me of its existence.

justincormack 5y ago

We overuse identity as an important thing in computing. AWS does have problems with IAM of course, but we need to accept that adding human identities everywhere in what is largely a system of computers and applications talking to each other is a security mistake, we need the fine grained delegation of access control, and capabilities. Just because I control some aspect of a program does not imbue it with any sense of my identity. Roles, capabilities, all these are more important than identities. They should be able to talk to you as a person for marketing or conferences yeah, thats a different thing.

politelemon 5y ago

Article fails to explain why that's a problem. From a security standpoint, this separation is necessary and beneficial.

nikanj 5y ago

The downside of One True Identity is getting your startup data deleted from account A because account B was booted from Google for unclear TOS violation. Usually these issues can only get resolved by getting your blog post to HN

blunte 5y ago
Do they? We heard the cries for help, and we assume in most cases a Googler here on HN champions the caller. In fact, I'd like to see some metrics, a transparency report of false positive blocks/deletions which were reversed. But indeed, I absolutely do not want my personal projects to be related in any way to my work projects, nor vice versa.
- thanksforfish 5y ago
  Surely there are people getting banned from Google who are not HN users. Social media outcry is not a good solution as its not accessible to everyone. Agreed about wanting to see more transparency.
- profmonocle 5y ago
  The fact that these stories go viral as often as they do suggests false positives are pretty common, and that the standard support channels are really, really bad at dealing with them. Whenever I read a story like this, complaining on social media was the company/user's desperate last resort, not their first step. For every user who gets saved by someone at Google seeing their story on HN or Twitter, how many users stay permabanned because they just aren't social media savvy enough (or lucky enough) to get traction? I would guess that the majority of false positive bans never get resolved.
profmonocle 5y ago
There was a horror story on Reddit a few years back, cross-posted to HN, where a single employee got their entire company's G Suite account banned for violating some Play Store policy using their work account. (as a consumer, not a dev) The horrifying part was that Google went on to ban every employee's personal account as well because they were "linked" to an account that was banned for TOS violations. Imagine losing access to your email, Android apps, and photo library because a coworker you may not even know broke some TOS. A Google employee entered the thread and said they were investigating, but notably ignored anyone asking "is it really Google's policy to ban people's personal accounts if their employer gets banned?" I was pretty happy when my company switched from G Suite to Office 365. (Amazon allegedly isn't free of these "guilt by association" practices - I've heard stories of people getting permabanned from Amazon because their roommate or family member returned too much stuff, since the delivery address was the same.)

yarcob 5y ago

It's good that every service has separate credentials. For a counterexample, consider Apple and how they try to restrict you to a single Apple ID. They want everything to be tied to a single person. Every service you use is tied to your Apple ID. It just doesn't match the way that people use computers. For example, I get my computer games and business software billed to the same card, and there's no easy way to change that. Somehow the app store "helpfully" installed a baby monitor app that I use at home on my work computer. We set up a Mac as build server in the office. It's shared by multiple people. I need to log in with my personal credentials to download software from the Mac App store. My girlfriend bought an iPad for the kids to watch TV. It's shared by a couple of people. She had to log in with her Apple ID to set it up, and now her personal iMessages and emails are on it. It's stupid. Some of these problems can be fixed, but it's really annoying.

e40 5y ago
My son wanted to login to the desktop AirBnB because I wanted a PDF of a receipt, which he couldn't get on mobile. He logged in using his Google account on his phone. On his Windows and Mac laptops, with Chrome and Firefox he got errors. He just couldn't login. We cleared cookies, everything. Rebooted. Nothing would fix it. Of course, to start a chat with aBnB you need to login... So, I agree. Every service should have separate credentials.
wisty 5y ago
Or see people who "spammed" emotes into a Youtube livestream getting caught by spam detection and locked out of gmail.
- teddyh 5y ago
  And, IIRC, they only did it because the YouTube streamer (i.e. the channel host) asked them to do it!
amelius 5y ago
Yes, Apple ID is like a cookie that you can't delete. My solution: use Linux :)

ggm 5y ago

Whatever the identity tuple is with Amazon it's deeply confusing. I think it's possible to have: frobiz@example.com password A frobiz@example.com password B Work, and be two different accounts. It's scary.

scrollaway 5y ago
Because they're namespaced by which AWS account you connect to, same as Slack and many more enterprise products. You don't have an AWS account. You have an IAM identity and credentials for an AWS account. Except for the root account where what you described is never the case.
- ggm 5y ago
  I absolutely do think that reasonable ordinary people find this situation confusing. As do password managers. IAM identity is not exactly a widespread understood concept. I doubt if most people entirely "get" the distinction. Google (our instance) pretty much forbids crossbinding like this. I've had non google accounts refused as bootstrap identity in ads and gke because they were just used elsewhere on Google for authorising access. I'm reluctant to delete duplicate Amazon entries in 1password and bitwarden in case I still need them, for some distinct IAM.
  - scrollaway 5y ago
    You should be deleting IAM identities you do not use. At the source, not just from the password manager but actually deleting the accounts/secret keys/passwords/whatever. Also AWS isn't exactly for "reasonable ordinary people", it's a tool that requires some minimum amount of training. Yes the concept isn't super widely used for end user applications (although 1Password is a good example of another such "you have an account on an instance, that is unrelated to your account with the same email on another instance" concept). And yeah I do wish password managers would handle that better, but for anything that uses subdomain-level separation (example.1password.com vs amazon's signin.aws.amazon.com with multiple fields), it generally works out fine.
justincormack 5y ago

qxmat 5y ago

As an independent software contractor I could say the same about Microsoft's Partner Network. Unless I sit a myriad of different exams I can't advance my competency to Silver or Gold. This means my MPN default "Partner" benefit is restricted Azure AD Basic and I can't take a parallel Azure DevOps build with me to a new project. Worst still, if I leave my MS Gold Partner for a start-up I'll lose access to the enterprise elements of Azure AD (SCIM integration, Azure AD Application Proxy etc). If I'm called out to support something I delivered I'll need to absorb the cost of upgrading my Azure AD subscription.

DominikD 5y ago

I'm reading the comments and it looks like many people forgot to read the piece before commenting on it. Yes, separate credentials are good, he states that in the article. That's not what he's asking for either. He's aware of IAM, he's a user, and it's also stated in the article on several occasions.

psanford 5y ago

Sounds like a problem if you are an AWS Serverless Hero, but for the rest of us I think there is comfort in the fact that AWS identities are not a massive privacy invasion.

bluehatbrit 5y ago
This was exactly my thinking when I read through it. I don't even really care about shared pinned services, my day job and side projects use different services for the most part. None of the benefits explored will have much impact to me, and I use AWS almost every day for one reason or another. If anything it just gives me another place where I can't keep work and home separate. I don't want another "Atlassian" where suddenly my work own my account because I had a work email attached to it, and can close it at will.

blunte 5y ago

Hope you get what you want, but I hope it's an opt-in because I do not want it. Depending on the service, I probably do not want to be ME + sub-identities. While a good sleuth (or algorithm) with enough data can probably connect me to all the different services I use/manage, I don't necessarily want that information to be public. And if it exists in a database somewhere, it will likely eventually become public.

tyingq 5y ago

I especially don't want AWS to tie my personal stuff to my work stuff. That would mean my work would then credibly have some rights over my personal stuff.

selfhoster11 5y ago

Absolutely no. I present different facets of my personality in different circumstances, because not everyone needs to know, or wants to know, everything about me. Work, family, public profiles, private chat and entirely personal spaces are separate for a reason. I don't talk about tech in too much depth with most of my family, and neither do I share my home address with everyone who checks my LinkedIn page. Binding these personality facets into a single person also has the disadvantage that if my account gets banned in one social context, the repercussions will touch the other contexts too. Will an oversensitive PC/abuse filter on one service ban me from all my Amazon-based access? I don't know, let's YOLO and find out.

kalium-xyz 5y ago
They wont as of yet.
SilasX 5y ago
Yes! This was exactly the premise of my April Fools joke this year, where I imagined that Google would stop doing authentication challenges, because they already know who you are and which identities you use from all that tracking: http://blog.tyrannyofthemouse.com/2021/04/leaked-google-initiative-no-more.html http://blog.tyrannyofthemouse.com/2021/04/leaked-google-init...

toss1 5y ago

Yes, that's a lovely idea. EXCEPT for the absolutely abysmal "customer service" and "issue resolution" provided by the likes of Amazon, Google, FB, etc. (as if those so-called services even rise to the level of the ordinary defnitions). IFF they provided real humans, with real time and authority to look into and resolve issues, this might be a good idea. But since, in the real world, their business model is obviously to provide only the most superficial figment of anything resembling an ability to resolve issues, any such linkage would be absolutely terrifying. Any inadvertent slipup, or even getting innocently hacked already result in disastrous loss of access to your own data and privs. Just today, there's an HN story of such an unrecoverable loss on FB & Oculus [1] The only solution in light of these hostile policies on the part of FAANGs and other big tech companies is maximum fragmentation/segmentation/sharding of accounts. (I've already passed on invitations for an Amazon Biz acct, despite the fact that it might be quite useful for my biz, for exactly these reasons.) Edit: add ref for [1] https://news.ycombinator.com/item?id=28249977 https://news.ycombinator.com/item?id=28249977

turminal 5y ago

More megacorps knowing who I am? No thanks.

lovetocode 5y ago

I disagree. I think compartmentalization is important.

deleted 5y ago

[deleted]

zomiaen 5y ago

This is essentially the classic "internet ID" proposal that's been floated around for a few years, which universally has been regarded as a bad idea.

kodah 5y ago

AWS doesn't deserve that kind of responsibility, no tech giant does. I'm surprised anyone would propose that without considering the consequences of this statement: The richest man in the world now controls the idea of your identity. I will give crayons to every angry third grader willing to color all over that idea until it is unrecognizable. Real cryptography based identities with derived keys are possible. PGP allows this today. With some organization you could use PGP with twice derived keys for various identities that can be corralled under a single identity. Again, all possible today for the aspiring entrepreneur. What I think will be infinitely tricky is creating an organization that is international to manage them without influence. They can't be beholden to a single nation or continent. Being able to be influenced by any nation would need to be a P1 bug in the corporate architecture. You'd need a stupidly secure facility with offline data gaps, the kind that are proposed for things like SCADA. Anyway, I've thought about this problem a good bit over the years. I'm interested in others thoughts.

0xbadcafebee 5y ago

For those not reading the article: the purpose is to have better customer engagement, not to affect security or privacy in any way. They have a fractured ecosystem (customer-wise) and it makes people's lives annoying. (It's also a missed opportunity to simplify business intelligence) The benefit to you, the consumer, is deeper connection to the AWS ecosystem. Your contributions can be tracked on a dashboard and added to a virtual resume, so you don't have to list every god damn service and account you've worked with in your resume. You can more easily contact support across accounts and services, forums, etc. If you've ever gone, "shit, in what account/region did I use that one S3 feature before?", you could look it up in your global user history. It's the same thing as having one GitHub account that lists all your contributions across orgs/repos. You can always create another GitHub account linked to another key/email/identity. Solving this is a good idea, and can be done without much technical work, but it won't be, because of their business model. This is what Google already does: all your "stuff" is linked to a Google account across all their products/services, because their bread and butter is knowing who "you" are everywhere, so they can make money off "you". AWS doesn't care who "you" are because (outside of Amazon Prime) they don't make money off "you", they make money when you pay them. Very different business model. There's effectively no business case to track "you" everywhere, so they're not going to put in the work. But actually, this could be solved easily with PGP keys and a database of databases. Add your public key to every system that AWS has (or they can add it for you, based on your email address). They can look up your general information in any public key server. And if they need verification of who you are, just send them a signed E-mail or file or something. It would be tedious to do this manually for every service, so they can architect some internal service to map public keys to internal services to hopefully get the human validation part down to just one time.

nitwit005 5y ago

Every service that knowns something about your identity has the potential to leak it due to a security problem. It's better to just not have access. This also seems like an IT headache. If you tie an identity to some test user, it has to get cleaned up somehow if you leave the job.

ed-209 5y ago

I clicked this wanting to ensure that AWS continues not knowing who I am. Apparently this person's issue is being too anonymous in the eyes of Bezos...a strange complaint indeed.

Sanguinaire 5y ago

To see how this can go tragically badly, try using MS Teams with one login address across multiple client accounts.

mvaliente2001 5y ago

I've always thought that AWS conceptual model and implementation is a big mess. Root accounts different from other account, big numbers & ARNs exposed to the user, meaningless names for services, multiple names for same concepts (do I need to say Ireland-1 or is it eu-east-1?). It's inhuman and overly complex. I assume people hasn't revolted because that baroque and unnecessary obfuscation feeds a lot of consultants whose time could have been cut significantly have Amazon had someone to think before implementing such monstrosity.

jiggawatts 5y ago

A lot of people are comparing AWS identities to G Suite or Apple ID. A better, more apples-to-apples comparison would be Azure Active Directory. A single AAD account enables access to: Azure DevOps, Microsoft 365 collaboration apps, remote desktop logins to servers, virtual desktops, and a bunch of other stuff. It certainly is very convenient, but the downside is that a global outage of AAD takes down a lot of things all at once. For example, AAD system-managed identities are used as a type of "service account" in Azure. This means that web apps can lose access to their HTTPS certificates stored in Key Vault because AAD is down, causing massive outages. In theory, AAD has a "read-only delayed replica" as a fallback, but in practice this hasn't worked. This is actually one of the core "philosophical" differences between AWS and Azure. The former values completely distinct services with no (or minimal) interdependencies, the latter values integrated, cohesive architectures. In my experience Azure's approach is more convenient but more fragile. Conversely, AWS is more robust but can be super irritating for end-users.

liquidexil 5y ago

I feel like this doesn't consider the massive upside to IAM roles as identities. Once a user is a top-level concept, there will be things that only users can do. When everything is a role, an action can be taken by a user or an autonomous system in the exact same way. I don't think this was an accident. Internally, Amazon traditionally had very different methods for authenticating and authorizing users versus systems, and it was a massive pain. Switching to IAM roles relieved some massive pain-points.