7 ms·

My own personal AWS S3 bucket

57 points by judell 5y ago

beardyw 5y ago
I am regularly surprised by old Gmail addresses I set up. Usually it's because I get a mail saying someone tried to log into it, so then I guess it must be mine. In the end there is/was a reason for them but life has moved on. Still accessable though even after many years.
Jugurtha 5y ago
This is both sad and dangerous. A person I know has recently found out that their Coinbase wallet is empty. She has not used it in about four years or so and is disheartened. So disheartened that I am encouraging her by taking a few actions to recover her assets.
- judell 5y ago
  I think about this a lot. This recent tweet from Simon Willison (https://twitter.com/simonw/status/1444071543902912513 https://twitter.com/simonw/status/1444071543902912513) really resonates: "One of the most obvious flaws in using blockchains for anything involving regular human beings is one I've not seen much discussion of: Regular human beings cannot protect their passwords, credentials or private keys. They just can't." I guess I'm not a regular human or I wouldn't have an AWS dev account, but I still hardly feel secure w/respect to the continuity of my various digital assets.
  - chillfox 5y ago
    Just being aware of the risks and counters helps a lot. Most people don't understand the risks beyond "I can get hacked" and because they don't understand the how or basic counters they treat it like a freak weather event that can't be forecast.
    - dna_polymerase 5y ago
      The ability to remember a password or write down backup phrases really goes up when it’s not the access to facebook that can be lost but people’s own money.
      - wahern 5y ago
        At least when I was working in the area 10 years ago, most passwords were leaked via brute-force, phishing, or key logging trojans. The latter was far more common than you'd ever think, and also often harvested SSH private keys.
  - encryptluks2 5y ago
    Probably because most people don't care if they get hacked. They've never had major consequences from it. They think that someone will always be there to hold there hand. I am confident in my security. My biggest concern is making sure I have a solid dead man's switch in place before I die or get dementia.
    - mhdhn 5y ago
      how do you do this, any hints?
      - daave 5y ago
        I use LastPass’s Emergency Access feature for this. You can designate people who can access your Vault, after a certain waiting period. If they request access prematurely, I can revoke it during the waiting period. There are written instructions for my next of kin on what to look for in the Vault. The main difficulty is if my next of kin forget their LastPass master password. I’ve been thinking of distributing a key via a set of USB stick using Shamir’s secret sharing, with written instructions to use them to recover a backup of the Vault kept offline… but have not gotten around to this.
        elcritch 5y ago
        One could put an unencrypted usb in a bank safety deposit. I kinda get a kick out of the notion. But yah Shamir’s seems underused.
  - sneak 5y ago
    Even users who know how generally fail to properly store, transmit, and authenticate key material. https://youtu.be/9k4GP3Evh9c https://youtu.be/9k4GP3Evh9c
    - dspillett 5y ago
      It occurs with information transfer as well as storage. I've seen this with people at client organisations with password protected files in email. They understand the need for the security and how to apply it but fail to connect those thoughts to the next hurdle and send the password in another email to the same address. This is like keeping the password in a file in the same directory, or taping the key to the underside of a lockbox. It can happen less obviously too: I've seen it internally where two channels merge: someone sends an encrypted file as an attachment and the password view Skype-for-business, but the Skype conversation is then archived and accessible in the same outlook account (at least not in the same folder, but someone who gets access to the account and scans for credentials will find it and know where to look for the payload). I wish the user of PKI had become easy enough to take off generally, though that only really solves the transmission problem: you still have potential issues with people managing passphrases/passwords for their private keys.
- marcelnita 5y ago
  Why do you think it's sad?
- lmm 5y ago
  Most things in life require regular maintenance or checking on. When my dad went to the garage and saw that some of the boxes of comics he'd left there for years had gotten damp, he was pretty sad, but ultimately accepted that that kind of thing is part of life. If this person wasn't using their "wallet" for four years it sounds like it wasn't a huge part of their life.
  - ivalm 5y ago
    That’s not really a justification for a financial crime.
  - mhdhn 5y ago
    what do you mean? it was an asset, a long-term investment. it's just supposed to be able to sit there growing in value. why is it gone, that's not supposed to be possible unless credentials were gotten and funds stolen
    - sellyme 5y ago
      > it was an asset, a long-term investment. it's just supposed to be able to sit there growing in value Did the promise of free money for doing nothing not seem slightly too good to be true to you?
      - kube-system 5y ago
        That strategy seems to work fine for my 401k
        gowld 5y ago
        what happens when you lose your password, or move house so your address is no longer valid, or get a new cell phone number, or got married and changed your name, and you haven't updated your account in years?
        kube-system 5y ago
fidesomnes 5y ago
"cool s3 bucket names..." okay that is enough internet for me for one day.
godmode2019 5y ago
I have been thinking about this problem. The 30 year problem. Long term key storage, something that can never be forgotten. Hard drives can be stolen, damaged or lost ink on paper can fade away. But if your key is protected by something timeless and unchanging as long as you remember the formula you can get it back. A global constant that you can be sure will always be publicly known and unchanged. Here are some simple examples that you should not use .com register - two or more long random domains blended in a certain way. Old letters from famous people Passage from a Classical book, music ect. For long term cold storage as soon as you have written it down you have lost it.
- sneak 5y ago
  Laser printed paper that is thermally laminated should last an entire human lifespan. There are also little metal punch tools that let you record a BIP32 seed phrase onto a fireproof metal card, which should last at least a couple centuries.
  - hsbauauvhabzb 5y ago
    What if somebody steals it?
    - sneak 5y ago
      That is, of course, a different problem.
- hsbauauvhabzb 5y ago
  What if I forget which .com registers I picked?
  - godmode2019 5y ago
    .com registers are the public domain. This database is easy to get a hold of, you just need to use a contact name that is searchable
- 5y ago
jayceedenton 5y ago
Whenever I see an online system with a single global namespace, I can't help but feel sorry for the next generation. Gmail? Sorry, every variant of your name is taken. Twitter? Every witticism, every pop culture reference, every real name, all taken. Just add another number to the end, I guess. It must get you down when you feel like you're always part of the 3rd/4th/5th wave of everything. How many people here have tried to get a Twitter account for their new company, only to find an existing account that tweeted some spam once eight years ago and has been dead ever since? For services that have global reach, the problem gets bad real quick. We really should think hard about whether we can namespace the population in some way. Contrary to the thrust of this article from Jon, I'd also like to see more aggressive cleanup for some services. If you have an S3 bucket and it has no activity for 15 years, you're just squatting and I think you should arguably be warned, and then finally have the name recycled. Same goes for Twitter accounts that have never posted, retweeted, liked a tweet, etc and not been logged into for over 10 years.
- callahad 5y ago
  Discord and Blizzard games (maybe others?) let you choose your own username, but then assign a four digit disambiguation code to everyone, which seems like a decent compromise.
  - Kipters 5y ago
    Also Xbox Live now, older accounts got just the nickname, the new ones get the four digit code. Seems like the gaming world is the one really pushing for solving this problem.
- rakoo 5y ago
  That's exactly why we should use domain names instead: having to pay prevents a whole class of people just registering for fun, and having them expire reduces the risk of squatting.
  - wink 5y ago
    Yep, totally. Let's exclude poor people and teenagers from grabbing a handle they like. Capitalism ftw. /s

57 points by judell 5y ago

I am regularly surprised by old Gmail addresses I set up. Usually it's because I get a mail saying someone tried to log into it, so then I guess it must be mine. In the end there is/was a reason for them but life has moved on. Still accessable though even after many years.

Jugurtha 5y ago

This is both sad and dangerous. A person I know has recently found out that their Coinbase wallet is empty. She has not used it in about four years or so and is disheartened. So disheartened that I am encouraging her by taking a few actions to recover her assets.

judell 5y ago
I think about this a lot. This recent tweet from Simon Willison (https://twitter.com/simonw/status/1444071543902912513 https://twitter.com/simonw/status/1444071543902912513) really resonates: "One of the most obvious flaws in using blockchains for anything involving regular human beings is one I've not seen much discussion of: Regular human beings cannot protect their passwords, credentials or private keys. They just can't." I guess I'm not a regular human or I wouldn't have an AWS dev account, but I still hardly feel secure w/respect to the continuity of my various digital assets.
- chillfox 5y ago
  Just being aware of the risks and counters helps a lot. Most people don't understand the risks beyond "I can get hacked" and because they don't understand the how or basic counters they treat it like a freak weather event that can't be forecast.
  - dna_polymerase 5y ago
    The ability to remember a password or write down backup phrases really goes up when it’s not the access to facebook that can be lost but people’s own money.
    - wahern 5y ago
      At least when I was working in the area 10 years ago, most passwords were leaked via brute-force, phishing, or key logging trojans. The latter was far more common than you'd ever think, and also often harvested SSH private keys.
- encryptluks2 5y ago
  Probably because most people don't care if they get hacked. They've never had major consequences from it. They think that someone will always be there to hold there hand. I am confident in my security. My biggest concern is making sure I have a solid dead man's switch in place before I die or get dementia.
  - mhdhn 5y ago
    how do you do this, any hints?
    - daave 5y ago
      I use LastPass’s Emergency Access feature for this. You can designate people who can access your Vault, after a certain waiting period. If they request access prematurely, I can revoke it during the waiting period. There are written instructions for my next of kin on what to look for in the Vault. The main difficulty is if my next of kin forget their LastPass master password. I’ve been thinking of distributing a key via a set of USB stick using Shamir’s secret sharing, with written instructions to use them to recover a backup of the Vault kept offline… but have not gotten around to this.
      - elcritch 5y ago
        One could put an unencrypted usb in a bank safety deposit. I kinda get a kick out of the notion. But yah Shamir’s seems underused.
- sneak 5y ago
  Even users who know how generally fail to properly store, transmit, and authenticate key material. https://youtu.be/9k4GP3Evh9c https://youtu.be/9k4GP3Evh9c
  - dspillett 5y ago
    It occurs with information transfer as well as storage. I've seen this with people at client organisations with password protected files in email. They understand the need for the security and how to apply it but fail to connect those thoughts to the next hurdle and send the password in another email to the same address. This is like keeping the password in a file in the same directory, or taping the key to the underside of a lockbox. It can happen less obviously too: I've seen it internally where two channels merge: someone sends an encrypted file as an attachment and the password view Skype-for-business, but the Skype conversation is then archived and accessible in the same outlook account (at least not in the same folder, but someone who gets access to the account and scans for credentials will find it and know where to look for the payload). I wish the user of PKI had become easy enough to take off generally, though that only really solves the transmission problem: you still have potential issues with people managing passphrases/passwords for their private keys.
marcelnita 5y ago
Why do you think it's sad?
lmm 5y ago
Most things in life require regular maintenance or checking on. When my dad went to the garage and saw that some of the boxes of comics he'd left there for years had gotten damp, he was pretty sad, but ultimately accepted that that kind of thing is part of life. If this person wasn't using their "wallet" for four years it sounds like it wasn't a huge part of their life.
- ivalm 5y ago
  That’s not really a justification for a financial crime.
- mhdhn 5y ago
  what do you mean? it was an asset, a long-term investment. it's just supposed to be able to sit there growing in value. why is it gone, that's not supposed to be possible unless credentials were gotten and funds stolen
  - sellyme 5y ago
    > it was an asset, a long-term investment. it's just supposed to be able to sit there growing in value Did the promise of free money for doing nothing not seem slightly too good to be true to you?
    - kube-system 5y ago
      That strategy seems to work fine for my 401k
      - gowld 5y ago
        what happens when you lose your password, or move house so your address is no longer valid, or get a new cell phone number, or got married and changed your name, and you haven't updated your account in years?
        kube-system 5y ago

fidesomnes 5y ago

"cool s3 bucket names..." okay that is enough internet for me for one day.

godmode2019 5y ago

I have been thinking about this problem. The 30 year problem. Long term key storage, something that can never be forgotten. Hard drives can be stolen, damaged or lost ink on paper can fade away. But if your key is protected by something timeless and unchanging as long as you remember the formula you can get it back. A global constant that you can be sure will always be publicly known and unchanged. Here are some simple examples that you should not use .com register - two or more long random domains blended in a certain way. Old letters from famous people Passage from a Classical book, music ect. For long term cold storage as soon as you have written it down you have lost it.

sneak 5y ago
Laser printed paper that is thermally laminated should last an entire human lifespan. There are also little metal punch tools that let you record a BIP32 seed phrase onto a fireproof metal card, which should last at least a couple centuries.
- hsbauauvhabzb 5y ago
  What if somebody steals it?
  - sneak 5y ago
    That is, of course, a different problem.
hsbauauvhabzb 5y ago
What if I forget which .com registers I picked?
- godmode2019 5y ago
  .com registers are the public domain. This database is easy to get a hold of, you just need to use a contact name that is searchable
5y ago

jayceedenton 5y ago

Whenever I see an online system with a single global namespace, I can't help but feel sorry for the next generation. Gmail? Sorry, every variant of your name is taken. Twitter? Every witticism, every pop culture reference, every real name, all taken. Just add another number to the end, I guess. It must get you down when you feel like you're always part of the 3rd/4th/5th wave of everything. How many people here have tried to get a Twitter account for their new company, only to find an existing account that tweeted some spam once eight years ago and has been dead ever since? For services that have global reach, the problem gets bad real quick. We really should think hard about whether we can namespace the population in some way. Contrary to the thrust of this article from Jon, I'd also like to see more aggressive cleanup for some services. If you have an S3 bucket and it has no activity for 15 years, you're just squatting and I think you should arguably be warned, and then finally have the name recycled. Same goes for Twitter accounts that have never posted, retweeted, liked a tweet, etc and not been logged into for over 10 years.

callahad 5y ago
Discord and Blizzard games (maybe others?) let you choose your own username, but then assign a four digit disambiguation code to everyone, which seems like a decent compromise.
- Kipters 5y ago
  Also Xbox Live now, older accounts got just the nickname, the new ones get the four digit code. Seems like the gaming world is the one really pushing for solving this problem.
rakoo 5y ago
That's exactly why we should use domain names instead: having to pay prevents a whole class of people just registering for fun, and having them expire reduces the risk of squatting.
- wink 5y ago
  Yep, totally. Let's exclude poor people and teenagers from grabbing a handle they like. Capitalism ftw. /s