3 ms·

Slightly related - CloudFlare account_id and zone_id are safe to be public https://github.com/cloudflare/cloudflare-docs/issues/474 https://github.com/cloudfla

• abadpoli 3y ago
  AWS account ID is also safe to be public. That said, one thing I could think of that this could be used for is correlation. If you’re running multiple S3 sites from the same AWS account, people would be able to see that they’re hosted by the same account. Whether or not this matters depends on your threat model.
  • tracebit 3y ago
    Exactly - this isn't going to open the door for someone but could add a ton of value to enumeration. As we are very canary focused, we also think it's interesting to consider the implications of the recent research from Truffle Security w.r.t canary tokens (https://trufflesecurity.com/blog/canaries https://trufflesecurity.com/blog/canaries).
  • mschuster91 3y ago
    > AWS account ID is also safe to be public. Not necessarily. An AWS account ID + the knowledge of a role name that by mistake has the "allow role assumption" allowlist too wide (say "*") is now enough to take over the account. One might of course say "well then don't do that", but of course the more complex a system like IAM is the easier it is for unexperienced people to open the floodgates.
    • anamexis 3y ago
      Well sure, but your account email isn't safe to be public if your password is "password".
      • mschuster91 3y ago
        Email providers have rate limits against specific user logins, IAM not.
        • hiatus 3y ago
          How do you know that?
          • mschuster91 3y ago
            That's easy to find out: change the API credentials of a user, but forget to update the service. Notice only a few days later that you forgot the change, but you also never got any notification "something" is going wrong. In contrast, every half-decent IdP will lock an account automatically after anything from 3-10 wrong attempts.
    • dekhn 3y ago
      Turning what you said around, you're arguing you might want to keep an account ID secret for "security by obscurity" reasons. In my mind, even in a multi-layer security solution, even then the account ID should be considered as a public string whose knowledge (along with other bits like what misconfigurations it has) provides no additional vector of attack, because of defense in depth.
  • sroussey 3y ago
    Oh, there are other things... like a compromised chrome extension that only looks for your accountID being used and sends back credentials. Knowing an accountId tells you where to focus your efforts. You got through one hoop (of many).
• latchkey 3y ago
  For CF accounts, I use the gmail `+ feature` to make a totally unique email address that cannot be easily guessed. Not perfect, but adds another layer of abstraction.
  • busymom0 3y ago
    If I remember right, the pre-signed url generated for R2 uploads include the account ID in it.