4 ms·
> Demirkapi turned to Amazon Web Services, but the company refused to provide him with access to existing private reporting tools. “We believe firmly that custo
by Ukv 2y ago
> Demirkapi turned to Amazon Web Services, but the company refused to provide him with access to existing private reporting tools. “We believe firmly that customer credentials, including security keys, belong solely to customers. AWS does not grant external users access to manage or revoke security keys as that would violate security policies and erode customer trust,” says Aisha Johnson, an AWS spokesperson
AWS's response seems muddled. To make sure that "customer credentials [...] belong solely to customers" surely you would typically want an endpoint to revoke exposed secret keys?
- loa_in_ 2y agoExposed secret keys is not a technological problem, not really. It doesn't belong to the category of problems you solve with automated decision making. I leave it to the reader to imagine how automated decision making would play out here. But they should accept feedback about exposed secret keys through some way where a responsible person in company could act on it.
- Ukv 2y ago> I leave it to the reader to imagine how automated decision making would play out here Could you elaborate? Many other services have automated revocation, either through scanning for exposed keys or offering an endpoint to submit keys to, and as far as I can tell the way it has played out is in successful warning of and prevention of many leaks. I don't see how lack of it can be justified as a "security" measure.
- loa_in_ 2y agoIMO it's going to result in a potential DoS by submitting guesses en masse, denying whole revoking whole company's access until key renewal.
- Ukv 2y agoKeys should have sufficient bits of entropy to not be guessable. And if a malicious actor can guess a key, you should want it revoked as opposed to them doing more serious damage through other endpoints.