10 ms·

Amazon Starts Email Service for Companies

173 points by cryptoz 12y ago

cryptoz 12y ago
Here is a link that goes through Google: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0CDoQqQIwAA&url=http%3A%2F%2Fwww.wsj.com%2Farticles%2Famazon-starts-selling-an-email-service-to-companies-1422468169&ei=oijJVMaJEJShyATDpoDgBw&usg=AFQjCNEBxqsxa2zHwdufPj-F6J9Hsy3YEQ&bvm=bv.84607526,d.aWw https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd... I tried to submit that to HN, but it didn't seem to work.
- pwenzel 12y ago
  You can also use Instapaper.
- riledhel 12y ago
  No luck, I can't see the article with that link either
  - _neil 12y ago
    Same, but if you go type the headline into Google and follow the WSJ link, you should be able to read it.
  - deleted 12y ago
    [deleted]
- dang 12y ago
  We changed the URL from http://www.wsj.com/articles/amazon-starts-selling-an-email-service-to-companies-1422468169 http://www.wsj.com/articles/amazon-starts-selling-an-email-s... to what seems to be the other substantive article on this topic.
  - cpach 12y ago
    Thank you! (Edit: Forbes’ article was much better than WSJs.)
- delsalk 12y ago
  Probably because HN doesnt want people accidentally linking to Google's tracking search results by accident, although HN should really wrap paywalled articles by default, or at least have a policy on what is allowed. Im sure more than 90% cant actually see anything without messing around with referral links.
flowerpot 12y ago
I'm actually not too surprised. It seems like Amazon feels like they have to have every online service possible, however, some of their services could be better if they focused on fewer.
- _almosnow 12y ago
  You misspelled Google. Most of AWS are products that have a consistent user base and profitable almost from day one.
  - raptormissle 12y ago
    LOL? Amazon makes money? Good one.
  - efiftythree 12y ago
    My personal opinion is that there is a divergence product types between traditional AWS offerings and their new desire to break into traditional Enterprise offerings. The Workspaces and managed Directory Services are nods to the Enterprise space but they are currently getting more shakes of the head back rather than nods.
jcreedon 12y ago
I think the biggest distinguishing feature of this is being able to have it encrypt emails with customer provided keys stored on their Key Management Service. This hypothetically should prevent three letter agencies from accessing emails, but I'm not sure that is the top feature on everyone's mind when they are looking to set up email for their company. It definitely piques my interest though.
- calpaterson 12y ago
  I think since the Sony leak, probably a lot of people have thought about the security of their corporate mail - I have
  - jcreedon 12y ago
    That's a good thought. The more I have sat and thought about it, the more use cases I can come up with where there is a business case for it. One big one that comes to mind is foreign companies that don't trust the US.
- deleted 12y ago
  [deleted]
- hackuser 12y ago
  If your mail is encrypted, how do you search it? EDIT: That is, assuming the mail is stored on the server and it's encrypted, how do you search it efficiently? It does not seem efficient to download every byte of mail, decrypt it, and search it on your local machine (especially a phone). Perhaps you could build an index locally, but could you keep it updated? And even that requires downloading and reading every byte at least once. This is something I've always wondered about encrypting hosted email.
  - jcreedon 12y ago
    As other commenters elsewhere in the thread have pointed out, we don't know much about the implementation at this point. How it is implemented I think will make or break this product.
e0m 12y ago
This to me just emphasizes the need for services like Nilas' email APIs. I don't want to have to worry about integrating with yet another email provider. That being said, I trust Amazon's data centers and API stack far more then Microsoft alone.
- calpaterson 12y ago
  Email can go better than APIs - it has publicly available protocols and there are many implementations of them (including many good FOSS implementations). They are called IMAP and SMTP! Any email client can integrate with any email server, and has been able to since the beginning of email
  - martinesko36 12y ago
    Sounds wonderful until you have actually tried to integrate IMAP "supported" email services, such as Gmail. What makes it hard is that different providers have different implementations which very often do not follow the protocol spec. Microsoft, Google, Yahoo all have their own higher-level API for email access, and every modern email tool ends up making something like Nilas, with a server taking care of pushes and managing logic for each provider. The industry needs a new standard, and that is why ideas such as Nilas seem exciting.
    - ForHackernews 12y ago
      That's an argument for providers implementing the spec correctly, not an argument for abandoning specifications in favor of various proprietary APIs. We've already learned this lesson with web browsers and HTML specs, maybe we'll have to learn it again for email.
__Joker 12y ago
Sometimes it feels Amazon does a lot of "throwing at the wall and see what sticks". Not sure how this fits better at their vision ?
- flurdy 12y ago
  Scatter gun + Lean Startup principles. Not entirely wrong, though wish some more initial refinement was included, but if the brand doesn't take a hit then fair enough.
  - jdub 12y ago
    Plus, because almost all of what they do is based on customer demand, they haven't killed many products. Whereas Google…
rdl 12y ago
I'm curious about two things: 1) Where does this use Key Management Service to encrypt? At the SMTPD? With keys unique to each end user? S/MIME? What? 2) What's the real security model of KMS? Is it using HSMs for keys, or just shipping keys to systems? Does it use any other hardware/platform security features to protect keys, or just basically a "soft HSM" running in Dom0 on each machine? Or something purely network based, and also done in software only?
- deleted 12y ago
  [deleted]
hackuser 12y ago
To qualify any hosted mail service to handle valuable, confidential data seems difficult. For example: What are the confidentiality provisions? Can they be changed without your consent? Does Amazon possess cleartext data and metadata? Do they monitor it to collect customer data? Who at Amazon can access it and when? What is their retention policy? Is non-retained data destroyed or just left on the storage medium until overwritten? How will they respond to subpoenas, warrants, and similar requests from counterparties in lawsuits or from government? And perhaps most importantly, how able are they to execute their policies and what deters Amazon from violating them (i.e., what is the penalty?)? Is there any service that satisfies these requirements?
- hellbanner 12y ago
  Isn't the NSA/CIA hosting with Amazon nowadays?
  - ForHackernews 12y ago
    Maybe their website. Not for anything that matters. They're not building billion-dollar datacenters in Utah for fun.
    - dclusin 12y ago
      Amazon has a separate cloud for government computing that conforms to the various classification regimes, iirc.
      - discodave 12y ago
        That's GovCloud, see here: http://aws.amazon.com/govcloud-us/ http://aws.amazon.com/govcloud-us/ The 600 million contract described here is not GovCloud: http://www.informationweek.com/cloud/infrastructure-as-a-service/amazon-again-beats-ibm-for-cia-cloud-contract/d/d-id/1112211 http://www.informationweek.com/cloud/infrastructure-as-a-ser...?
    - karambahh 12y ago
ecaron 12y ago
After trying for 3 weeks to make AWS WorkSpaces work for my company, I can still confidently say that Amazon doesn't get it. Their solutions are more "Go to Home Depot and get the parts to make a desk", whereas Google Apps is "go to Ikea". The two solutions are neighbors, but not everyone is ready to buy the individual boards and cut them down to size.
- level09 12y ago
  Agreed, while they have some excellent services some other products lose the usability/practicality game . e.g: video transcoding service compared to zen coder, or cloud front service compared to cloud flare.
- scuba7183 12y ago
  I'm so happy I was able to talk my bosses out of Workspaces. It would have been an expensive mess for us
- npinguy 12y ago
  Your comparison is bang on, except that's the point. Amazon isn't trying to be Ikea. It is absolutely trying to provide the building blocks for small companies and large to use their cloud platform in a very foundational manner. Yes, the onboarding cost may be high, but Amazon doesn't mind if customers end up using Heroku or EngineYard instead - they are customers too. AWS is a lot like Linux that way: Deeply challenging initial learning curve, but the only thing worth considering for serious mission critical architecture. Stability and scalability does come at the cost of user-friendliness.
  - cheriot 12y ago
    Are you saying there's a security and scalability to Amazon over Google Apps? People still make that argument about in house vs hosted, but hosted vs hosted of two major providers is new to me.
    - mukundmr 12y ago
      I don't know about security and scalability, but from what I read, it seems that Amazon gives you fine grain control and AD integration which is nice. Also, customer support is one area where AWS is better than Google in my opinion. YMMV.
rdl 12y ago
Wow, I loled. This uses Amazon KMS. Amazon KMS is PC backed ("HSA"), which means all your mail is encrypted to a key which it now takes two Amazon employees acting under court order to get access to, rather than a court order and one employee. Google's internal controls are at least this robust, and they have similar key management systems internally. There might be a reason to buy Amazon WorkMail, but it's not for security advantages over Gmail.
- _almosnow 12y ago
  Mmm, how is it less secure to add another "employee" to the equation?
  - rdl 12y ago
    The court order is the bar, not the second employee. Google's keyservers also don't have single employee control. The ones used for encrypting gmail behind the scenes, and other Google services. This is just table stakes for any large system. This is in contrast to something like Azure Key Vault, which is HSM backed. A court order should not be sufficient to compel Microsoft to turn over a key from Azure Key Vault; it should be impossible for them (or for nCipher) to do so.
    - cwyers 12y ago
      Can you explain the difference between HSM and HSA, or at least point to a good resource for understanding the difference? Thanks.
      - rdl 12y ago
        HSMs are tamper-resistant/tamper-responding devices with memory/processor inside the protected envelope. With an HSM, your key lives inside, and all operations happen on the security processor. HSA is an Amazon term for a PC with an HSM inside. The data-at-rest might be protected by the HSM (full disk crypto with a dongle used to decrypt at boot), but the actual keys get decrypted into the host PC's RAM, and further customer-accessible calculations happen in the PC CPU. Anyone who can tamper with the PC can read the keys! There are two risks this exposes you to: 1) Someone goes into the datacenter and physically attacks the HSA. 2) Someone legally compels the owner of the HSA to subvert the HSA. I'm not as worried about #1 (these are equinix tier-4 datacenters; someone rolling in with some M4s and a bulldozer and such is great for Hollywood. Insider threat probably still exists with the HSA even though normal operation is two-employee, though.) I'm incredibly worried about #2, since the bar for #2 is hella low for emails older than 6mo. I believe ECPA older-than-6mo would be sufficient to compel the email KMS key as mere instrumentality, so even a the fairly low bar today of warrant wouldn't be required.
nullrouted 12y ago
Everyone is talking KMS which is nice but I don't think that is the biggest selling point. Being able to say in which region your email is stored is huge for customers who don't want their data shipped all over the world. http://arstechnica.com/information-technology/2015/01/amazon-goes-after-office365-with-workmail-hosted-e-mail-service/ http://arstechnica.com/information-technology/2015/01/amazon... "Another notable feature of WorkMail is that users can specify what Amazon region their e-mail is stored in. Customers can choose a specific, relatively close data center to reduce latency in retrieving e-mail or for compliance purposes—such as European privacy regulations. The feature means that users won’t get the benefit of failover to another data center in the event of an outage, but Amazon may offer mirroring services later." That is a big differentiator for many companies right there.
- rodgerd 12y ago
  > or for compliance purposes—such as European privacy regulations That sounds nice, but Amazon is still a US company, and the US government seems pretty staunch in their view that US law trumps country-of-residence law.
  - wahnfrieden 12y ago
    IANAL, but these regulations and organization requirements in my experience haven't cared about this. A common requirement is physical location of servers / the data on them which this satisfies.
  - nullrouted 12y ago
    I can understand why you would say that after the big fight with Microsoft. What if Amazon makes it so the only employees with keys to be able to decrypt data in that region, live in that region. I think that could be the failsafe right there to where even if the government says "hand over the data", Amazon says "we can't and the only people that can are Citizens of xyz and we can't compel them to break the law of their home country". I'm not saying that is what they are doing but it would be a very interesting strategy.
    - 12y ago
dflock 12y ago
I wonder if Amazon has switched their internal email over to use WorkMail?
- efiftythree 12y ago
  No, they are running Exchange 2013.
ghobs91 12y ago
I get the feeling they haven't learned from Microsoft's mistakes when trying to spread themselves too thin.
burtr85 12y ago
I've been a user of Rackspace E-mail. It's one of the last services I still have with Rackspace and it's been a good platform for my company. I can't tell you the last time I had an issue. Looks like this is on the road to making Rackspace irrelevant on yet another level.
- bretpiatt 12y ago
  Racker here responsible for our mail services. Thanks for the positive feedback and for being a customer. Curious why you say this would make our offering irrelevant?
  - burtr85 12y ago
    Hi Racker: I dont think this statement is necessarily specific to the mail offering. It's more about the pace of innovation or lack thereof @ Rackspace these days. There just seems to be a better fit for everything Rackspace used to do well somewhere else. :( I want support and someone I can call, but I can honestly say that the support that I receive at AWS is more comprehensive and detailed that the typical response I got from Rackspace, which is really disappointing. Once I discovered that, I couldnt justify the 2x+ premium that I had been paying. I also wish some of the more interesting things you have like Airbrake, Mailgun, Exceptional got more love. Instead, the focus seems to be on the non-differentiated stuff and all the "enterprise" stuff that matters less and less everyday.
mathattack 12y ago
I'm scratching my head wondering, "You mean they haven't done this already?"
KeepTalking 12y ago
They seem to be scant on security details. Its great to say you are built on the tenant of security but its the details that matter. What sort of protection do they offer for phishing , spam and AV ? Do they offer integration with other security , DLP suits ?
peteretep 12y ago
To run a "real" company, of let's say, 200 people or more, dealing with mildly sensitive data, you need Microsoft[1][2][3][4]. You need Microsoft because you need: * Calendaring that Just Works, and a capable client for it. This involves an Exchange server and MS Office; * You need mail that Just Works, and Just Works in conjunction with the above calendaring; this involves an Exchange server and MS Office; * You need an easily controllable and relatively cheap OS that can run Word, Excel, and a web-browser for non-technical staff, and can be run on cheap-ass Dell boxes; currently this involves Windows and MS Office; * You need a shared fileserver for people to upload company party photos to, storing improperly protected financial spreadsheets, and so on; * You need a central identity system to tie the whole shebang together; this involves Active Directory To summarise, you need: * ActiveDirectory, for which there is now Amazon WorkMail * Exchange, for which there is now Amazon WorkMail * Windows File Sharing, for which there is now Amazon WorkDocs * Windows desktops that can run MS Office ... for which there is sort of Amazon WorkSpaces The question now becomes: can I get away with running a 200-person company with no relationship with MS by deploying cheap-cheap Linux machines with a VNC-client to Amazon WorkSpaces for non-technical staff? And the answer is ... perhaps, but I need my people to be able to work without an internet connection, so probably not. But still, that's fucking huge. The one piece missing in this lineup is capable local Office apps. You simply cannot get away with not having Excel, Word, and Outlook's Calendar functionality ... yet. Finance, Admin, Management, and non-dev IT will riot without Excel; Admin, Sales, and Management will riot without Word; Sales and Management will riot without Outlook, and blood will be spilled over the management of more than two meeting rooms. OpenOffice, LibreOffice, whatever, they don't cut it in the real world. So while it doesn't sound like their game, if Amazon were to release a lock-down-able Linux and some high-quality Office apps, they can take SME IT away from Microsoft. That's is HUGE. Hell, if they can put together a package that can run Office under WINE reliably, and sort sensible licensing terms, it's just as huge, but I can't see MS allowing that licensing part to happen, because it would be suicide. Interesting times! [1] I don't care how Canonical or RedHat manage their internal IT [2] Nor do I care about how your 11 person social media startup does it [3] I too did all my best IT management before I became responsible for it [4] Seriously.
- ts330 12y ago
  Someone buy this man a beer.
known 12y ago
What's it USP?
ukigumo 12y ago
Hopefully this means AWS will also be implementing DNSSEC which I need in order to implement DANE on my own secure mail solution.
chatman 12y ago
And Amazon uses Outlook for internal office mail and calendar. What an irony?
- jdub 12y ago
  Why irony? You can use Outlook as a client for WorkMail. I wouldn't be surprised if they shift to WorkMail once it satisfies their large enterprise requirements (given that it's an MVP right now).

173 points by cryptoz 12y ago

Here is a link that goes through Google: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0CDoQqQIwAA&url=http%3A%2F%2Fwww.wsj.com%2Farticles%2Famazon-starts-selling-an-email-service-to-companies-1422468169&ei=oijJVMaJEJShyATDpoDgBw&usg=AFQjCNEBxqsxa2zHwdufPj-F6J9Hsy3YEQ&bvm=bv.84607526,d.aWw https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd... I tried to submit that to HN, but it didn't seem to work.

pwenzel 12y ago
You can also use Instapaper.
riledhel 12y ago
No luck, I can't see the article with that link either
- _neil 12y ago
  Same, but if you go type the headline into Google and follow the WSJ link, you should be able to read it.
- deleted 12y ago
  [deleted]
dang 12y ago
We changed the URL from http://www.wsj.com/articles/amazon-starts-selling-an-email-service-to-companies-1422468169 http://www.wsj.com/articles/amazon-starts-selling-an-email-s... to what seems to be the other substantive article on this topic.
- cpach 12y ago
  Thank you! (Edit: Forbes’ article was much better than WSJs.)
delsalk 12y ago
Probably because HN doesnt want people accidentally linking to Google's tracking search results by accident, although HN should really wrap paywalled articles by default, or at least have a policy on what is allowed. Im sure more than 90% cant actually see anything without messing around with referral links.

flowerpot 12y ago

I'm actually not too surprised. It seems like Amazon feels like they have to have every online service possible, however, some of their services could be better if they focused on fewer.

_almosnow 12y ago
You misspelled Google. Most of AWS are products that have a consistent user base and profitable almost from day one.
- raptormissle 12y ago
  LOL? Amazon makes money? Good one.
- efiftythree 12y ago
  My personal opinion is that there is a divergence product types between traditional AWS offerings and their new desire to break into traditional Enterprise offerings. The Workspaces and managed Directory Services are nods to the Enterprise space but they are currently getting more shakes of the head back rather than nods.

jcreedon 12y ago

I think the biggest distinguishing feature of this is being able to have it encrypt emails with customer provided keys stored on their Key Management Service. This hypothetically should prevent three letter agencies from accessing emails, but I'm not sure that is the top feature on everyone's mind when they are looking to set up email for their company. It definitely piques my interest though.

calpaterson 12y ago
I think since the Sony leak, probably a lot of people have thought about the security of their corporate mail - I have
- jcreedon 12y ago
  That's a good thought. The more I have sat and thought about it, the more use cases I can come up with where there is a business case for it. One big one that comes to mind is foreign companies that don't trust the US.
deleted 12y ago
[deleted]
hackuser 12y ago
If your mail is encrypted, how do you search it? EDIT: That is, assuming the mail is stored on the server and it's encrypted, how do you search it efficiently? It does not seem efficient to download every byte of mail, decrypt it, and search it on your local machine (especially a phone). Perhaps you could build an index locally, but could you keep it updated? And even that requires downloading and reading every byte at least once. This is something I've always wondered about encrypting hosted email.
- jcreedon 12y ago
  As other commenters elsewhere in the thread have pointed out, we don't know much about the implementation at this point. How it is implemented I think will make or break this product.

e0m 12y ago

This to me just emphasizes the need for services like Nilas' email APIs. I don't want to have to worry about integrating with yet another email provider. That being said, I trust Amazon's data centers and API stack far more then Microsoft alone.

calpaterson 12y ago
Email can go better than APIs - it has publicly available protocols and there are many implementations of them (including many good FOSS implementations). They are called IMAP and SMTP! Any email client can integrate with any email server, and has been able to since the beginning of email
- martinesko36 12y ago
  Sounds wonderful until you have actually tried to integrate IMAP "supported" email services, such as Gmail. What makes it hard is that different providers have different implementations which very often do not follow the protocol spec. Microsoft, Google, Yahoo all have their own higher-level API for email access, and every modern email tool ends up making something like Nilas, with a server taking care of pushes and managing logic for each provider. The industry needs a new standard, and that is why ideas such as Nilas seem exciting.
  - ForHackernews 12y ago
    That's an argument for providers implementing the spec correctly, not an argument for abandoning specifications in favor of various proprietary APIs. We've already learned this lesson with web browsers and HTML specs, maybe we'll have to learn it again for email.

__Joker 12y ago

Sometimes it feels Amazon does a lot of "throwing at the wall and see what sticks". Not sure how this fits better at their vision ?

flurdy 12y ago
Scatter gun + Lean Startup principles. Not entirely wrong, though wish some more initial refinement was included, but if the brand doesn't take a hit then fair enough.
- jdub 12y ago
  Plus, because almost all of what they do is based on customer demand, they haven't killed many products. Whereas Google…

rdl 12y ago

I'm curious about two things: 1) Where does this use Key Management Service to encrypt? At the SMTPD? With keys unique to each end user? S/MIME? What? 2) What's the real security model of KMS? Is it using HSMs for keys, or just shipping keys to systems? Does it use any other hardware/platform security features to protect keys, or just basically a "soft HSM" running in Dom0 on each machine? Or something purely network based, and also done in software only?

deleted 12y ago
[deleted]

hackuser 12y ago

To qualify any hosted mail service to handle valuable, confidential data seems difficult. For example: What are the confidentiality provisions? Can they be changed without your consent? Does Amazon possess cleartext data and metadata? Do they monitor it to collect customer data? Who at Amazon can access it and when? What is their retention policy? Is non-retained data destroyed or just left on the storage medium until overwritten? How will they respond to subpoenas, warrants, and similar requests from counterparties in lawsuits or from government? And perhaps most importantly, how able are they to execute their policies and what deters Amazon from violating them (i.e., what is the penalty?)? Is there any service that satisfies these requirements?

hellbanner 12y ago
Isn't the NSA/CIA hosting with Amazon nowadays?
- ForHackernews 12y ago
  Maybe their website. Not for anything that matters. They're not building billion-dollar datacenters in Utah for fun.
  - dclusin 12y ago
    Amazon has a separate cloud for government computing that conforms to the various classification regimes, iirc.
    - discodave 12y ago
      That's GovCloud, see here: http://aws.amazon.com/govcloud-us/ http://aws.amazon.com/govcloud-us/ The 600 million contract described here is not GovCloud: http://www.informationweek.com/cloud/infrastructure-as-a-service/amazon-again-beats-ibm-for-cia-cloud-contract/d/d-id/1112211 http://www.informationweek.com/cloud/infrastructure-as-a-ser...?
  - karambahh 12y ago

ecaron 12y ago

After trying for 3 weeks to make AWS WorkSpaces work for my company, I can still confidently say that Amazon doesn't get it. Their solutions are more "Go to Home Depot and get the parts to make a desk", whereas Google Apps is "go to Ikea". The two solutions are neighbors, but not everyone is ready to buy the individual boards and cut them down to size.

level09 12y ago
Agreed, while they have some excellent services some other products lose the usability/practicality game . e.g: video transcoding service compared to zen coder, or cloud front service compared to cloud flare.
scuba7183 12y ago
I'm so happy I was able to talk my bosses out of Workspaces. It would have been an expensive mess for us
npinguy 12y ago
Your comparison is bang on, except that's the point. Amazon isn't trying to be Ikea. It is absolutely trying to provide the building blocks for small companies and large to use their cloud platform in a very foundational manner. Yes, the onboarding cost may be high, but Amazon doesn't mind if customers end up using Heroku or EngineYard instead - they are customers too. AWS is a lot like Linux that way: Deeply challenging initial learning curve, but the only thing worth considering for serious mission critical architecture. Stability and scalability does come at the cost of user-friendliness.
- cheriot 12y ago
  Are you saying there's a security and scalability to Amazon over Google Apps? People still make that argument about in house vs hosted, but hosted vs hosted of two major providers is new to me.
  - mukundmr 12y ago
    I don't know about security and scalability, but from what I read, it seems that Amazon gives you fine grain control and AD integration which is nice. Also, customer support is one area where AWS is better than Google in my opinion. YMMV.

rdl 12y ago

Wow, I loled. This uses Amazon KMS. Amazon KMS is PC backed ("HSA"), which means all your mail is encrypted to a key which it now takes two Amazon employees acting under court order to get access to, rather than a court order and one employee. Google's internal controls are at least this robust, and they have similar key management systems internally. There might be a reason to buy Amazon WorkMail, but it's not for security advantages over Gmail.

_almosnow 12y ago
Mmm, how is it less secure to add another "employee" to the equation?
- rdl 12y ago
  The court order is the bar, not the second employee. Google's keyservers also don't have single employee control. The ones used for encrypting gmail behind the scenes, and other Google services. This is just table stakes for any large system. This is in contrast to something like Azure Key Vault, which is HSM backed. A court order should not be sufficient to compel Microsoft to turn over a key from Azure Key Vault; it should be impossible for them (or for nCipher) to do so.
  - cwyers 12y ago
    Can you explain the difference between HSM and HSA, or at least point to a good resource for understanding the difference? Thanks.
    - rdl 12y ago
      HSMs are tamper-resistant/tamper-responding devices with memory/processor inside the protected envelope. With an HSM, your key lives inside, and all operations happen on the security processor. HSA is an Amazon term for a PC with an HSM inside. The data-at-rest might be protected by the HSM (full disk crypto with a dongle used to decrypt at boot), but the actual keys get decrypted into the host PC's RAM, and further customer-accessible calculations happen in the PC CPU. Anyone who can tamper with the PC can read the keys! There are two risks this exposes you to: 1) Someone goes into the datacenter and physically attacks the HSA. 2) Someone legally compels the owner of the HSA to subvert the HSA. I'm not as worried about #1 (these are equinix tier-4 datacenters; someone rolling in with some M4s and a bulldozer and such is great for Hollywood. Insider threat probably still exists with the HSA even though normal operation is two-employee, though.) I'm incredibly worried about #2, since the bar for #2 is hella low for emails older than 6mo. I believe ECPA older-than-6mo would be sufficient to compel the email KMS key as mere instrumentality, so even a the fairly low bar today of warrant wouldn't be required.

nullrouted 12y ago

Everyone is talking KMS which is nice but I don't think that is the biggest selling point. Being able to say in which region your email is stored is huge for customers who don't want their data shipped all over the world. http://arstechnica.com/information-technology/2015/01/amazon-goes-after-office365-with-workmail-hosted-e-mail-service/ http://arstechnica.com/information-technology/2015/01/amazon... "Another notable feature of WorkMail is that users can specify what Amazon region their e-mail is stored in. Customers can choose a specific, relatively close data center to reduce latency in retrieving e-mail or for compliance purposes—such as European privacy regulations. The feature means that users won’t get the benefit of failover to another data center in the event of an outage, but Amazon may offer mirroring services later." That is a big differentiator for many companies right there.

rodgerd 12y ago
> or for compliance purposes—such as European privacy regulations That sounds nice, but Amazon is still a US company, and the US government seems pretty staunch in their view that US law trumps country-of-residence law.
- wahnfrieden 12y ago
  IANAL, but these regulations and organization requirements in my experience haven't cared about this. A common requirement is physical location of servers / the data on them which this satisfies.
- nullrouted 12y ago
  I can understand why you would say that after the big fight with Microsoft. What if Amazon makes it so the only employees with keys to be able to decrypt data in that region, live in that region. I think that could be the failsafe right there to where even if the government says "hand over the data", Amazon says "we can't and the only people that can are Citizens of xyz and we can't compel them to break the law of their home country". I'm not saying that is what they are doing but it would be a very interesting strategy.
  - 12y ago

dflock 12y ago

I wonder if Amazon has switched their internal email over to use WorkMail?

efiftythree 12y ago
No, they are running Exchange 2013.

ghobs91 12y ago

I get the feeling they haven't learned from Microsoft's mistakes when trying to spread themselves too thin.

burtr85 12y ago

I've been a user of Rackspace E-mail. It's one of the last services I still have with Rackspace and it's been a good platform for my company. I can't tell you the last time I had an issue. Looks like this is on the road to making Rackspace irrelevant on yet another level.

bretpiatt 12y ago
Racker here responsible for our mail services. Thanks for the positive feedback and for being a customer. Curious why you say this would make our offering irrelevant?
- burtr85 12y ago
  Hi Racker: I dont think this statement is necessarily specific to the mail offering. It's more about the pace of innovation or lack thereof @ Rackspace these days. There just seems to be a better fit for everything Rackspace used to do well somewhere else. :( I want support and someone I can call, but I can honestly say that the support that I receive at AWS is more comprehensive and detailed that the typical response I got from Rackspace, which is really disappointing. Once I discovered that, I couldnt justify the 2x+ premium that I had been paying. I also wish some of the more interesting things you have like Airbrake, Mailgun, Exceptional got more love. Instead, the focus seems to be on the non-differentiated stuff and all the "enterprise" stuff that matters less and less everyday.

mathattack 12y ago

I'm scratching my head wondering, "You mean they haven't done this already?"

KeepTalking 12y ago

They seem to be scant on security details. Its great to say you are built on the tenant of security but its the details that matter. What sort of protection do they offer for phishing , spam and AV ? Do they offer integration with other security , DLP suits ?

peteretep 12y ago

To run a "real" company, of let's say, 200 people or more, dealing with mildly sensitive data, you need Microsoft[1][2][3][4]. You need Microsoft because you need: * Calendaring that Just Works, and a capable client for it. This involves an Exchange server and MS Office; * You need mail that Just Works, and Just Works in conjunction with the above calendaring; this involves an Exchange server and MS Office; * You need an easily controllable and relatively cheap OS that can run Word, Excel, and a web-browser for non-technical staff, and can be run on cheap-ass Dell boxes; currently this involves Windows and MS Office; * You need a shared fileserver for people to upload company party photos to, storing improperly protected financial spreadsheets, and so on; * You need a central identity system to tie the whole shebang together; this involves Active Directory To summarise, you need: * ActiveDirectory, for which there is now Amazon WorkMail * Exchange, for which there is now Amazon WorkMail * Windows File Sharing, for which there is now Amazon WorkDocs * Windows desktops that can run MS Office ... for which there is sort of Amazon WorkSpaces The question now becomes: can I get away with running a 200-person company with no relationship with MS by deploying cheap-cheap Linux machines with a VNC-client to Amazon WorkSpaces for non-technical staff? And the answer is ... perhaps, but I need my people to be able to work without an internet connection, so probably not. But still, that's fucking huge. The one piece missing in this lineup is capable local Office apps. You simply cannot get away with not having Excel, Word, and Outlook's Calendar functionality ... yet. Finance, Admin, Management, and non-dev IT will riot without Excel; Admin, Sales, and Management will riot without Word; Sales and Management will riot without Outlook, and blood will be spilled over the management of more than two meeting rooms. OpenOffice, LibreOffice, whatever, they don't cut it in the real world. So while it doesn't sound like their game, if Amazon were to release a lock-down-able Linux and some high-quality Office apps, they can take SME IT away from Microsoft. That's is HUGE. Hell, if they can put together a package that can run Office under WINE reliably, and sort sensible licensing terms, it's just as huge, but I can't see MS allowing that licensing part to happen, because it would be suicide. Interesting times! [1] I don't care how Canonical or RedHat manage their internal IT [2] Nor do I care about how your 11 person social media startup does it [3] I too did all my best IT management before I became responsible for it [4] Seriously.

ts330 12y ago
Someone buy this man a beer.

known 12y ago

What's it USP?

ukigumo 12y ago

Hopefully this means AWS will also be implementing DNSSEC which I need in order to implement DANE on my own secure mail solution.

chatman 12y ago

And Amazon uses Outlook for internal office mail and calendar. What an irony?

jdub 12y ago
Why irony? You can use Outlook as a client for WorkMail. I wouldn't be surprised if they shift to WorkMail once it satisfies their large enterprise requirements (given that it's an MVP right now).