<story><title>Hundreds of exposed Amazon cloud backups found leaking sensitive data</title><url>https://techcrunch.com/2019/08/09/aws-ebs-cloud-backups-leak</url></story><parent_chain><item><author>dboreham</author><text>Laziness in attempting to share data with someone in another org?&lt;p&gt;&amp;quot;Nope, can&amp;#x27;t access it&amp;quot; ...&lt;p&gt;&amp;quot;Nope, still can&amp;#x27;t access it&amp;quot;...&lt;p&gt;&amp;quot;My manager is harassing me to get access now&amp;quot;...&lt;p&gt;&amp;quot;Look, just make it public then change it back after I get it copied&amp;quot;...</text></item><item><author>joncrane</author><text>I&amp;#x27;ve been working almost exclusively in the AWS space for about 10 years now.  Clients anywhere from tiny little three-person consultancies to Fortune 100.  Commercial, govcloud, dozens of clients.&lt;p&gt;Never once have I ever found a use case for making public EBS snapshots.&lt;p&gt;Who on Earth is thinking that it is a good idea to take an EBS snapshot and make it public?&lt;p&gt;Note, several of those engagements did involve multiple accounts, and the need to share &amp;#x2F; copy AMIs and&amp;#x2F;or snapshots between accounts.  But never making them public.</text></item></parent_chain><comment><author>privateSFacct</author><text>This 100%. I don&amp;#x27;t do much AWS stuff - but this issue exists outside of AWS as well (inside a corp).&lt;p&gt;It&amp;#x27;s why I hate all the password rotation, double VPN stuff - people work around it too much.&lt;p&gt;All the old staff start having the tech person track their passwords or write them near the computer, all the young staff use whatever new .io domain does X super easily (but less securely) or stick things on thumb driver (no keypad) or use their personal google drive etc.</text></comment>
<story><title>Hundreds of exposed Amazon cloud backups found leaking sensitive data</title><url>https://techcrunch.com/2019/08/09/aws-ebs-cloud-backups-leak</url></story><parent_chain><item><author>dboreham</author><text>Laziness in attempting to share data with someone in another org?&lt;p&gt;&amp;quot;Nope, can&amp;#x27;t access it&amp;quot; ...&lt;p&gt;&amp;quot;Nope, still can&amp;#x27;t access it&amp;quot;...&lt;p&gt;&amp;quot;My manager is harassing me to get access now&amp;quot;...&lt;p&gt;&amp;quot;Look, just make it public then change it back after I get it copied&amp;quot;...</text></item><item><author>joncrane</author><text>I&amp;#x27;ve been working almost exclusively in the AWS space for about 10 years now.  Clients anywhere from tiny little three-person consultancies to Fortune 100.  Commercial, govcloud, dozens of clients.&lt;p&gt;Never once have I ever found a use case for making public EBS snapshots.&lt;p&gt;Who on Earth is thinking that it is a good idea to take an EBS snapshot and make it public?&lt;p&gt;Note, several of those engagements did involve multiple accounts, and the need to share &amp;#x2F; copy AMIs and&amp;#x2F;or snapshots between accounts.  But never making them public.</text></item></parent_chain><comment><author>heyoni</author><text>&lt;i&gt;goes home completely forgetting to change it back...&lt;/i&gt;</text></comment>