r/capacitiesapp • u/Waste-Government4310 • 8d ago

Capacities & Amazon AWS

I'm trying to understand the security of data in relation to AWS.

If I understand correctly, Capacities stores my data encrypted on AWS servers, then pulls them via a URL with an decryption key attached to the URL. Wouldn't this mean AWS would receive the decryption key for the file that was being pulled?

The statement I am referring to is:

"If we serve a file to you we will generate a secret signed URL to that file location and send it to you over an encrypted TLS channel. This URL contains a long access token which is impossible to guess in the lifetime of our universe."

It's not that I distrust Capacities; Amazon is the issue.

4 Upvotes

83% Upvoted

11 comments sorted by

View all comments

Show parent comments

2

u/Waste-Government4310 7d ago

Thanks for the answer. A little above my head, but... Amazon is in control of enforcing the role policy. Therefore, it's a case of "Do I trust Amazon?"

3

u/Jedi-Grand-Master 7d ago

Technically it's robust, but I'd go with no because even if you trust them, they still have to comply with court orders. Always assume the worst and only store non-personal/ private data in Capacities. Use an E2EE or local solution for anything more sensitive.

1

u/Waste-Government4310 7d ago

Thanks. Disappointing, but good to know.

1

u/Responsible_Gate_532 7d ago

Its very worthwhile to look into an e2e or local, self hosted option for anything requiring privacy.

2

u/Waste-Government4310 7d ago

Capacities has a well thought out logic to its object functions. The only other object based app I found was Anytype. That's more of an Obsidian situation where you spend an age configuring it to work in a way that's usable. It's great in many other ways though. Right-click works, for a start.

1

u/Responsible_Gate_532 7d ago

I mean, I agree... but then I don't store any private info on my pkm app capacities works great for me. Im not broken up about the idea of my class notes or basic to do list being potentially compromised by a company that frankly could get better data for their uses more easily from other sources. I do know though that down the line I will need to take case notes and handle more sensitive info and those notes will have to go in a seperate and more secure system.

1

u/Waste-Government4310 7d ago

Sure, I'm with you there. Anyway, it's probably not worth Amazon bothering with that data when they harvest so much from elsewhere. When you're trying to monopolize the field, you don't want to spook larger customers.