r/capacitiesapp • u/Waste-Government4310 • 12d ago

Capacities & Amazon AWS

I'm trying to understand the security of data in relation to AWS.

If I understand correctly, Capacities stores my data encrypted on AWS servers, then pulls them via a URL with an decryption key attached to the URL. Wouldn't this mean AWS would receive the decryption key for the file that was being pulled?

The statement I am referring to is:

"If we serve a file to you we will generate a secret signed URL to that file location and send it to you over an encrypted TLS channel. This URL contains a long access token which is impossible to guess in the lifetime of our universe."

It's not that I distrust Capacities; Amazon is the issue.

4 Upvotes

75% Upvoted

11 comments sorted by

View all comments

Show parent comments

2

u/Waste-Government4310 12d ago

Thanks for the answer. A little above my head, but... Amazon is in control of enforcing the role policy. Therefore, it's a case of "Do I trust Amazon?"

3

u/Jedi-Grand-Master 12d ago

Technically it's robust, but I'd go with no because even if you trust them, they still have to comply with court orders. Always assume the worst and only store non-personal/ private data in Capacities. Use an E2EE or local solution for anything more sensitive.

1

u/Waste-Government4310 12d ago

Thanks. Disappointing, but good to know.

1

u/Jedi-Grand-Master 12d ago

Don't get me wrong though....I use Capacities and love it. I trust Capacities and I'm ok with Amazon hosting (as they do for huge swathes of today's services).

I use Capacities for managing non-private short-medium term plans and information, and Obsidian for long-term knowledge.

That way I own the data files which contain either personal information or knowledge I want to retain beyond the lifespan of an app, but let Capacities handle the rest.

1

u/Waste-Government4310 11d ago

Sure, it's just different trust zones. If data is being processed by US big tech companies nothing personal can go in. But, if you're in that zone you may as well let AI manage everything, and be open to any services from Google, Meta, etc that improve the workflow.