[danenania]

Thanks for the feedback and for laying out your investigation :)

I'd say it's pretty unfair to call a 20 char id 'security-by-obscurity', unless you want to call almost every username/password authentication mechanism the same. The id has vastly more entropy than the average password and is far beyond brute-forcible.

Along the same lines, there are no known attacks that can break 2048 bit PGP with a sufficiently strong passphrase.

So there are two layers of security that cannot be broken by any real-world attacks. I believe that is indeed sufficient for protecting customer data.

It's likely that we'll move away from the S3 failover eventually in favor of our own replication strategy. This wouldn't really have security implications, but it does make it simpler to have a single source of truth for logging, which is coming soon.

[ttldr]

all fair points. and your product seems to be designed/documented/marketed with the notion of keeping the username (which is part of the ENVKEY) secret, so agreed that "security-by-obscurity" is unfair (coupled w/ massive ID space).

your product is very well designed, seems like a tremendous customer experience. best of luck; i hope you continue to grow