Amazon Kindle Fire, Silk: Security and Privacy Issues

Amazon Kindle Fire's web browser Silk has serious security and privacy issues. Amazon's web browser Silk is designed to pre render Web pages on the Amazon's EC2 server farm and send the rendered pages back to Kindle Fire. This is supposed to speed up the display of web pages on the Kindle Fire.

We however recommend that you configure the Silk browser to not use the Amazon Server Farm to render your pages if you are concerned about your privacy and security.

Amazon Kindle Fire and Silk: Privacy Issues

We suspect that a key reason that Amazon wants the Silk to use the Amazon EC2 farm for rendering is that they want to capture your browsing habits. Amazon is a retailer and this data is very valuable to them.

Using the data from people browsing the web on their Kindle Fires Amazon can know which user is buying what and what their interests are. Knowing the products that are trending and the amount the users are willing to pay for different products they can change the pricing and the product mix on their online stores.

According to Amazon Silk Terms and Conditions: Amazon Silk also temporarily logs web addresses -- known as uniform resource locators (“URLs”) -- for the web pages it serves and certain identifiers, such as IP or MAC addresses, to troubleshoot and diagnose Amazon Silk technical issues. We generally do not keep this information for longer than 30 days.

Other questions whose answers we are not quite sure about are:

Though the data for the individual user will be deleted in 30 days, is such data being aggregated and stored? If so can your individual browsing habits be guessed from the aggregated data?

Amazon Kindle Fire and Silk Browser: Security Concerns

Since the rendering of the page is taking place on the server farm, the server farm has access to all the data you are processing on the Silk web browser running on Kindle Fire. This means that Amazon can take a look at your banking data and the content of your emails.

For processing sensitive data on the web we use the https protocol. This protocol ensures that sensitive data between the web server and the web browser cannot be intercepted and read by an eavesdropper.

The Kindle Fire renders https pages also on the server farm and so end to end security between the web server and the web browser is not there. The server farm also has access to your secure data. Now besides the client device, the Kindle Fire, there is an additional place where a security breach may happen - the Amazon Server Farm.

What? You say Amazon's EC2 server farm will have the tightest levels of security and a security breach will never take place there. Recent history is replete with security breaches happening at places where no security breach should have occurred.

A way around this is to use the mode where Amazon's EC2 server farm is not used to pre render or pre cache sensitive data.

The Opera Mini Browser has a similar processing mode, and some banks block it for this very reason.

Amazon Kindle Fire and Silk Browser: Unlikely but possible

Since the browsing is taking place on Amazon server, Amazon at some point can slow down the rendering of their competitor's sites. For example, they can make Barnes and Noble site slower to load.

Technical Details

Prerendering and caching of web pages makes sense if

• The network connection is slow. A web page may have many embedded items. Making separate requests to servers on the web may consume too much time as compared to the download of a pre rendered and precached image.
• There is not enough storage on the device running the web browser to cache data which may be repeatedly used.
• The CPU on the web browser device is underpowered, so that is unable to process complex web pages

Now since the Kindle Fire is designed to be used on Wifi, the network is fast enough. The Kindle Fire should have a reasonable amount of storage space, enough for a web cache. We also suspect that the CPU has enough computing power to render web pages. Our cell phones have been rendering web pages reasonably well for quite some time.

Technically there seems to be no overwhelming reason to have the web browser show pre-rendered and pre-cached images from Amazon's EC2 server farm.

---

Back from Amazon Kindle Fire, Silk: Security and Privacy to Security and Privacy