S3 security is flawed by design