6 ms·

What a nefarious move by Hetzner and Linode. How to trust them after this?

by zxwrt 3y ago

Nextgrid 3y ago
If it's a "lawful intercept" then they most likely have no choice.
dathinab 3y ago
first the article jumped the gun when saying it's by Hetzner/Linode, as it as much could have been done by the carrier the data-center connects to and from what I know about German espionage/wiretapping by police law that would be far more likely second pretty much _every_ country has laws which require carriers to help them wiretap in case of an investigation with appropriate court orders thirdly even if it went through Hetzner/Linode instead of carriers it wasn't done "a move from them" but something they where legally binding ordered to silently tolerate lastly if as unlikely as it seems it was not lawful interception of police or similar then they (or a carrier) would have been hacked, i.e. there is absolutely no chance that server providers will do such an attack on their own violation, especially Hetzner (they also don't have the legal means to get the necessary certificates)
- cassonmars 3y ago
  That "lawful" interception allows certificate issuance to be a means of wiretap completely undermines any trust one should have in CAs. It seems that an alternative is greatly needed.
- scraptor 3y ago
  The fact that they were legally required to MITM their customers does not make them more trustworthy (in the sense of unlikely to do it in the future), just the opposite! Of course that applies equally to any other cloud host (modulo jurisdiction games) but that does little to restore my interest in running my software on other peoples computers.
  - wlonkly 3y ago
    Or, presumably, using other people's internet peering, since the MITM was outside of the XMPP server host. I think jurisdiction games is all you have, because outside of that there's going to be _someone_ close to you network-wise who will fold when faced with a lawful intercept order.
  - Jenda_ 3y ago
    It's not about "other peoples computers" (there is no evidence of the system itself to be backdoored). If you are running on your own hardware in your own house, you still need an ISP that can do exactly this time of MITM.
  - dathinab 3y ago
    yes it applies to pretty much any datacenter and carrier in the world but that's why running thing at home doesn't help that much, because it also applies to carriers, too and when it comes to sizing data it tends to not make much difference whether they physically size disk at your home or in the data center, actually if legal order for a sizure like that is confirmed by a judge it's normally applied to all the computers such a person has, both at home and in datacenters

What a nefarious move by Hetzner and Linode. How to trust them after this?

by zxwrt 3y ago

What a nefarious move by Hetzner and Linode. How to trust them after this?

Nextgrid 3y ago

If it's a "lawful intercept" then they most likely have no choice.

dathinab 3y ago

first the article jumped the gun when saying it's by Hetzner/Linode, as it as much could have been done by the carrier the data-center connects to and from what I know about German espionage/wiretapping by police law that would be far more likely second pretty much _every_ country has laws which require carriers to help them wiretap in case of an investigation with appropriate court orders thirdly even if it went through Hetzner/Linode instead of carriers it wasn't done "a move from them" but something they where legally binding ordered to silently tolerate lastly if as unlikely as it seems it was not lawful interception of police or similar then they (or a carrier) would have been hacked, i.e. there is absolutely no chance that server providers will do such an attack on their own violation, especially Hetzner (they also don't have the legal means to get the necessary certificates)

cassonmars 3y ago
That "lawful" interception allows certificate issuance to be a means of wiretap completely undermines any trust one should have in CAs. It seems that an alternative is greatly needed.
scraptor 3y ago
The fact that they were legally required to MITM their customers does not make them more trustworthy (in the sense of unlikely to do it in the future), just the opposite! Of course that applies equally to any other cloud host (modulo jurisdiction games) but that does little to restore my interest in running my software on other peoples computers.
- wlonkly 3y ago
  Or, presumably, using other people's internet peering, since the MITM was outside of the XMPP server host. I think jurisdiction games is all you have, because outside of that there's going to be _someone_ close to you network-wise who will fold when faced with a lawful intercept order.
- Jenda_ 3y ago
  It's not about "other peoples computers" (there is no evidence of the system itself to be backdoored). If you are running on your own hardware in your own house, you still need an ISP that can do exactly this time of MITM.
- dathinab 3y ago
  yes it applies to pretty much any datacenter and carrier in the world but that's why running thing at home doesn't help that much, because it also applies to carriers, too and when it comes to sizing data it tends to not make much difference whether they physically size disk at your home or in the data center, actually if legal order for a sizure like that is confirmed by a judge it's normally applied to all the computers such a person has, both at home and in datacenters