Hacker News

points by lawabider 3 days ago | 0 comments

I have avoided Intel products since the time some law enforcement forensic team used DCILeech to read the RAM of my server hosted at Hetzner and extracted a LUKS key from it. That was a lifelong lesson. There is no guarantee AMD won't come up with similar shenanigans like Intel's DCI soon and of course we don't know what PSP does behind the scenes, but at least for now, they are generally better for anti-forensics-tuned Linux kernels.

[–] dingaling911 3 days ago

If you assume the machine will be compromised, is there any way around this?

[–] basilikum 3 days ago

Confidential computing and hardware security are starting to be an actual thing now. They are mostly used for DRM and I would not trust them when your adversary is three letters long.

Hardware security used to be a joke. Now verified boot, encrypted RAM, key storage in hardware security models and hardware and OS attestation are getting somewhere.

But if you're important enough of a target to a state actor they will magically have some workaround. For your average raid on your home they might actually work depending on the specific setup.

For really high threat models you want zero trust models with E2EE as well as staying anonymous so no one knows where the hardware (and the people which might be much more vulnerable) are located. Tor exists for a reason.

[–] nvme0n1p1 3 days ago

Yep, physical access = game over. A tale as old as time. It doesn't matter who etched the silicon.

[–] dingaling911 3 days ago

Telegram supposedly gets around this by distributing keys over various regions.

But surely intel services are smart enough to get people in there illegally.

[–] mahemm 3 days ago

90% of Telegram chats live in cleartext on their servers; no one would need to go to those lengths to get chat data from them.

[–] rednb 3 days ago

Telegram chats not being end-to-end crypted are encrypted at rest on their servers. In this case telegram definitely controls the encryption keys but distributes them across jurisdictions to mitigate some risks.

[–] ecshafer 3 days ago

There's also no way around a $5 wrench, but you'd be hard pressed to find that wrench for $5.

[–] piyh 3 days ago

Full story pls?

[–] Doohickey-d 3 days ago

It's not the OP's story, but it's also not the first story of things hosted at Hetzner being intercepted. Best to not host "such" things there, since they seem quite compliant in that regard: https://notes.valdikss.org.ru/jabber.ru-mitm/ (comments at the time: https://news.ycombinator.com/item?id=37955264 )

[–] theturtletalks 3 days ago

Look into the WireCard scandal. WireCard was the Stripe of EU worth billions. They were even audited by one of the big 4 firms and they confirmed it was a real company.

Turns out it was a front for Russian intelligence. Even after the German government found out, the guy still somehow escaped to Russia. There’s a solid chance that Russia operatives have infiltrated the German government. They was even a big hack Russia’s state hackers did and a lot of information was leaked.

I bring this up because Hetzner was asking for my passport to buy a $10/m server. Simple opsec says to just pay a bit more and use DigitalOcean or some other VPS.

[–] sofixa 3 days ago

You're twisting the Wirecard to such an extent it's de facto wrong.

Wirecard were a German fintech, but didn't have big market penetration across Europe. They were a real company with real operations, but a decent part of its balance sheet was fake (supposedly it was in an Asian subsidiary, there was no money there). It wasn't a front for Russian intelligence, it's COO was a Russian operative (and nowadays runs a shadow intelligence agency from Moscow, using incompetent morons to try to kidnap journalists, or scheming to hire ISIS suicide bombers to blow them up); those connections only surfaced after the whole thing imploded. But the whole company was an actual real place with real operations and real non-russian intelligence employees. It's still not certain if the CEO knew about the COO for instance.

Read the FT series on the whole thing, their investigation started the collapse.

[–] mort96 3 days ago

Yeah I tried to move to Hetzner, but bounced off when they wanted my passport info. I've since moved to OVH, where I get significantly more resources for the same money compared to DO, they're a European company hosting in Europe (getting away from US tech was the primary reason I was looking for DO alternatives), and they never asked for my passport!

There are many good non-Hetzner European hosting companies, luckily.

[–] purpleidea 3 days ago

OVH is also asking for id card photos, and full face photos, and I wish there were good hosting companies around.

[–] nekitamo 3 days ago

I can recommend Netcup in Germany. They didn't ask me for ID at the very least.

[–] purpleidea 3 days ago

They don't offer physical/dedicated servers. That's the key!

[–] nsoam 3 days ago

I have no idea what this has to do with the topic at hand. What does KYC from Hetzner have to do with Wirecard? Do you mean to say that you suspect that Russia is behind Hetzner?

[–] theturtletalks 3 days ago

That case was so baffling, it left me forever doubting German companies, especially ones that ask for my passport. A lot of businesses used WireCard, even the government itself.

[–] 2OEH8eoCRo0 3 days ago

The documentary about that was crazy. Like a real life spy thriller.

https://www.netflix.com/title/81404807

[–] Foobar8568 3 days ago

What? I don't remember that it turned out to be a front for Russian intelligence. WTH https://en.wikipedia.org/wiki/Jan_Marsalek

[–] dralley 3 days ago

It was messy. A number of agencies of the German government, including a handful of intelligence agencies, used Wirecard for banking.

[–] dboreham 3 days ago

Russian operatives have definitely infiltrated the US government.

[–] nutjob2 3 days ago

Yes, but just one man, at the very top.

[–] wmf 3 days ago