I have avoided Intel products since the time some law enforcement forensic team used DCILeech to read the RAM of my server hosted at Hetzner and extracted a LUKS key from it. That was a lifelong lesson. There is no guarantee AMD won't come up with similar shenanigans like Intel's DCI soon and of course we don't know what PSP does behind the scenes, but at least for now, they are generally better for anti-forensics-tuned Linux kernels.

▲

dingaling911 8 hours ago | parent | next [-]

If you assume the machine will be compromised, is there any way around this?

▲

basilikum 15 minutes ago | parent | next [-]

Confidential computing and hardware security are starting to be an actual thing now. They are mostly used for DRM and I would not trust them when your adversary is three letters long.

Hardware security used to be a joke. Now verified boot, encrypted RAM, key storage in hardware security models and hardware and OS attestation are getting somewhere.

But if you're important enough of a target to a state actor they will magically have some workaround. For your average raid on your home they might actually work depending on the specific setup.

For really high threat models you want zero trust models with E2EE as well as staying anonymous so no one knows where the hardware (and the people which might be much more vulnerable) are located. Tor exists for a reason.

▲

nvme0n1p1 7 hours ago | parent | prev | next [-]

Yep, physical access = game over. A tale as old as time. It doesn't matter who etched the silicon.

▲

dingaling911 7 hours ago | parent [-]

Telegram supposedly gets around this by distributing keys over various regions.

But surely intel services are smart enough to get people in there illegally.

▲

mahemm 6 hours ago | parent [-]

90% of Telegram chats live in cleartext on their servers; no one would need to go to those lengths to get chat data from them.

	▲	rednb 4 hours ago \| parent [-]
		Telegram chats not being end-to-end crypted are encrypted at rest on their servers. In this case telegram definitely controls the encryption keys but distributes them across jurisdictions to mitigate some risks.

▲

ecshafer 5 hours ago | parent | prev [-]

There's also no way around a $5 wrench, but you'd be hard pressed to find that wrench for $5.

▲

piyh 8 hours ago | parent | prev | next [-]

Full story pls?

▲

Doohickey-d 8 hours ago | parent [-]

It's not the OP's story, but it's also not the first story of things hosted at Hetzner being intercepted. Best to not host "such" things there, since they seem quite compliant in that regard: https://notes.valdikss.org.ru/jabber.ru-mitm/ (comments at the time: https://news.ycombinator.com/item?id=37955264 )

▲

theturtletalks 8 hours ago | parent | next [-]

Look into the WireCard scandal. WireCard was the Stripe of EU worth billions. They were even audited by one of the big 4 firms and they confirmed it was a real company.

Turns out it was a front for Russian intelligence. Even after the German government found out, the guy still somehow escaped to Russia. There’s a solid chance that Russia operatives have infiltrated the German government. They was even a big hack Russia’s state hackers did and a lot of information was leaked.

I bring this up because Hetzner was asking for my passport to buy a $10/m server. Simple opsec says to just pay a bit more and use DigitalOcean or some other VPS.

▲

nsoam 7 hours ago | parent | next [-]

I have no idea what this has to do with the topic at hand. What does KYC from Hetzner have to do with Wirecard? Do you mean to say that you suspect that Russia is behind Hetzner?

	▲	theturtletalks 6 hours ago \| parent [-]
		That case was so baffling, it left me forever doubting German companies, especially ones that ask for my passport. A lot of businesses used WireCard, even the government itself.

▲

mort96 7 hours ago | parent | prev | next [-]

Yeah I tried to move to Hetzner, but bounced off when they wanted my passport info. I've since moved to OVH, where I get significantly more resources for the same money compared to DO, they're a European company hosting in Europe (getting away from US tech was the primary reason I was looking for DO alternatives), and they never asked for my passport!

There are many good non-Hetzner European hosting companies, luckily.

▲

sofixa 5 hours ago | parent | prev | next [-]

You're twisting the Wirecard to such an extent it's de facto wrong.

Wirecard were a German fintech, but didn't have big market penetration across Europe. They were a real company with real operations, but a decent part of its balance sheet was fake (supposedly it was in an Asian subsidiary, there was no money there). It wasn't a front for Russian intelligence, it's COO was a Russian operative (and nowadays runs a shadow intelligence agency from Moscow, using incompetent morons to try to kidnap journalists, or scheming to hire ISIS suicide bombers to blow them up); those connections only surfaced after the whole thing imploded. But the whole company was an actual real place with real operations and real non-russian intelligence employees. It's still not certain if the CEO knew about the COO for instance.

Read the FT series on the whole thing, their investigation started the collapse.

▲

2OEH8eoCRo0 7 hours ago | parent | prev | next [-]

The documentary about that was crazy. Like a real life spy thriller.

https://www.netflix.com/title/81404807

▲

Foobar8568 7 hours ago | parent | prev | next [-]

What? I don't remember that it turned out to be a front for Russian intelligence. WTH https://en.wikipedia.org/wiki/Jan_Marsalek

	▲	dralley 7 hours ago \| parent [-]
		It was messy. A number of agencies of the German government, including a handful of intelligence agencies, used Wirecard for banking.

▲

dboreham 6 hours ago | parent | prev [-]

Russian operatives have definitely infiltrated the US government.

	▲	nutjob2 2 hours ago \| parent [-]
		Yes, but just one man, at the very top.

▲

wmf 7 hours ago | parent | prev [-]

All hosting providers comply with local law enforcement.

	▲	Computer0 an hour ago \| parent [-]
		Not all

▲

varispeed 8 hours ago | parent | prev [-]

All devices have such backdoors.