3 ms·

Your own self-hosted service on rented server / cloud instance? AFAIU (IANAL!!!) you can refuse to give evidences against yourself in most jurisdictions. I don

Your own self-hosted service on rented server / cloud instance? AFAIU (IANAL!!!) you can refuse to give evidences against yourself in most jurisdictions. I don't thinks that dedicated server provider (like Hetzner) or cloud provider (like Digital Ocean or Vultr) stores traffic logs with enough details to be useful in such case. But payment will be a problem...

upbeat_general 5y ago
It’s certainly possible that they store IP addresses. Even if they don’t, as long as they have the email address then they can probably find the mail server even if the payment is anonymous.
- ta988 5y ago
  They absolutely keep who used which IP at what time. And they do not allow anonymous purchases.
- blacklion 5y ago
  Find mail server itself — sure. Find all clients which submitted mail through it in the past — I'm in doubt. Anonymous/protected enough payment is the problem.
Sebb767 5y ago
You can't be compelled to incriminate yourself, but your server provider can very much be compelled to give access to the server. And once the server is physically compromised the battle is lost, anyway, but in that case probably with a larger papertrail leading to you. One expensive but possible option would be to build a server yourself with sufficient traps to shut off when it's tapered with. Then set it up with full disk encryption and put it in a shared rack.
- chrononaut 5y ago
  > .. and put it in a shared rack What would be the benefit of being in a shared rack? Wouldn't the service provider still know which physical system is yours if you only rented a 1/2/3U space? (Or is there an advantage at a network layer?)
  - Sebb767 5y ago
    The shared part is only for pricing, since renting a full rack for a single server is a bit overkill :) Going for a rack has the advantage that you own the hardware and can install the anti-tamper measures so that the server can't be turned against you. Anonymity wise, renting a server makes things a lot easier.
- blacklion 5y ago
  Dedicated server (with standard hardware) can be prepared to be almost tamper-protected, for almost everything realistic attacks. Yes, it will be prone to freeze memory (physical freeze, with liquid nitrogen or liquid helium), but I don't think that it is what police in any country will do. But as sibling comment mention, it can be seen as destroying of evidences in many jurisdictions :-(
PeterisP 5y ago
In most jurisdictions you can refuse to testify against yourself but you are still required to give up all physical evidence against yourself if an appropriate warrant requests them, the immunity only applies to things in your mind. Things like hiding or destroying evidence of a crime generally are separate crimes of which you can be convicted even if you're acquitted of the original crime (e.g. burying a corpse in the woods or throwing a gun in the river). Destruction of evidence with the intent to hide it from prosecution also may enable so called 'adverse inference' where essentially the jury/judge can assume that the destroyed evidence actually showed what the prosecution intended to find there. For example, if you're being prosecuted for possession of child sexual abuse material, there's a warrant for your hard drive, but it gets fully destroyed because you have rigged some device to destroy it (and the prosecution proves that you did that with the intent to destroy evidence) then the court may take it as a fact that the hard drive did indeed contain CSAM and treat it as sufficient evidence to convict you. In short, self-hosted service on a rented service does not provide much protection.
- blacklion 5y ago
  Here is interesting collision: password IS thing in my mind, for sure. But, as far as I understand, case law is not in my favor in this case :-(

upbeat_general 5y ago

It’s certainly possible that they store IP addresses. Even if they don’t, as long as they have the email address then they can probably find the mail server even if the payment is anonymous.

ta988 5y ago
They absolutely keep who used which IP at what time. And they do not allow anonymous purchases.
blacklion 5y ago
Find mail server itself — sure. Find all clients which submitted mail through it in the past — I'm in doubt. Anonymous/protected enough payment is the problem.

Sebb767 5y ago

You can't be compelled to incriminate yourself, but your server provider can very much be compelled to give access to the server. And once the server is physically compromised the battle is lost, anyway, but in that case probably with a larger papertrail leading to you. One expensive but possible option would be to build a server yourself with sufficient traps to shut off when it's tapered with. Then set it up with full disk encryption and put it in a shared rack.

chrononaut 5y ago
> .. and put it in a shared rack What would be the benefit of being in a shared rack? Wouldn't the service provider still know which physical system is yours if you only rented a 1/2/3U space? (Or is there an advantage at a network layer?)
- Sebb767 5y ago
  The shared part is only for pricing, since renting a full rack for a single server is a bit overkill :) Going for a rack has the advantage that you own the hardware and can install the anti-tamper measures so that the server can't be turned against you. Anonymity wise, renting a server makes things a lot easier.
blacklion 5y ago
Dedicated server (with standard hardware) can be prepared to be almost tamper-protected, for almost everything realistic attacks. Yes, it will be prone to freeze memory (physical freeze, with liquid nitrogen or liquid helium), but I don't think that it is what police in any country will do. But as sibling comment mention, it can be seen as destroying of evidences in many jurisdictions :-(

PeterisP 5y ago

In most jurisdictions you can refuse to testify against yourself but you are still required to give up all physical evidence against yourself if an appropriate warrant requests them, the immunity only applies to things in your mind. Things like hiding or destroying evidence of a crime generally are separate crimes of which you can be convicted even if you're acquitted of the original crime (e.g. burying a corpse in the woods or throwing a gun in the river). Destruction of evidence with the intent to hide it from prosecution also may enable so called 'adverse inference' where essentially the jury/judge can assume that the destroyed evidence actually showed what the prosecution intended to find there. For example, if you're being prosecuted for possession of child sexual abuse material, there's a warrant for your hard drive, but it gets fully destroyed because you have rigged some device to destroy it (and the prosecution proves that you did that with the intent to destroy evidence) then the court may take it as a fact that the hard drive did indeed contain CSAM and treat it as sufficient evidence to convict you. In short, self-hosted service on a rented service does not provide much protection.

blacklion 5y ago
Here is interesting collision: password IS thing in my mind, for sure. But, as far as I understand, case law is not in my favor in this case :-(