4 ms·
They are however the entity most capable of actually accessing the data for nefarious purposes. Any other entity would need to go through the hoster first, whic
by welterde 4y ago
They are however the entity most capable of actually accessing the data for nefarious purposes.
Any other entity would need to go through the hoster first, which means either mounting a physical attack on the actual data center or compromising their systems to gain access.
However with dedicated servers the next step is more complicated for both the hoster and the potential other attackers, since the only chance they have here is to catch the key material during reboots, which is quite a bit more noisy than silently extracting the key from ram of a running VM (especially since they would need to mirror the disks or other complications to have access at the same time as you are using the machine).
If it's a colocated machine (or if the hoster trusts you enough with their dedicated machines) one can use TPM/Secure Boot to make the MITM attack very very difficult (since one can use something like dropbear to have an encrypted and authenticated connection to enter the encryption credentials and TPM/Secureboot can prevent manipulation of the bootloader).
- isbvhodnvemrwvn 4y agoI trust in Azure much more than solutions like that. I'd imagine most of their customers do too.
- welterde 4y agoThen we are back to the starting point. If you are already trusting Azure what's exactly the threat model the encryption is supposed to protect against?
- speedgoose 4y agoI see two: someone physically stealing the storage devices, or Microsoft disposing of the storage devices without destroying them first.
- welterde 4y agoWhich both mean that you cannot really trust Azure. Although the latter is an easy mistake to make for hosting providers and thus indeed a valid threat model. The theft scenario is exactly the reason why you wouldn't want to trust Azure to do the encryption for you, since they can just extract the plain text data from the virtual machine. Unless you are saying you don't trust Azure datacenter techs only? And for preventing the leakage from old storage devices very non-fancy and simplistic encryption setups are good enough (most of the complexity comes from trying to prevent/detect MITM or manipulation by the hosting provider).
- speedgoose 4y ago> Unless you are saying you don't trust Azure datacenter techs only? Yes, and also the local datacenter people. I understood that Microsoft didn’t build a datacenter in every region and rents some space in existing datacenters managed by other companies.