3 ms·
Because the NSA actively intercepts that traffic. There's a reason why encryption is non optional
by 20k 1y ago
Because the NSA actively intercepts that traffic. There's a reason why encryption is non optional
- Karrot_Kream 1y agoTo me this seems outlandish (e.g. if you're part of PRISM you know what's happening and you're forced to comply.) But to think through this threat model, you're worried that the NSA will tap intra-DC traffic but not that it will try to install software or hardware on your hosts to spy traffic at the NIC level? I guess it would be harder to intercept and untangle traffic at the NIC level than intra-DC, but I'm not sure?
- viraptor 1y ago> you're worried that the NSA will tap intra-DC traffic but not that it will try to install software or hardware on your hosts It doesn't have to be one or the other. We've known for over a decade that the traffic between DCs was tapped https://www.theguardian.com/technology/2013/oct/30/google-reports-nsa-secretly-intercepts-data-links https://www.theguardian.com/technology/2013/oct/30/google-re... Extending that to intra-DC wouldn't be surprising at all. Meanwhile backdoored chips and firmware attacks are a constant worry and shouldn't be discounted regardless of the first point.
- adgjlsfhk1 1y agoThe difference between tapping intra-DC and in computer spying is that in computer spying is much more likely to get caught and much less easily able to get data out. There's a pretty big difference between software/hardware weaknesses that require specific targeting to exploit and passive scooping everything up and scanning
- heavyset_go 1y ago> (e.g. if you're part of PRISM you know what's happening and you're forced to comply.) Only a handful of people need to know what happens in Room 641A, and they're compelled or otherwise incentivized not to let anyone else know.
- codedokode 1y ago> you're worried that the NSA will tap intra-DC traffic but not that it will try to install software or hardware on your hosts to spy traffic at the NIC level It might not be able to, if you use secure boot and your server is locked in a cage.
- exabrial 1y agoImaginary problems are the funnest to solve.
- 20k 1y agoIts a stone cold fact that the NSA does this, it was part of the snowden revelations. Don't spread FUD about security, its important
- cherryteastain 1y agoIf you are concerned about this, how do you think you could protect against AWS etc allowing NSA to snoop on you from the hypervisor level?
- heavyset_go 1y agoAssuming the PSP isn't backdoored, using AMD SME and SEV theoretically allow you to run VMs that are encrypted such that, even at the hypervisor level, you can't read code or data from the VM.
- codedokode 1y agoYou cannot assume that. The solution is to have a server on your territory and use the datacenter only to forward the packets.