11 ms·
Note the obvious caveat though: "There are of course other avenues available to obtain your data. Our colocation providers could be compelled to give physical
by andrewfong 13y ago
Note the obvious caveat though:
"There are of course other avenues available to obtain your data. Our colocation providers could be compelled to give physical access to our servers. Network capturing devices could be installed. And in the worst case an attacker could simply force their way into the datacentre and physically remove our servers."
As the colocation providers are based in the U.S., they would be subject to the National Security Letters. FastMail claims this is no different from any other hacking attempt. But in a normal hacking attempt, colocation providers would be free to explain to FastMail the extent of any hacking on their end. Moreover, hackers typically do not have physical access to any data. Even with encryption, physical access opens up a lot of attack vectors that most sysadmins don't anticipate.
- MichaelGG 13y agoIf they mount webcams and other sensors inside the cabinet, they could detect unexplained access to their servers. Not sure what it'd really accomplish. The colo provider would either say "tech mistakenly opened that cabinet" or "no comment". The only real defense is to assume any such access is a breach and have servers immediately overwrite FDE keys in RAM and power off - and if they were that committed, they wouldn't host in the US in the first place.
- jamesaguilar 13y agoFull disk encryption would be another option, with the key being obtained over a secure channel from servers hosted remotely before booting to the real system. Then, as long as they can detect whether the server asking for the key has been compromised, I think it should be pretty safe. (Not a security researcher though, I wouldn't bet money on it.)
- toast0 13y agoRemotely detecting if the server is not compromised when you don't trust the physical surroundings is probably unsolvable. If your attackers are very motivated and have lots of resources, what's to prevent them from installing a ram bus signal analyzer during a scheduled/unscheduled downtime. This would be pretty hard to detect (absent an elaborate video monitoring setup), as a good analyzer should not impact the system being monitored.
- rdl 13y agoHardware Security Modules (HSMs) are supposed to be able to resist that kind of attack, but given we currently have a duopoly of fairly government (US and EU/UK) connected HSM manufacturers, and they devices aren't suitable (price and capabilities) for general purpose computing, we're kind of out of luck. A Free/Open HSM design would go a long way, along with more host-based trusted computing security (Intel SGX, etc.). But just physically controlling the surroundings is probably the only feasible option today.
- gaius 13y agoIntel? It's alleged that Intel is in on it! Any NSA-proof solution must be based on chips designed and fabbed outside the US.
- ams6110 13y agoBecause chips fabbed in China would never be compromised?
- gaius 13y agoSure, they might be, but what do I care what the Chinese govt knows about me? They're 10,000 miles away and I have no foreseeable plans to travel there. My own government, who I want to be free to criticize when they do something I disapprove of, that's something else.
- deleted 13y ago[deleted]
- duskwuff 13y agoThere is some historical precedent for such methods. I believe one popular CDN (possibly Akamai?) has its nodes set up with sensors of some variety to discard sensitive data if the hardware is exposed to light.
- dsl 13y agoDell (and possibly others) servers have chassis intrusion sensors that you can trap in software, and do with as you please.
- duskwuff 13y agoThis goes beyond chassis intrusion, though - the servers are set up to freak out if anyone even opens the cage to look at them.
- dsl 13y agoYeah, that is just bar room banter between nerds. I've stood next to unprotected racks of Akamai servers and nothing happened. Nobody really builds systems where an HVAC engineer walking into your cage to move a cooling tile will cause an outage, they just love to talk about how they would build them.
- brongondwana 13y agoAnd we'd want to turn that off every time we got them to replace a hard disk... I wonder how many "sorry, the hairtrigger anti-intrustion systems took the site down" outages it would take before people begged us to turn the sensitivity down.
- Vivtek 13y agoHow likely is it that Fastmail data could be obtained without anybody at Fastmail noticing? And the key point is that Fastmail cannot be complied to keep such an attempt secret - which is not the case for a US company.
- Vivtek 13y ago"Compelled", not "complied"... Ugh. Posting before breakfast: always a mistake.
- kijin 13y agoAccording to a FastMail representative: > We use encryption to make hard drives worthless if they are stolen or just misplaced. [1] [1] http://www.emaildiscussions.com/showpost.php?p=561920&postcount=39 http://www.emaildiscussions.com/showpost.php?p=561920&postco... Anything that makes hard drives unreadable by thieves would probably also make them unreadable by any U.S. agency that seizes them. Unless of course NSA has already broken the algorithms used by the disk encryption software.
- Wingman4l7 13y ago...or if they use RSA at too low of a bit depth: https://news.ycombinator.com/item?id=6506120 https://news.ycombinator.com/item?id=6506120
- mike_esspe 13y agoEncrypted HDD won't help against cold boot attack.
- kijin 13y agoI doubt that an unexpected reboot and chassis intrusion (to install a compromized bootloader, for example) will go unnoticed by FastMail staff.
- MichaelGG 13y agoThat was what my comment was addressing: What will they do if that happens? Suppose a machine goes offline for a minute then comes back. Datacenter says nothing or says "we have no records of a power issue" or something to that effect. Now what? If Fastmail's software didn't wipe the key from RAM, it may be already compromised. Do they shutdown that colo facility? If so, why are they in the US in the first place?