Mitigating the Hetzner/Linode XMPP.ru MitM interception incident

Post by [deleted] » Sat, Oct 21, 2023, 9:19 PM UTC

chatmasta wrote: post #120

petre wrote: post #118

Earlier quoted context omitted.

I know. Most of them have a fill in the blanks sheet with name address and document s/n. I can understand scanning documents if one rents a vehicle, although for hotels I fail to see why the form shouldn't be enough. It's not like they don't have cameras at the reception desk and I don't pay with a card under my name, they can also check my ID and fill in the form themselves if they don't trust the customer. Why shou…

Interesting. That didn't happen to me when I stayed a month in an Airbnb in Serbia, although the host did ask me for a copy of my passport. (Not that I'd expect it from an Airbnb host even if hotels were doing it... just an additional data point). For renting a vehicle (or more likely, something like a bike or moped), I can understand why they take your ID as a form of collateral in exchange for the material goods th…

Post by deeth_starr_v » Sat, Oct 21, 2023, 9:53 PM UTC

lathiat wrote: post #91

tetromino_ wrote: post #40

Earlier quoted context omitted.

No. Most probably it merely implies someone upstream of them (presumably their hosting provider under compulsion from German law enforcement) intercepted and spoofed their unencrypted, unauthenticated ACME HTTP traffic. Same can happen to you.

The same way they are intercepting the jabber port they can intercept any other port for the HTTP ACME challenge. No need to get involved at the name server level.

Post by skissane » Sun, Oct 22, 2023, 12:14 AM UTC

chatmasta wrote: post #113

skissane wrote: post #33

Earlier quoted context omitted.

A business can request visiting law enforcement to do all those things, and hopefully law enforcement complies. However, if they refuse to comply, realistically you just have to let them in anyway. Document their non-compliance and provide it to your lawyers, who can decide what action to take (lodge a formal complaint to the law enforcement agency, apply to a judge for an injunction to compel their compliance, etc)…

> realistically you just have to let them in anyway No, you don't. If they have a warrant then you need to let them in for the purposes specified in the warrant. Otherwise you're free to tell them to piss off. Unfortunately you're also free to acquiesce to any of their demands. This kind of passive, default-compliant attitude from service providers, while understandable from a "path of least resistance" standpoint, i…

Post by jacquesm » Sun, Oct 22, 2023, 12:52 AM UTC

OmarAssadi wrote: post #80

manxman wrote: post #53

Earlier quoted context omitted.

Agree re: everything you said but wanted to add datadentre security staff are some of the most interesting characters I’ve encountered. Not sure I sleep as well at night after seeing what I saw.

Do tell, please; stories about "interesting characters" are often the best.

Post by immibis » Sun, Oct 22, 2023, 11:06 AM UTC

mjevans wrote: post #9

LeoPanthera wrote: post #6

Earlier quoted context omitted.

I would suggest that if you are the police, you can break into a datacenter with a flash of a badge. I can't imagine many would attempt to stop you.

I would hope they at least: * Require a copy of the badge number, and verify that this officer is assigned and expected to be at this business right now. * Require them to sign into and out of the site. * Annotate which systems / compromises are in place. - That all of the above MIGHT be sealed under a court order; I would hope any such order has an automatic 'sunset' date, and possibly renewal upon review by a diffe…