German Cloud Company Offering Free Heat If You Have Room for Some of Its Servers • Hacker News Board

Re: German Cloud Company Offering Free Heat If You Have Room for Some of Its Servers

#51

Post by willvarfar » Thu, Nov 13, 2014, 2:41 PM UTC

Xylakant wrote: post #40

vertex-four wrote: post #37

Earlier quoted context omitted.

They'd need to immediately shut down their server as well (as in immediately , as in crash), and even that's not necessarily enough to remove data from RAM before attackers can get to it.

The threat scenario is a bit far fetched. First you'd need to find out where an individual, interesting piece of data is stored. Then you have to break into this building, break open the cabinet and freeze the RAM fast enough to preserve the memory content. That's obviously something that can be done, but it requires a lot of dedication to pull of, so that's something you'd only do in case where you know the data is…

Its not at all far fetched.

The very first people to sign up will all be budding security enthusiasts secretly looking forward to their prime time on Chaos Computer Club or BlackHat or whatever where they take apart one of these servers.

Re: German Cloud Company Offering Free Heat If You Have Room for Some of Its Servers

#52

Post by valarauca1 » Thu, Nov 13, 2014, 2:44 PM UTC

Xylakant wrote: post #43

valarauca1 wrote: post #38

Earlier quoted context omitted.

This doesn't solve the problem. Unless the cabinet is air tight, and uses a pressure sensor to detect itself being opened. It's "Is the cabinet open?" subroutine can be defeated by simply opening the cabinet where a sensor isn't located. Basically cut the sucker open on the side. :.:.: Also by using a time sharing OS its likely you can induce a large network based load externally slowing its IO speed to the level you…

A possible approach would be: keep the data encrypted, just decrypt it at the endpoint. Tarsnap for example does that. Or keep the keys on servers that are acting as proxies and decrypt the data. Or actually loose all data on door opening. Just drop it and use a replication like backblaze and S3 use. A harddrive lost? Allocate a shard somewhere else. A unit looses enough harddrives to require service? Just pull it, t…

Likely extreme mirroring + no keys actually kept on the unit. They just store N byte chunks of data which a master somewhere fetches an decrypts at its leisure would be the best approach. (with key value pairs stored on that said machine).

Best approach not necessarily being the one that was put into production.

The fastest approach would be to store your key value pairs encrypted on the host device, and do your map/reduce functions locally so you only forward relatively useful data.

Re: German Cloud Company Offering Free Heat If You Have Room for Some of Its Servers

#53

Post by thraxil » Thu, Nov 13, 2014, 2:51 PM UTC

justinsb wrote: post #30

thraxil wrote: post #19

> Security is a concern with these setups, because anyone’s data could be in anyone else’s house at a given time, but Cloud&Heat claims that since all of its data is encrypted and only its employees can open the cabinets that everyone’s information is safe. Unless they've cracked the problem of practical fully homomorphic encryption, that data is still going to be unencrypted at some point in those units and vulnerab…

Rather than cracking the problem of practical fully homomorphic encryption, I think they're probably cracked the problem of deleting the keys when the physical security of the cabinet is compromised.

It means that at best, they've reduced the problem to safe cracking. And it's a "safe" that has to have channels for power, data, and hot water/air to go in and out and sits unguarded in the potential attacker's house for as long as they need.

No safe is "uncrackable", they just get rated at how much time/expense it would take a pro to break in and then you don't store anything in it that's more valuable than that.

If I'm a potential customer looking to process my data on these servers, I would want to know what the equivalent rating is.

Re: German Cloud Company Offering Free Heat If You Have Room for Some of Its Servers

#54

Post by mhurron » Thu, Nov 13, 2014, 2:51 PM UTC

hrnnnnnn wrote: post #26

Excerpts from the contract: "We install The Device in your house, free of charge. You receive heat. Do not ask about the function of The Device." "You may hear a human voice coming from inside The Device. Ignore it." "Some customers report having recurring dreams about The Device, this is normal." "The Device comes in one colour: Impenetrable Blackness." "Behold, I will corrupt your seed, and spread dung upon your fa…

It's good to see a contract written in clear, understandable language.

Re: German Cloud Company Offering Free Heat If You Have Room for Some of Its Servers

#55

Post by Retric » Thu, Nov 13, 2014, 2:55 PM UTC

sauere wrote: post #28

> Security is a concern with these setups, because anyone’s data could be in anyone else’s house at a given time, but Cloud&Heat claims that since all of its data is encrypted and only its employees can open the cabinets that everyone’s information is safe. Ladies and Gentlemen, i present: Bullshit. I wish companies with no clue about encryption would stop making these insane claims.

Depends on usage patterns.

If there simply storing encrypted data then these servers might be unable to decrypt the stored information and reading their contents would be pointless.

If on the other hand these servers decrypt the data then encryption is of limited value.

Re: German Cloud Company Offering Free Heat If You Have Room for Some of Its Servers

#56

Post by toxican » Thu, Nov 13, 2014, 2:57 PM UTC

jqm wrote: post #31

I wish I could sign up for this. I still use dial up. Is that going to be a problem?

Not in '96 it won't be!

Re: German Cloud Company Offering Free Heat If You Have Room for Some of Its Servers

#57

Post by Xylakant » Thu, Nov 13, 2014, 3:27 PM UTC

owenmarshall wrote: post #50

Xylakant wrote: post #40

Earlier quoted context omitted.

The threat scenario is a bit far fetched. First you'd need to find out where an individual, interesting piece of data is stored. Then you have to break into this building, break open the cabinet and freeze the RAM fast enough to preserve the memory content. That's obviously something that can be done, but it requires a lot of dedication to pull of, so that's something you'd only do in case where you know the data is…

Or freeze the entire cabinet in situ and pick through the RAM at your leisure. But yeah, you're right - this isn't gonna happen. I'd worry more about a home below floodplain taking on water.

Yeah, sure. Nobody would ever notice the truck with the coolant tank in front of the building and the frozen pipes running in ;). Here in Berlin they freeze the ground to make excavations in places with high ground water, that looks the same.

To be honest - law enforcement could pull that off. But that's not the threat model that this is supposed to counter.

Re: German Cloud Company Offering Free Heat If You Have Room for Some of Its Servers

#58

Post by Xylakant » Thu, Nov 13, 2014, 3:28 PM UTC

willvarfar wrote: post #51

Xylakant wrote: post #40

Earlier quoted context omitted.

The threat scenario is a bit far fetched. First you'd need to find out where an individual, interesting piece of data is stored. Then you have to break into this building, break open the cabinet and freeze the RAM fast enough to preserve the memory content. That's obviously something that can be done, but it requires a lot of dedication to pull of, so that's something you'd only do in case where you know the data is…

Its not at all far fetched. The very first people to sign up will all be budding security enthusiasts secretly looking forward to their prime time on Chaos Computer Club or BlackHat or whatever where they take apart one of these servers.

Cool, free pentesting. If I'd plan such an offer I'd give away units for free to CCC members that want to penetrate it. Maybe even throw in some money.

Re: German Cloud Company Offering Free Heat If You Have Room for Some of Its Servers

#59

Post by pbhjpbhj » Thu, Nov 13, 2014, 3:31 PM UTC

vertex-four wrote: post #37

justinsb wrote: post #29

Earlier quoted context omitted.

What is the attack you're envisaging? Presumably they detect unauthorized case-intrusion and immediately delete the keys. This isn't foolproof, but it's probably good enough to stop anyone except the people that are going to get the data no matter what you do.

They'd need to immediately shut down their server as well (as in immediately , as in crash), and even that's not necessarily enough to remove data from RAM before attackers can get to it.

>remove data from RAM before attackers can get to it //

Seems about the last thing you'd try too. Surely you'd try and catch the data on the wire a long time before you'd even contemplate this sort of scenario. At least then you have the chance to get the whole encrypted file you're after.

Re: German Cloud Company Offering Free Heat If You Have Room for Some of Its Servers

#60

Post by kordless » Thu, Nov 13, 2014, 3:42 PM UTC

> Still, it's more reassuring to think that your data is stored in a remote server farm than in someone’s house.

That depends entirely on your use cases. Making comments like this without mentioning the wide range of trust levels with different use cases is short sighted.