Hacker News Reader

Comment by tyfon | Hacker News Reader

As of today we have cloud offerings of for instance azure completely separate from the US companies due to this.

Here in Norway we can get the complete azure offering from a company called Evry using azure stack [1] and there is a data centre like this in Germany too at least that I know of, probably many more.

And sectors like government and banking are required to use them and not the parent companies offerings, especially if it contains PII.

If this goes on I suspect a lot of the revenue US tech companies see today will disappear even if (for now) most run the licensed version of azure stack and the like.

[1] https://www.evry.com/en/what-we-do/key-services/evry-cloud-s...

View on HN

The German one at least was cancelled recently [0] (source in German).

[0] https://www.heise.de/newsticker/meldung/Auslaufmodell-Micros...

Outside of the government sector it seems like these laws are to make sure that the data is within legal jurisdiction, and has nothing to do with privacy.

Banking data is at least considered to be "important" enough to keep within the borders too, but privacy is important too in regards to GDPR. How do you prevent unauthorized access to the data (i.e. the US government) with the cloud act. Do you report those requests as a breech? There is really no difference between that and having the servers hacked in other ways.

Banking data is important because the police and tax authority wants to make sure they have access, privacy doesn't really come into play here. It's a nice side effect, though. It's the same with accounting data.

When it comes to GDPR it only talks about where and by who data is processed, it doens't really put any restriction on storage, except for some pretty vague (on purpose) requirements about data protection (read: encryption).

But if the US government access PII without authorization via the cloud act wouldn't it count as a data breech when it comes to GDPR?

Then they should be getting encrypted or pseudoanonymised data, if you are following the regulations.

For services like AWS you can argue that they should be able to get ahold of these encryption keys, but most data protection authorities seems to think this is good enough.

Encryption is useless when you store the keys on the same infrastucture. U.S may ask for keys as well.

Even if you would store the keys on a local service at some point your data will lie/transition decrypted on the remote hardware.

It's not a good idea at all to use hardware controlled by a hostile government regardless of what kind of encryption you plan to use.

>Encryption is useless when you store the keys on the same infrastucture. U.S may ask for keys as well.

Are you claiming HSM are unsafe?

>Even if you would store the keys on a local service at some point your data will lie/transition decrypted on the remote hardware.

Well no. You have TPM and HMS which should solve this problem sufficiently. Even hardware tokens for crypto e.g Nitrokey and/or yubikey should be sufficiently safe for most use cases.

>It's not a good idea at all to use hardware controlled by a hostile government regardless of what kind of encryption you plan to use.

It depends. You shouldn't host anything at any "hostile government", but who is the hostile government? Is this a hostile nation based on a threat model for your company? Or is this your personal opinion?

Once the attacker gets physical access to your device/computer all bets are off. Not to mention if "your device" is actually provided by a hostile party(i.e amazon/microsoft in collaboration with various US agencies).

A government/state is hostile if it breaks the laws designed to protect the citizens and their freedoms(i.e privacy). I believe it's obvious by now that the U.S government seeks not only to apply its justice system over sovereign states but also to control the politics and get strategic information, even from its "allies".

What's your threat model here? Who's the actor you're protecting yourself from?

A government/state acting under they own laws is still acting under a law so they would never have physical access to something like an HSM located in a DC on another continent. Or even your laptop that's sitting in another country.

A government/state acting around the law makes any discussion about laws superfluous. They will go around them anyway, as per the premise.

> A government/state acting under they own laws is still acting under a law so they would never have physical access to something like an HSM located in a DC on another continent.

A government’s own laws may restrict what it can do outside of its own territory, but those restrictions, if they exist, don't always include following local law, and so it's entirely unjustified to conclude that a government acting under its own laws would not have the described access.

What I meant is if the US government wants to access data in a German datacenter it can either try via a warrant which I imagine would not be legally enforceable in the EU (at least not without the cloud provider breaking EU law), or via hacking which makes any law irrelevant.

The cloud providers provide the access controls for the HSM. Why break the encryption when you can just come through the front door?

That's not how HSMs work or they would be totally useless.

Short of a hidden vulnerability or a manufacturing defect there's no "official" way to physically access data from the device without destroying it. And accessing the data the normal way still requires access the cloud provider doesn't have (a certificate password for example).

If we're talking hackers that could successfully hack an HSM, they don't really care about laws. And if we're talking about acting under some law, that law has to compel the owner of the password to give it up. Not the cloud provider.

So your threat model includes the cloud provider?

Storage is processing.

‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction

https://gdpr-info.eu/art-4-gdpr/

It’s the other way around, the Europeans want to be able to snoop in the data. They don’t care if your data leaks to the US, as long as they have access themselves.

Well, no, we do care if the data leaks to the US; the ECJ struck down the Safe Habour Decision, and there are many critics of the new "Privacy Shield".

Didn’t Russia require something like this back in 2016 or so? All data pertaining to Russians had to stay in Russia?

Yes, it was ostensibly about privacy but the actual compliance requirements align with jurisdiction and access rather than privacy.

> We can now finally announce that, together with Dell EMC, and as one of the first companies in the world, successfully deployed a customer-ready, production version of Azure Stack.

If they're working with Dell EMC, an American company, then it's still the exact same issue.

One step at a time. Having physical control over data definitely is an improvement. Not everyone believes conspiracy theories about spy microchips in mainboards.

Microsoft Euro branch is still subject to US law. The US can still seize your data.

Yes, that is why you use azure stack and not azure. It's a licensed version of the software that you can run completely independent of Microsoft.

licenses usually include provisions for being disabled if the parent country requires it. see what happened to iran when US levied sanctions

Disabled != data changes hands.

Usually you want that unless you don’t and you don’t here :)

> believes conspiracy theories about spy microchips in mainboards.

You mean not everyone believes the cold, hard truth?

That's unfortunate, because most of us here saw the evidence of this taking place.

Interesting. Can you provide a source?

https://en.wikipedia.org/wiki/Intel_Management_Engine#Claims...

How is that a chip in a mainboard? The mainboard story was a propaganda piece in Bloomberg aimed at China.

Afaik the processor is a chip on the mainboard. I personally don't care which part of the mainboard carries the backdoor.

With respect, what you linked to is a conspiracy theory that the ME is used in ways other than explicitly stated by Intel and unsupported by any evidence other than allegation.

"Can be used in ways other than explicitly stated" quickly turns into "is used": "https://hackaday.com/2017/12/07/another-defeat-of-the-intel-...

"The Intel Management Engine with its proprietary firmware has complete access to and control over the PC: it can power on or shut down the PC, read all open files, examine all running applications, track all keys pressed and mouse movements, and even capture or display images on the screen. And it has a network interface that is demonstrably insecure, which can allow an attacker on the network to inject rootkits that completely compromise the PC and can report to the attacker all activities performed on the PC. It is a threat to freedom, security, and privacy that can't be ignored." - Hackaday

A part of my machine which I have no control over and which I cannot remove is a backdoor. Some would call that even malware. I don't care whether it has been solely used for the intended purpose which I can't even verify.

The Snowden leaks.

We saw photographs of this taking place in what looked like an assembly line or distribution centre, along with accompanying text from internal NSA presentation slides.

If you're talking about Intel ME, just use AMD or ARM.

Both have their own ME equivalent with ARM TrustZone.

https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo...

https://en.wikipedia.org/wiki/ARM_TrustZone#TrustZone_(for_C...

I thought there is a great level of control over these and none of these run Minix and connect to the network. The actual functionality that ME is supposed to provide is purposeful.

No one outside of Bloomberg has seen any evidence of mainboard spy chips. You must be thinking about CPUs.

No, I'm thinking about what we read in the Snowden leaks (if you bothered reading them).

I did read them. Which part are you referring to? If it is GODSURGE then it is malware in the BIOS used by the NSA. I have seen nothing about China spying via motherboards, outside the propaganda hit piece Bloomberg wrote which everyone (even FBI and Amazon, etc) dismissed as total bullcrap.

That cloud thing is overhyped. The "Cloud" will never swallow the budget and mid-tier hosting industry for purely economic reasons.

Uncle Liu hosting Co. and AWS are the same things underneath, running mainstream x86 hardware, and both buying from mid-tier OEM server assemblers.

The days of people buying $10k Dell servers are gone, and ones ability to capitalise on undercutting major hosters by buying directly from OEMs is gone too, because every large scale hosting co began doing the same.

Cloud is not purely hosting, it's the services on top, the benefits of the company behind it. I don't know the statistics but probably bigger companies will pay a premium knowing that it's Amazon doing the hosting and not 10 different Uncle Lius.

> the same things underneath, running mainstream x86 hardware

Maybe not for long. Some providers (Amazon, Google) are working on their own processors.

Reply on news.ycombinator.com