Mitigating the Hetzner/Linode XMPP.ru MitM interception incident

They had the option to send it encrypted with PGP. But yes, this reminds me of communist countries where you had to leave your ID at the hotel upon check in. The Stasi mentality lingers on and accomplishes nothing.

What does this have to do with lingering Stasi mentality? Gunzenhausen was in West Germany.

You don't seem to know anything about VPS administration.

I think it is less Stasi and more so 30 euro dedicated servers with unmetered gigabit lines are ripe for bad clients.

You've got the general issue of abuse and fraud that all providers face. But I think there are two issues that make it worse for companies like Hetzner, OVH, and other low-cost providers:

1. Chargebacks are a big deal, both in terms of being cut off from payment networks but also the fees imposed, which are especially harsh if your margins are likely razor thin sometimes; looking at the server auctions right now, it's kind of wild that Hetzner manages to give you a place in a datacenter, 3700X, 64GB RAM, 2x1TB enterprise SSDs, and unmetered gigabit on a decent network for 33 euros while still making a profit.

2. I would imagine that attempting the proper credit-card theft kind of fraud is also more of an issue for low-cost providers, not only because of #1, but because I think you'd manage to keep and abuse servers bought with stolen money for a lot longer; I think legitimate owners of said cards are less likely to notice 30 euro charges every month compared to being robbed blind by unexpected AWS fees.

I've had to deal with anti-fraud paranoia from OVH, BuyVM, Hetzner, and many others, likely all for the same reasons as Hetzner.

Both Hetzner and OVH refused to provide me service without photo ID or a passport. BuyVM refused one of my Jordanian friends entirely unless he paid in crypto. And while minor in comparison, I've had to change my PayPal email to match my account email on BuyVM despite it literally previously being paypal@myfirstandlastname.tld.

Not meant to be a dig at BuyVM, btw, even though the crypto bit may seem harsh. I really like them; freedom to host pretty much anything that isn't straight-up illegal, even Tor exit nodes, the support is good, they're often around and transparent in the community chat, and it's hard to beat free BGP announces, up to 10Gbps speeds, anycasted VMs across Europe and the US for <$10/month, and optional $3/month DDoS mitigation -- especially since it's the kind of small enough, tight-ship type of thing to where you can moan about poor routing or custom mitigation filters and potentially have someone actually try to take care of it (and it's also hard to beat for abusive or awful clients too, hence the trouble).

They provide great service, even if only to use as a DDoS-mitigated tunnel for more powerful servers elsewhere, or as a CDN, etc.

Plenty of modern hotels in Western countries require you to submit your passport to reception, who then scans it and keeps a copy of it. In fact Marriot recently suffered a data breach where the attacker obtained the photos of these passports.

Of course, that's not mutually exclusive with Western nations having "The Stasi Mentality..."

I know. Most of them have a fill in the blanks sheet with name address and document s/n.

I can understand scanning documents if one rents a vehicle, although for hotels I fail to see why the form shouldn't be enough. It's not like they don't have cameras at the reception desk and I don't pay with a card under my name, they can also check my ID and fill in the form themselves if they don't trust the customer. Why should I trust them to properly handle copies of my ID? They are not a bank operating under strict regulation.

The thing is back then they were physically keeping your ID until you've paid in full and checked out. Last time it happened to us in Serbia, in 2019. The receptionist regarded us with suspicion. Brought back memories from the '80s. If you've played Papers Please you know what I mean. Now about 8 Schengen Area states have introduced border checks. Great.

https://www.euractiv.com/section/justice-home-affairs/news/s...

Interesting. That didn't happen to me when I stayed a month in an Airbnb in Serbia, although the host did ask me for a copy of my passport. (Not that I'd expect it from an Airbnb host even if hotels were doing it... just an additional data point).

For renting a vehicle (or more likely, something like a bike or moped), I can understand why they take your ID as a form of collateral in exchange for the material goods they're lending you. But for a hotel there's no real reason to hold onto it.

Out of curiosity, did you acquiesce and leave your passport with them?

BuyVM comes off as one of those sites that's explicitly set up to host illegal content, but with plausible deniability. I don't understand how they're still allowed to remain operating. Governments usually err on the side of arresting innocent people.

P.S. Hetzner gigabit is not actually unmetered, but the limits are vague, but high (>100TB/month)