←back to thread

Mitigating the Hetzner/Linode XMPP.ru MitM interception incident

(www.devever.net)
341 points hlandau | 1 comments | 20 Oct 23 20:31 UTC | HN request time: 0.21s | source
Show context
manxman ◴[21 Oct 23 02:26 UTC] No.37963542[source]▶
A quick warning on hetzner. I needed a personal bare metal machine so signed up.

I was travelling and on an IP in a distant land so their sign up asked for secondary verification via PayPal. All passed and now it’s should get a server?

Nope - next day their support emailed telling me they would not approve my account without… no word of a lie here… either 1: a fax of my passport info page or 2: a scan and email containing the same.

I refused reminding them of GDPR and that email is at best opportunistically encrypted and at worst open to interception.

They replied stating they believed they were GDPR compliant because all they do is use the passport to verify the account and delete the document. They also said I could hide anything sensitive other than my name and date of birth!!

I suggested the process is not GDPR compliant as anyone could intercept unencrypted emails and that they should talk to a lawyer if they did not believe my assertion.

Within a short time the server was approved and online. I queried if they would revise their process in light of our interaction. They did not address the question.

replies(8): >>37963761 #>>37964297 #>>37964364 #>>37964823 #>>37965391 #>>37968710 #>>37970183 #>>37974389 #
1. crote ◴[21 Oct 23 05:37 UTC] No.37964364[source]▶
I tried to sign up from The Netherlands for a server hosted in Germany.

They asked me to email them a copy of my ID card for verification. They refused to have me as a customer even after I provided it. I guess they didn't like the look of my face? They refused to tell me how I could still proceed, and I would've happily paid a year in advance or something. Heck, I could've probably visited their office in person.

I did try to register from a Protonmail account because I self-host my email and don't want to run into a chicken-and-egg problem (need to mail them because my server is down, can't mail them because my server is down...), so perhaps that was the issue.

Because Hetzner refused my business I was forced to look for another provider, and I've been using OVH without any issue for a few years now. Quite a shame though, because Hetzner definitely seems to provide a superior service - provided you can get them to take your business!