28

Could a VPS provider like DigitalOcean have access to the content of their users? In their terms of service they do not mention anything related to this question, but could they theoretically have access (e.g., via a backdoor)?

Apart from a possible hack, how could I assure my clients that their content is only known by me, even if their data is not on my server?

  • 14
    You are uploading data onto their servers. Yes, they have access and they don't even need a backdoor. The solution is encryption. – schroeder Oct 25 '15 at 18:53
  • 9
    If, how, when and why they access your data, is often not part of the terms of service. Usually it is part of a separate document: the privacy policy. – Philipp Oct 25 '15 at 19:40
54

When you host your data on other people's servers, then these people have full access to it.

With a virtualized server, the data is written to the hard drive of the host system. The server administrators could look at that hard drive image at any time and thus get access to the data of your users. They can also monitor the network traffic.

You could prevent access to the hard drive image by using full disk encryption. When the virtual machine encrypts all the data it writes on its virtual hard drive, that data is also encrypted when written on the physical hard drive of the host.

To prevent monitoring of network traffic, you could make sure all traffic - both administrative and user-traffic - is strongly encrypted.

But with some criminal energy, they can still monitor your data.

  • When you reboot your machine, you will have to enter the disk encryption password through the remote administration console. That console is under their control, so they could use that to log your disk password.
  • They can make a snapshot of your VM at any time, which dumps the whole RAM content to disk. This gives them access to all data currently in memory, including the decryption key of the virtual disk.
  • When they control the VM hypervisor, they also control all the computations the virtual machines make. It's not easy to do, but it is theoretically possible to use this to break any cryptography which happens on it.

Solution: Host your servers on your own premise where you have full access.

But will Digital Ocean do that? This is what their privacy policy says:

Server Data

DigitalOcean does not have access to its users’ server data. The backend is locked away from the users’ support staff and only engineering staff has access to the physical servers where users’ virtual machines reside. DigitalOcean does not store users’ passwords or private SSH keys. DigitalOcean also does not request user login information to their servers. DigitalOcean does not review or audit any user data.

This is what they say. Can you trust their words? Your decision to make. By the way, their Law Enforcement Guide might also be worth reading in this regard. It describes what information they suddenly do have access to when pressed by government officials.

  • 6
    All of the software the client installs, including any full disk encryption, is running on hardware they control, so it may not be as installed as one would like. As with administrators, you fundamentally have to have some degree of trust in whoever is hosting your server. And as with administrators, if you don't trust them, the solution is not to use them. – jmoreno Oct 25 '15 at 21:44
  • The solution for your first point is to not use their console but any SSH client on your own machine – Freedo Oct 25 '15 at 22:37
  • 4
    @Freedo How are you going to SSH into a machine which is currently on the bootloader prompting for the disk encryption password? – Philipp Oct 25 '15 at 23:44
  • 2
    You can have an initrd that runs a ssh server and then waits for someone to ssh in and provide the encryption password but ultimately it doesn't help much because of the other ways the host can get in if they want to. – Peter Green Oct 26 '15 at 2:09
  • 4
    @hipocd In my opinion a full disk encryption will simply add more complexity (and a small performance hit) for almost no gain. It will also require manual input from a password holder any time the machine reboots. Only the most trivial of attackers will be put off by it (e.g. a bored employee at the hosting company, who doesn't care specifically about your data). Consider that if the hosting company is bothering to try to access your data in the first place, then they must have a compelling reason to do so, in which your security by obscurity will not be an obstacle. – Jon Bentley Oct 26 '15 at 18:59
11

As other answers have explained, it is impossible to prevent a third party host from being able to inspect the data on your server. What you can do however is make that data worthless to anyone who inspects it. If you can do that, then hosting your own physical server doesn't have to be the only solution.

Merely encrypting the data on the server isn't enough, and is completely useless against a determined attacker with access to the server. What you need is known as "zero knowledge" encryption and the extent and ease with which you can utilize it will depend on your server application. All encryption/decryption is done on the client side, and only encrypted data is ever transmitted to and stored on the server. The server never sees the unencrypted data at any point.

For example, a Dropbox-like file sync/storage service can achieve this fairly easily. The client encrypts files prior to uploading, and decrypts them after downloading. Anyone with direct access to the server will only be able to see the encrypted files. Another example with an easy solution is a messaging app, where encryption is done end to end. Each client transmits encrypted data via the server, with the other client performing decryption.

That alone will still leave the meta-data vulnerable. In the Dropbox eample, the attacker will be able to see file sizes, date stamps, etc. Whether or not that matters depends on your specific security needs of course, but if you want a full solution you will need to find a way to encrypt the meta data as well. Ideally you want to store a single stream of raw encrypted bytes on the server, and have all operations on it performed by the client.

Even then you will have to consider that the attacker might glean some information by analysing the amount and frequency of data that is transmitted to and from the client, as well as things like the client's IP address. That could be a problem in some contexts (e.g. people living under oppressive governments), but probably isn't for most applications.

  • 2
    "zero knowledge" encryption is not a thing that actually exists in the world -- that's a made-up phrase. "zero knowledge" is a technical term in this field with a very specific meaning, one that is not what you seem to think it is. Dropbox is a funny example to choose, as there are certain well-known limitations of its security that certainly make it fall short of "zero-knowledge": see e.g., economist.com/blogs/babbage/2011/05/internet_security. – D.W. Oct 26 '15 at 23:37
  • Your comment seems interesting but your link is broke/dead. – cgcmake Oct 27 '15 at 10:33
  • @Jon Bentley How could you use a zero knowledge encryption scheme with a ssh connection ? – cgcmake Oct 27 '15 at 10:49
  • @d.w. Define made up phrase. All technology terms are made up at some point. There are blogs and products in existence right now using the term zero knowledge encryption to do what I describe. As for Dropbox, I did not use it as a specific example. I described a hypthetical Dropbox-like service. See for example here or here for file sync services claiming to be zero knowledge, or this question about the topic. – Jon Bentley Oct 27 '15 at 11:37
  • @hipocd ssh is used to provide end to end encrypted communications. If one of those ends is a server then whatever you transmit (commands, files, tunnelled protocols) will typically be unencrypted at the other end. If you want "zero knowledge" you will have to take your own steps to only leave encrypted data on the server. Those steps are independent of whether you use ssh or something else to communicate with the server. – Jon Bentley Oct 27 '15 at 11:53
-6

No VPS offers privacy from the owners/operators of the hardware, yet this can be worked around via VPN tunnelling. The straightforward approach is to rent a VPS in a foreign country (.i.e Russia), and then construct a private VPN connection to the VPS from a server that you control. Then simply forward the desired ports from the VPS to your local server. This will frustrate most law enforcement, but if you attract the attention of the NSA/DEA/FBI etc, you had better add VPN over TOR as your link, and keep the private server far away from where you live.

  • 5
    I'm not sure what problem you are trying to solve but it doesn't seem to be in the OP. No matter how many layers of Tor and VPN you add, if you host on a VPS, the provider can access your data. – Neil Smithline Oct 26 '15 at 1:01
  • 4
    The question is about the uploaded content, not about the communication channel for that content. – schroeder Oct 26 '15 at 3:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.