Re:We moved our servers to Iceland
by sneak on Saturday March 30, 2019 @07:09AM
(#19528844)
In practice, it is harder to dump the memory of a bare metal server than it is to simply yank out a hard drive. (It is, of course, possible - the technique is beyond many hosting companies and local police, and the effectiveness depends on the temperature.)
In theory, the hosting provider, having physical access, has both the key (in RAM) and the cyphertext on disk, so logically there is little point.
Itβs worth noting that my hosted bare metal boxes have encrypted data partitions with keys I provide over ssh each boot.
Of course, if it is a VM, anyone with root on the hypervisor (i.e. the hosting company) can trivially dump the memory and encryption keys.
In theory, the hosting provider, having physical access, has both the key (in RAM) and the cyphertext on disk, so logically there is little point.
Itβs worth noting that my hosted bare metal boxes have encrypted data partitions with keys I provide over ssh each boot.
Of course, if it is a VM, anyone with root on the hypervisor (i.e. the hosting company) can trivially dump the memory and encryption keys.