0

What is the optimal way to protect my data (db and source code) from my hosting provider?

Would using an encrypted volume, such as truecrypt, suffice? However - for my program to access data on the encrypted volume, it needs to be unlocked and mounted - does this make it pointless?

I've heard of homomorphic encryption, but: A) I have no idea where to start, and B) I'd need to decrypt the data before presenting it to the rightful origin/user

Of course, there isn't a way to make it entirely secure, I'd just like to defend it as much as possible, and hopefully make it non-viable for anybody to view/steal it.

--Update---

For example, would a veracrypt volume provide any level of defence against the provider, at all?

(Not having a VPS is not a valid answer, sorry Tom) :)

Thanks.

Improve this question
13
  • 3
    "Not having a VPS is not a valid answer, sorry Tom" - actually it is. The point is -. you need to understand enough of computers to analyze attack vectors to realize that any vps provider means you have ZERO control over the hardware. You literally ask "if I send a packet by UPS, how can I make sure the delivery driver does not touch it" - impossible. Then say "saying it is impossible is not a valid answer" - delusional. Reality does not care what you think. Commented Apr 22, 2021 at 14:03
  • I think my question is more like: If my parcel is opened by UPS, how can I verify that they have no feasible way of discovering what the contents actually is Commented Apr 22, 2021 at 14:23
  • "actually it is" - implying that I self-host is not helpful in this situation, that all :) ... In fairness, you mentioned Hyper-V clusters and have explained the issues with using a VC volume. I'm now under the impression that a VC volume would provide a level of security, because the provider won't be able to access it for any mundane reason; they will need to invest time, intercepting packets, which is exactly what I'm after. Thanks :) Commented Apr 22, 2021 at 14:31
  • "which is exactly what I'm after" - no, it is not. If you read your question and title you will find out that if that is what you are after, you lied to us. Delaying is not optimal way. Depending on what you do, it is NOT EVEN A LEGAL WAY. Commented Apr 22, 2021 at 15:11
  • Not legal, eh!? "What is the optimal way to protect my data from my VPS provider?" this is elaborated on by: provider won't be able to access it for any mundane reason; they will need to invest time, intercepting packets, which is exactly what I'm after. I'm not sure how that's a lie, my good man! Commented Apr 22, 2021 at 15:25

1 Answer 1

Reset to default
1

Not HAVING a VPS provider.

And I am not snippy. THere is no way to protect a VPS from the people running the hardware. There are some theoretical ways but - at the end someone needs to allow access. I.e. your encryption - how the heck would the program decrypt the data? See, with physical access I can make a backup and spend a lot of time cracking. They key must be somewhere on the VPS image, or?

There are some ways in i.e. Hyper-V clusters to protect images from being exported, but again, the provider has access to the hardware.

Generally you ARE protected by the hosting provider. Contracts and the fact that you are irrelevant between hundreds of thousands (possibly) of machines.

I'd just like to defend it as much as possible, and hopefully make it non-viable for anybody to view/steal it.

And you are willing to pay a SIGNIFICANT price for that, both possibly in hardware (yes, hardware, SCM rental is expensive) and / or making your programming possibly 5 to 10 times as expensive? Because that is what we talk about - encrypting everything is fine, but it also means decryption when it needs to be accessed, the keys STILL somewhere on the platform for anyone with a debugger.

The SysAdmin / VPS host is the one attack vector extremely hard to defend against.

Improve this answer
9
  • Thanks, sincerely appreciate your response. Would a veracrypt volume provide any level of defence against the provider, at all? I don't mind paying more for a more computationally expensive set-up. Yes - defended by contracts is great, but most of the main-stream host privacy policies, aren't great - for example, they contain clauses that allow sharing your data with various authorities without even notifying you/the company leasing the VPS! The is certainly true with Digital Ocean - who can share customer data with the US authorities for almost any reason, even if you, company and... Commented Apr 22, 2021 at 13:38
  • the VPS are located outside of the US! (Clearly this is because they are a US company, but this is not good for a privacy perspective, at all.) Commented Apr 22, 2021 at 13:40
  • "Would a veracrypt volume provide any level of defence against the provider, at all?" - how does it decrypt? See, can be intercepted. Commented Apr 22, 2021 at 13:49
  • Well, that's the case for anything, isn't it. I've heard that everything travelling across the internet back bone is recorded. Commented Apr 22, 2021 at 13:59
  • I'm trying to figure out if the VC volume will only be encrypted when the volume isn't mounted/in use. I.E. Is it accessible in plain-text for the VPS provider when in use? If yes, then it provides next-to 0 defence from access by the provider. Commented Apr 22, 2021 at 14:01

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.