alt Hacker News> After a local activist uploaded a license-plate search tool on Fly.io, a developer-focused public cloud platform, to an infiltrated Signal chat, HSI agents reviewed website DNS queries and Stripe data along with data purchased from a commercial broker. This gave HSI access to SSH session logs, outbound connection records, the Fly.io account’s signup IP, and a Stripe card fingerprint on an account that had never completed a payment. Agents fused that with Minnesota DVS records and commercial data from the Thomson- Reuters CLEAR platform to produce a driver's license nummber, Social Security number summary, years of address history, phone numbers, property records, and jointly registered vehicles.
Wow, I wonder how they got SSH session logs?!
The breadcrumb trail here is chilling.
Replies
If you read the DHS document it sounds like Fly.io and Stripe are complacent. They provided data without fighting the subpoenas. Warrants should be required for this data.
https://www.documentcloud.org/documents/28831278-govuscourts...
Seems like it was fly.io, since they got the user IP from there and it would make sense they would have the session logs.
America is crazy, why are you letting people sell your data like this?
Correct me if I’m wrong here, but wasn’t this in response to a massive organized anti-ICE operation?
Headline makes it seem like ICE just did this in a vacuum.
Fly.io signup IP, huh ?
A proper warrant must be respected and adhered to …
… but was it a proper warrant or just a bluff and, further, was the customer notified?
I insist on knowing the answer to this question and if you are a customer of fly.io (I am not) you should too.
if fly.io has servers based in the U.S by all means the gvt has access to those logs legally and illegally.
DNS, too. I imagine they weren't using their ISP's DNS server, as that could cut out needing a bunch of this data, but then I wonder what data they did get from whatever DNS provider...
They might mean SSH TCP traffic logs, maybe?
Also SSH isn't a perfectly opaque protocol. There's stuff you can use to fingerprint e.g. client/server versions and often narrow it to architecture, OS, even OS version. That helps.
Adding `fly.io` to my permanent "never use" list. If they're not going to lawyer up when it comes to the 4th amendment, I will never use this service.
It's so reassuring to know that all a cloud provider needs to compromise its users trust is an official looking letterhead.
Definitely 0% chance they could ever be phished by a foreign (or domestic) power with enough email (or letter) know-how.
At least other big tech companies were forced to kneel with secret (unconstitutional) FISA orders. Both Apple and Google at least try to show that they're pushing back.
EG: google shifted location data to local device only to combat Geo fencing warrants
EG: Apple [requiring warrants](https://apnews.com/article/apple-push-notification-data-cour...) to read push notifications
(why aren't push notifications E2E encrypted in the year-of-our-lord 202X?)