Mitigating the Hetzner/Linode XMPP.ru MitM interception incident
A quick warning on hetzner. I needed a personal bare metal machine so signed up.<p>I was travelling and on an IP in a distant land so their sign up asked for secondary verification via  PayPal. All passed and now it’s should get a server?<p>Nope - next day their support emailed telling me they would not approve my account without… no word of a lie here… either 1: a fax of my passport info page or 2: a scan and email containing the same.<p>I refused reminding them of GDPR and that email is at best opportunistically encrypted and at worst open to interception.<p>They replied stating they believed they were GDPR compliant because all they do is use the passport to verify the account and delete the document. They also said I could hide anything sensitive other than my name and date of birth!!<p>I suggested the process is not GDPR compliant as anyone could intercept unencrypted emails and that they should talk to a lawyer if they did not believe my assertion.<p>Within a short time the server was approved and online. I queried if they would revise their process in light of our interaction. They did not address the question.