7 ms·

U.S. Visitors May Have to Hand Over Social Media Passwords

61 points by erelde 10y ago

moh_maya 10y ago
Why stop with social media? Why not email and other accounts as well, just to be safe? It's one thing to ask for social media user IDs (which still bothers me), but this is taking it to another level. I already have to submit my financial details, history of past travel..At some point, you will come to a place where there's enough 'data' for anyone to conclude anything they want. Sort of like, if all you have is a hammer, everything will look like a nail. Sad.
- fictioncircle 10y ago
  It is time for everyone to start building fictional aliases of themselves to hand over.
  - eatbitseveryday 10y ago
    You might be interested to listen to this talk at DEF CON. Chris Rock (the speaker) tells you how to one could forge new identities, SSN, etc. https://www.youtube.com/watch?v=m1lhGqNCZlA https://www.youtube.com/watch?v=m1lhGqNCZlA https://news.ycombinator.com/item?id=12528544 https://news.ycombinator.com/item?id=12528544
deleted 10y ago
[deleted]
facetube 10y ago
Finally, a real Catch-22: give the password, you violate the Facebook ToS and potentially the CFAA as a result. Don't give the password, you get held by DHS (and possibly sexually assaulted in a "strip search") as punishment before being sent back at your expense. America, I think our relationship is over.
nerfhammer 10y ago
Now out of diplomatic reciprocity other countries can do it to us
- moh_maya 10y ago
  Brazil already conducts enhanced scrutiny of Americans.. " American citizens are both photographed and fingerprinted as part of their immigration clearance process. This is because Brazil practices diplomatic reciprocity and processes American citizens entering Brazil the same way the U.S. processes Brazilian citizens entering the United States. This is most assuredly NOT the place to demonstrate any displeasure with this process. More that a few Americans (including at least one airline pilot) have been arrested, fined (thousands of dollars) and ejected from the country forever for making an obscene gesture during this process." http://www.brazil-help.com/brazil_travel_tips.htm http://www.brazil-help.com/brazil_travel_tips.htm http://www.economist.com/blogs/gulliver/2013/02/tourist-visas http://www.economist.com/blogs/gulliver/2013/02/tourist-visa...
  - abandonliberty 10y ago
    If people want to self-identify as rude and unable to understand the difference between creators and implementers of policy, I vote we let them. I'd rather they were turned back at the border. It would be great if we could apply this to people currently in the nation as well.
  - masonic 10y ago
    Note that this predates the Trump administration.
- r00fus 10y ago
  I think that's the only real power that other countries can exercise - force Americans (especially business travelers) to experience what the US is forcing on visitors in the US.
herbturbo 10y ago
Reminds me of a question on the US visa waiver form asking whether you are or ever have been a Nazi. Because everybody knows that Nazis cannot lie, and international terror organizations cannot create dummy social media accounts.
- mhurron 10y ago
  Green card application includes a form that has that and more. Are you a communist, have you been convicted of genocide, have you ever used a prostitute ... I really wish I had taken a picture of that form, the majority of questions were idiotic.
  - dragonwriter 10y ago
    The I-485, right? https://www.uscis.gov/i-485 https://www.uscis.gov/i-485
    - mhurron 10y ago
      That's the one. That's good for a laugh.
  - js8 10y ago
    I also used to think those questions are idiotic, but maybe there is a point to them. Now many people are worrying like, all these people coming from a different culture, do they understand our culture? So maybe these questions serve as a simple reminder - don't do these things. Actually, I think it would be better to ask about U.S. Bill of Rights, but hopefully you get my point.
    - mhurron 10y ago
      That is not the purpose of the form. Also - "Have you received public assistance in the United States from any source, including the U.S. Government or any State, county, city, or municipality (other than emergency medical treatment), or are you likely to receive public assistance in the future?" I was unaware that that was a problem in the US. It also asks about things that are legal in other countries and you are penalized if you answer honestly.
megous 10y ago
Will not having a social media presence be considered a red flag?
- concernedmonkey 10y ago
  This is one of my worries. I had a rarely-used FB account for a few years, but deleted it when I realized the privacy concerns. No FB, twitter, IG, Gmail, LinkedIn, etc. Nothing. You can't find me through a Google search except for my public-facing professional certifications (which are required to be public-facing). I wonder if one day this will get me on a list as some kind of "lone wolf" even though I'm quite social (in the in-person sense).
imgabe 10y ago
I don't think anyone who really wanted to get into the US would have a problem handing over A social media password. Whether that's a password for an account specifically created to be reviewed by immigration authorities is another matter entirely. What makes DHS think they would be reviewing a real social media account? I think this is not about reviewing social media accounts. This is about giving DHS and CBP a pretense to deny entry to anyone they feel like, based on gut feelings, prejudices, whatever.
- js8 10y ago
  I would have a problem with it. And I would really want to get into US, possibly, because I work for an American company. But it's not my job to create fake social media accounts, sorry.
  - imgabe 10y ago
    I don't think filling out visa applications, in general, is anyone's job (unless maybe you're a personal assistant for someone who travels internationally a lot). It's not about what is and is not your job. If that's what a country requires to allow you entry, and you want to enter, that's what you do.
    - js8 10y ago
      I am just a normal programmer, not a spy. Visa application is acceptable (I have done that in the past), forging social media accounts is not (I in fact I do have FB account but God knows where the password is).
      - marcos123 10y ago
        I think the point they were making was that regardless of how you feel emotionally about giving up specific information, it has no effect on whether a country allows you to enter. So go ahead and do only what you feel is "acceptable", just don't be surprised when you are turned away at the border for not filling out all of the required documents.
smileysteve 10y ago
2 Factor Authentication (Facebook, Twitter, Instagram (through Facebook), Google) really puts a damper on this and helps you remember that the U.S. government (and esp leadership) is sorely behind when it comes to security
- chopin 10y ago
  In which way would that help? It's access what is wanted, not the password. If you have 2FA, other ways will be found. I don't believe that there is a technical solution. This is a purely political thing. If this becomes policy the US becomes entirely off-limits for me although I don't have any social media account.
  - sqeaky 10y ago
    In the short term if they ask for passwords and they are provided people with 2FA might slip through unviolated. That is until laws catch up.
  - smileysteve 10y ago
    The problem I see is that I'll be able to share my password, but somebody won't be able to log in. They'd come back and be confused. If I give them the 2 factor, the computer needs to be there, or they need to say it over radio, and even if they say it over radio, it would be a race before it expires. And yes, presumably, they could work with facebook or the NSA for a portal that bypasses 2 factor, but then they don't need my password.
eatbitseveryday 10y ago
Give them something which resembles a password? How will they know? Give them the password, then change it afterwards? Have an alternative account used just for immigrations? Claim you have no social media accounts, or deactivate them before entering the country (we know FB doesn't delete, only deactivates)? Change the name on the social media accounts?
- jlarocco 10y ago
  Or do the right thing and tell them to go f* themselves because it's a huge invasion of privacy and none of their business. It's unfortunate most people won't have this option. I've been trying to give the Trump administration a chance, but this is getting more ridiculous and more embarrassing every day.
edblarney 10y ago
We should actually hope that they 'take it too far' and apply it broadly - because the first day it went into force the blowback would be mesmerizingly big. There was some blowback from immigration and that affected relatively few. But this will hit millions of people every day with a huge WTF? It'll go to every CEO and media person in America very quickly as a 'very material issue', unlike some policies which companies support/resist for populist or political reasons. If they just do it to 'select people' ... then it would be something on blogs, sometimes in the press yada yada but maybe not so mainstream.
arrty88 10y ago
give them a stage account?
logfromblammo 10y ago
Welp, time for Facebook, Twitter, et al. to intentionally make themselves inaccessible from locations/networks coincident with US ports of entry. "To protect our produ^H^H^H^H^Hcustomers' privacy, we have decided to block access to all accounts that we can ascertain within reasonable certainty to be temporarily crossing an international border. We apologize for the inconvenience, and service will be restored once you get further away from the port of entry, or as soon as those in charge of US customs decide to stop being asshats."
always_good 10y ago
My female Canadian friend was interrogated in a Canadian airport by an American border agent because she made the unfortunate mistake of having a connecting flight in the States on the way to visit me in Mexico. The agent asked her if she was a "good girl" and then demanded access to her phone's Facebook Messenger to see if she'd been offering or planning sex services. She of course complied. What else are you going to do? Cancel your plans and stay home during your vacation leave? It's a great job to have if you're a creep and/or resent women.
- toomuchtodo 10y ago
  Please report this incident to US Customs and Border Patrol, as well as DHS. https://www.cbp.gov/contact https://www.cbp.gov/contact https://www.dhs.gov/department-white-pages https://www.dhs.gov/department-white-pages EDIT: Sorry to piggyback. For your own security/privacy when traveling (I'm sorry, as a US citizen), bring a dumb phone just for calling, and wipe your iPhone (if its an iPhone) before transiting a customs checkpoint. Restore from iCloud when you're safely out of the airport. If asked what the dumb phone is for, "I break my iPhone all the time."
  - dingaling 10y ago
    > Restore from iCloud when you're safely out of the airport. "Sir, your phone appears to have been reset. Please connect it to iCloud and sync now". If they can compel access to apps and social media why would iCloud et al be any different?
    - toomuchtodo 10y ago
      Keep a separate sparse iCloud account if you don't think you have the soft skills to work around that unlikely scenario.
      - sqeaky 10y ago
        Will it stay unlikely in the long term?
cosinetau 10y ago
k bye
- sctb 10y ago
  Please comment civilly and substantively or not at all. We detached this comment from https://news.ycombinator.com/item?id=13601038 https://news.ycombinator.com/item?id=13601038 and marked it off-topic.
ommunist 10y ago
Before going to the US change your keyboard to Tibetan, change the password and give them your password in dzongkha notation written on a paper form. Make sure it is at least 16 symbols long. འགོ་དང་པ་བཅའ་མར་གཏོགས་དོ་ཡོདཔ།
- daxelrod 10y ago
  At which point they may just ask you to type in your password yourself.
  - smileysteve 10y ago
    At which point they need to provide a tibetan keyboard; unless they'll be able to thoroughly inspect your mobile device that may not have wifi.
  - ommunist 10y ago
    The only have instruction to ask for password. They cannot force you to do something. You do not have to give them access to your password manager.
    - daxelrod 10y ago
      Sure, they can't force you to do something, but they can make your entry dependent on your doing something, as long as you're not a citizen.
      - ommunist 10y ago
        But they cannot go against the instruction they have. I.e. they cannot force you to defecate into your pants just to be sure you are not holding USB flash drive there. Same applies here. They can ask for password, but they cannot force you to actually enter it. Its illegal.
makecheck 10y ago
Perhaps all new policies should have to be applied first to legislators. Want a password requirement? Fine, submit yours first, Congressman; we won't abuse it, "promise". Want inane questions and forms with high fees? Fine, Congressman, first you must fill out every last form yourself (don't forget to have a new picture taken, and thumbprints!). If you still think it's reasonable after all that, we can talk.
- sqeaky 10y ago
  While phrases like these might sound nice on the surface, they are entirely unenforceable. How do you intend to make this happen?
crystalmeph 10y ago
Facebook, Twitter, etc. should shut down DHS' and other TLAs' Facebook and Twitter pages if those organizations are purposefully violating the companies' TOS, including the accounts of the leadership who presumably know about and authorize these rules. Up to and including the official POTUS Twitter account as well as @realdonaldtrump. Just because the government can "legally" get access to anything they want doesn't mean they get to live consequence-free.
r00fus 10y ago
Soon: People leaving the US will have to hand over social media credentials, too. Do you think they'll stop at "foreigners"?
sqeaky 10y ago
What would happen if Twitter or Facebook implemented a "Crossing the Border" mode. When you set it up you get a fake password that logs into a fake version of your account with plausible looking but innocuous content. Then after some time, perhaps 72 hours this an all traces of it are erased. That ought to last until some new legislation specifically prohibits it.
drcongo 10y ago
I had to renew my ESTA[1] recently and was somewhat surprised to find that the form is now 6 pages instead of 6 fields, and asks for all sorts of weird stuff like the name, address and phone number of someone on the United States who can verify your identity. [1] https://esta.cbp.dhs.gov/esta/ https://esta.cbp.dhs.gov/esta/

61 points by erelde 10y ago

Why stop with social media? Why not email and other accounts as well, just to be safe? It's one thing to ask for social media user IDs (which still bothers me), but this is taking it to another level. I already have to submit my financial details, history of past travel..At some point, you will come to a place where there's enough 'data' for anyone to conclude anything they want. Sort of like, if all you have is a hammer, everything will look like a nail. Sad.

fictioncircle 10y ago
It is time for everyone to start building fictional aliases of themselves to hand over.
- eatbitseveryday 10y ago
  You might be interested to listen to this talk at DEF CON. Chris Rock (the speaker) tells you how to one could forge new identities, SSN, etc. https://www.youtube.com/watch?v=m1lhGqNCZlA https://www.youtube.com/watch?v=m1lhGqNCZlA https://news.ycombinator.com/item?id=12528544 https://news.ycombinator.com/item?id=12528544

deleted 10y ago

[deleted]

facetube 10y ago

Finally, a real Catch-22: give the password, you violate the Facebook ToS and potentially the CFAA as a result. Don't give the password, you get held by DHS (and possibly sexually assaulted in a "strip search") as punishment before being sent back at your expense. America, I think our relationship is over.

nerfhammer 10y ago

Now out of diplomatic reciprocity other countries can do it to us

moh_maya 10y ago
Brazil already conducts enhanced scrutiny of Americans.. " American citizens are both photographed and fingerprinted as part of their immigration clearance process. This is because Brazil practices diplomatic reciprocity and processes American citizens entering Brazil the same way the U.S. processes Brazilian citizens entering the United States. This is most assuredly NOT the place to demonstrate any displeasure with this process. More that a few Americans (including at least one airline pilot) have been arrested, fined (thousands of dollars) and ejected from the country forever for making an obscene gesture during this process." http://www.brazil-help.com/brazil_travel_tips.htm http://www.brazil-help.com/brazil_travel_tips.htm http://www.economist.com/blogs/gulliver/2013/02/tourist-visas http://www.economist.com/blogs/gulliver/2013/02/tourist-visa...
- abandonliberty 10y ago
  If people want to self-identify as rude and unable to understand the difference between creators and implementers of policy, I vote we let them. I'd rather they were turned back at the border. It would be great if we could apply this to people currently in the nation as well.
- masonic 10y ago
  Note that this predates the Trump administration.
r00fus 10y ago
I think that's the only real power that other countries can exercise - force Americans (especially business travelers) to experience what the US is forcing on visitors in the US.

herbturbo 10y ago

Reminds me of a question on the US visa waiver form asking whether you are or ever have been a Nazi. Because everybody knows that Nazis cannot lie, and international terror organizations cannot create dummy social media accounts.

mhurron 10y ago
Green card application includes a form that has that and more. Are you a communist, have you been convicted of genocide, have you ever used a prostitute ... I really wish I had taken a picture of that form, the majority of questions were idiotic.
- dragonwriter 10y ago
  The I-485, right? https://www.uscis.gov/i-485 https://www.uscis.gov/i-485
  - mhurron 10y ago
    That's the one. That's good for a laugh.
- js8 10y ago
  I also used to think those questions are idiotic, but maybe there is a point to them. Now many people are worrying like, all these people coming from a different culture, do they understand our culture? So maybe these questions serve as a simple reminder - don't do these things. Actually, I think it would be better to ask about U.S. Bill of Rights, but hopefully you get my point.
  - mhurron 10y ago
    That is not the purpose of the form. Also - "Have you received public assistance in the United States from any source, including the U.S. Government or any State, county, city, or municipality (other than emergency medical treatment), or are you likely to receive public assistance in the future?" I was unaware that that was a problem in the US. It also asks about things that are legal in other countries and you are penalized if you answer honestly.

megous 10y ago

Will not having a social media presence be considered a red flag?

concernedmonkey 10y ago
This is one of my worries. I had a rarely-used FB account for a few years, but deleted it when I realized the privacy concerns. No FB, twitter, IG, Gmail, LinkedIn, etc. Nothing. You can't find me through a Google search except for my public-facing professional certifications (which are required to be public-facing). I wonder if one day this will get me on a list as some kind of "lone wolf" even though I'm quite social (in the in-person sense).

imgabe 10y ago

I don't think anyone who really wanted to get into the US would have a problem handing over A social media password. Whether that's a password for an account specifically created to be reviewed by immigration authorities is another matter entirely. What makes DHS think they would be reviewing a real social media account? I think this is not about reviewing social media accounts. This is about giving DHS and CBP a pretense to deny entry to anyone they feel like, based on gut feelings, prejudices, whatever.

js8 10y ago
I would have a problem with it. And I would really want to get into US, possibly, because I work for an American company. But it's not my job to create fake social media accounts, sorry.
- imgabe 10y ago
  I don't think filling out visa applications, in general, is anyone's job (unless maybe you're a personal assistant for someone who travels internationally a lot). It's not about what is and is not your job. If that's what a country requires to allow you entry, and you want to enter, that's what you do.
  - js8 10y ago
    I am just a normal programmer, not a spy. Visa application is acceptable (I have done that in the past), forging social media accounts is not (I in fact I do have FB account but God knows where the password is).
    - marcos123 10y ago
      I think the point they were making was that regardless of how you feel emotionally about giving up specific information, it has no effect on whether a country allows you to enter. So go ahead and do only what you feel is "acceptable", just don't be surprised when you are turned away at the border for not filling out all of the required documents.

smileysteve 10y ago

2 Factor Authentication (Facebook, Twitter, Instagram (through Facebook), Google) really puts a damper on this and helps you remember that the U.S. government (and esp leadership) is sorely behind when it comes to security

chopin 10y ago
In which way would that help? It's access what is wanted, not the password. If you have 2FA, other ways will be found. I don't believe that there is a technical solution. This is a purely political thing. If this becomes policy the US becomes entirely off-limits for me although I don't have any social media account.
- sqeaky 10y ago
  In the short term if they ask for passwords and they are provided people with 2FA might slip through unviolated. That is until laws catch up.
- smileysteve 10y ago
  The problem I see is that I'll be able to share my password, but somebody won't be able to log in. They'd come back and be confused. If I give them the 2 factor, the computer needs to be there, or they need to say it over radio, and even if they say it over radio, it would be a race before it expires. And yes, presumably, they could work with facebook or the NSA for a portal that bypasses 2 factor, but then they don't need my password.

eatbitseveryday 10y ago

Give them something which resembles a password? How will they know? Give them the password, then change it afterwards? Have an alternative account used just for immigrations? Claim you have no social media accounts, or deactivate them before entering the country (we know FB doesn't delete, only deactivates)? Change the name on the social media accounts?

jlarocco 10y ago
Or do the right thing and tell them to go f* themselves because it's a huge invasion of privacy and none of their business. It's unfortunate most people won't have this option. I've been trying to give the Trump administration a chance, but this is getting more ridiculous and more embarrassing every day.

edblarney 10y ago

We should actually hope that they 'take it too far' and apply it broadly - because the first day it went into force the blowback would be mesmerizingly big. There was some blowback from immigration and that affected relatively few. But this will hit millions of people every day with a huge WTF? It'll go to every CEO and media person in America very quickly as a 'very material issue', unlike some policies which companies support/resist for populist or political reasons. If they just do it to 'select people' ... then it would be something on blogs, sometimes in the press yada yada but maybe not so mainstream.

arrty88 10y ago

give them a stage account?

logfromblammo 10y ago

Welp, time for Facebook, Twitter, et al. to intentionally make themselves inaccessible from locations/networks coincident with US ports of entry. "To protect our produ^H^H^H^H^Hcustomers' privacy, we have decided to block access to all accounts that we can ascertain within reasonable certainty to be temporarily crossing an international border. We apologize for the inconvenience, and service will be restored once you get further away from the port of entry, or as soon as those in charge of US customs decide to stop being asshats."

always_good 10y ago

My female Canadian friend was interrogated in a Canadian airport by an American border agent because she made the unfortunate mistake of having a connecting flight in the States on the way to visit me in Mexico. The agent asked her if she was a "good girl" and then demanded access to her phone's Facebook Messenger to see if she'd been offering or planning sex services. She of course complied. What else are you going to do? Cancel your plans and stay home during your vacation leave? It's a great job to have if you're a creep and/or resent women.

toomuchtodo 10y ago
Please report this incident to US Customs and Border Patrol, as well as DHS. https://www.cbp.gov/contact https://www.cbp.gov/contact https://www.dhs.gov/department-white-pages https://www.dhs.gov/department-white-pages EDIT: Sorry to piggyback. For your own security/privacy when traveling (I'm sorry, as a US citizen), bring a dumb phone just for calling, and wipe your iPhone (if its an iPhone) before transiting a customs checkpoint. Restore from iCloud when you're safely out of the airport. If asked what the dumb phone is for, "I break my iPhone all the time."
- dingaling 10y ago
  > Restore from iCloud when you're safely out of the airport. "Sir, your phone appears to have been reset. Please connect it to iCloud and sync now". If they can compel access to apps and social media why would iCloud et al be any different?
  - toomuchtodo 10y ago
    Keep a separate sparse iCloud account if you don't think you have the soft skills to work around that unlikely scenario.
    - sqeaky 10y ago
      Will it stay unlikely in the long term?

cosinetau 10y ago

k bye

sctb 10y ago
Please comment civilly and substantively or not at all. We detached this comment from https://news.ycombinator.com/item?id=13601038 https://news.ycombinator.com/item?id=13601038 and marked it off-topic.

ommunist 10y ago

Before going to the US change your keyboard to Tibetan, change the password and give them your password in dzongkha notation written on a paper form. Make sure it is at least 16 symbols long. འགོ་དང་པ་བཅའ་མར་གཏོགས་དོ་ཡོདཔ།

daxelrod 10y ago
At which point they may just ask you to type in your password yourself.
- smileysteve 10y ago
  At which point they need to provide a tibetan keyboard; unless they'll be able to thoroughly inspect your mobile device that may not have wifi.
- ommunist 10y ago
  The only have instruction to ask for password. They cannot force you to do something. You do not have to give them access to your password manager.
  - daxelrod 10y ago
    Sure, they can't force you to do something, but they can make your entry dependent on your doing something, as long as you're not a citizen.
    - ommunist 10y ago
      But they cannot go against the instruction they have. I.e. they cannot force you to defecate into your pants just to be sure you are not holding USB flash drive there. Same applies here. They can ask for password, but they cannot force you to actually enter it. Its illegal.

makecheck 10y ago

Perhaps all new policies should have to be applied first to legislators. Want a password requirement? Fine, submit yours first, Congressman; we won't abuse it, "promise". Want inane questions and forms with high fees? Fine, Congressman, first you must fill out every last form yourself (don't forget to have a new picture taken, and thumbprints!). If you still think it's reasonable after all that, we can talk.

sqeaky 10y ago
While phrases like these might sound nice on the surface, they are entirely unenforceable. How do you intend to make this happen?

crystalmeph 10y ago

Facebook, Twitter, etc. should shut down DHS' and other TLAs' Facebook and Twitter pages if those organizations are purposefully violating the companies' TOS, including the accounts of the leadership who presumably know about and authorize these rules. Up to and including the official POTUS Twitter account as well as @realdonaldtrump. Just because the government can "legally" get access to anything they want doesn't mean they get to live consequence-free.

r00fus 10y ago

Soon: People leaving the US will have to hand over social media credentials, too. Do you think they'll stop at "foreigners"?

sqeaky 10y ago

What would happen if Twitter or Facebook implemented a "Crossing the Border" mode. When you set it up you get a fake password that logs into a fake version of your account with plausible looking but innocuous content. Then after some time, perhaps 72 hours this an all traces of it are erased. That ought to last until some new legislation specifically prohibits it.

drcongo 10y ago

I had to renew my ESTA[1] recently and was somewhat surprised to find that the form is now 6 pages instead of 6 fields, and asks for all sorts of weird stuff like the name, address and phone number of someone on the United States who can verify your identity. [1] https://esta.cbp.dhs.gov/esta/ https://esta.cbp.dhs.gov/esta/