6 ms·

How to Get Past Customs Without Giving Up Your Digital Privacy

38 points by mikecarlton 10y ago

deleted 10y ago
[deleted]
- lisper 10y ago
  You should be careful about saying things like that on a public forum. It could get both you and your friends on a watch list or worse.
  - NotSammyHagar 10y ago
    nobody is using a real account with their normal email here, are they?
    - lisper 10y ago
      Your email is not the only information that binds your account to your real identity. Unless you access HN through TOR and use extreme caution not to reveal any personal information in submissions or comments, it would not be hard for the government to figure out who you are.
  - deleted 10y ago
    [deleted]
hprotagonist 10y ago
step 0: use a password manager. step 1: use randomly generated passwords for every account in that manager. step 2: neglect to bring that password file, or any means of accessing it, across a border. Them: Give us your password! You: I literally cannot. Your move!
- x1798DE 10y ago
  Them: Ok, we're denying you entry to this country. Alternatively, if you are a citizen: Them: We'll just keep these devices, then. When you get the password maybe you can get them back after we've searched them. Just wait here for 6-24 hours while we do our alternative background check.
  - rdl 10y ago
    If you're a US citizen and are harassed by CBP at the border (and you know you're not doing anything wrong), you should stand up for your rights.
    - x1798DE 10y ago
      Sure, I'm just saying that they aren't going to just be impressed with your awesome op-sec, they are going to seize your devices as evidence and harass you to the full extent that their inappropriately broad powers allow. If you're not ready for that to happen, probably best to make other arrangements.
      - rdl 10y ago
        Yeah, and I'm saying that if you can do this, you should, to help the many people who can't. I'd get more lulz value out of a $250 chromebook being taken for 6mo on bogus grounds than the cost of the chromebook. It's not a solution (since they can easily pre-sort citizen vs. non-citizen, and treat one group dramatically worse, even beyond the legal or threat-model requirements), but it's a start.
      - hprotagonist 10y ago
        I've had a lot of practice being stubbornly bright and chipper and polite at bureaucrats. I am happy to be obnoxiously polite for days at a time, if need be.
  - hprotagonist 10y ago
    i'm in a position where i'm able to be very happy indeed to make CBP do their jobs and waste as much of their time as possible to prove a point. (white, male, christian background, well educated, "looks like a good guy". might as well exploit those advantages)
rdl 10y ago
It's really depressing that this kind of thing is even needed for the US. As a citizen with a lot of privileged status, I'd personally be pushing back a lot if any US CBP person ever asked me for anything beyond proof of citizenship and the bare minimum to show I'm not carrying contraband. I'd consider standing up to that as a way to help other people who can't as easily stand up to it. On the other hand when I'm visiting a foreign country on a visa, I'm in a similarly disadvantaged position. (As an aside, if anyone in security is ever looking for a trustworthy and accurate journalist, I strongly endorse Andy Greenberg; consistently good at respecting "on the record" vs. "off the record", and he actually asks good questions.)
- ndh2 10y ago
  > I'd consider standing up to that What does that even mean? They'll detain you or deny entry. Then what?
  - rdl 10y ago
    I'm a US citizen. Aside from "is this actually Ryan Lackey, the US citizen?", immigration has no power to keep me out of the country. "Do you have reason to believe I'm someone other than the US Citizen in this passport? Please articulate your specific reasons for concern." is itself a pretty solid validation of "this guy is 1) a US citizen 2) knows the law 3) is likely to have >50 lawyers as friends and will pursue the matter happily. I'm really polite/friendly with ICE/CBP -- usually all I get is "welcome home", very infrequently they ask "where were you?" -- but in principle they can hassle people. Customs has some additional power -- do they believe you're transporting contraband -- illegal items, untaxed items, or dangerous items (agricultural contact). But since I never travel with illegal items, and generally have everything very nicely organized and minimalist, the only real thing they could claim is "you have digital files we want to access", and that is 1) an emerging area of law and 2) exactly the battle I want to fight. In general the law is on the side of citizens not turning over data at borders, although it's nowhere near as settled as most other things.
    - ilaksh 10y ago
ndh2 10y ago
Step 1: Don't travel to the U.S.
danjoc 10y ago
2FA? With a mobile number? Did the author completely forget Snowden, and how all the major phone companies give NSA direct access? Did the author forget the broad NSA information sharing that Obama enacted just before leaving office? Even that damned Coast Guard can get your 2FA code now.
- willstrafach 10y ago
  > Even that damned Coast Guard can get your 2FA code now. Posting unsourced and absolutely false claims does not help anyone, honestly. I would even consider it harmful.
  - danjoc 10y ago
    Before Snowden, they liked to call it tin foil hats. https://theintercept.com/2017/01/13/obama-opens-nsas-vast-trove-of-warrantless-data-to-entire-intelligence-community-just-in-time-for-trump/ https://theintercept.com/2017/01/13/obama-opens-nsas-vast-tr... One of those agencies is the Coast Guard. If the message crosses national boundaries, it's fair game. http://www.nytimes.com/2013/08/08/us/broader-sifting-of-data-abroad-is-seen-by-nsa.html http://www.nytimes.com/2013/08/08/us/broader-sifting-of-data... And before you pass through customs, you are considered outside the country. All legal. Checkmate. Fortunately, I've just discovered that the SMS option isn't required on a Google account. Now you just have to remember to remove your travel yubikey from the account before you fly home.
    - willstrafach 10y ago
      Please review the post linked from the beginning of the linked The Intercept article, here: https://icontherecord.tumblr.com/post/155766682978/fact-sheet-on-eo-12333-raw-sigint-availability https://icontherecord.tumblr.com/post/155766682978/fact-shee... You'll see that SIGINT sharing is not a free-for-all in any manner, it is restricted. It seems dishonest to tell people the Coast Guard can use it to compromise SMS 2FA (I'd be far more worried about other countries compromising SMS 2FA in a close-access scenario, using an "IMSI catcher" or similar device to intercept the incoming message).

38 points by mikecarlton 10y ago

deleted 10y ago

[deleted]

lisper 10y ago
You should be careful about saying things like that on a public forum. It could get both you and your friends on a watch list or worse.
- NotSammyHagar 10y ago
  nobody is using a real account with their normal email here, are they?
  - lisper 10y ago
    Your email is not the only information that binds your account to your real identity. Unless you access HN through TOR and use extreme caution not to reveal any personal information in submissions or comments, it would not be hard for the government to figure out who you are.
- deleted 10y ago
  [deleted]

hprotagonist 10y ago

step 0: use a password manager. step 1: use randomly generated passwords for every account in that manager. step 2: neglect to bring that password file, or any means of accessing it, across a border. Them: Give us your password! You: I literally cannot. Your move!

x1798DE 10y ago
Them: Ok, we're denying you entry to this country. Alternatively, if you are a citizen: Them: We'll just keep these devices, then. When you get the password maybe you can get them back after we've searched them. Just wait here for 6-24 hours while we do our alternative background check.
- rdl 10y ago
  If you're a US citizen and are harassed by CBP at the border (and you know you're not doing anything wrong), you should stand up for your rights.
  - x1798DE 10y ago
    Sure, I'm just saying that they aren't going to just be impressed with your awesome op-sec, they are going to seize your devices as evidence and harass you to the full extent that their inappropriately broad powers allow. If you're not ready for that to happen, probably best to make other arrangements.
    - rdl 10y ago
      Yeah, and I'm saying that if you can do this, you should, to help the many people who can't. I'd get more lulz value out of a $250 chromebook being taken for 6mo on bogus grounds than the cost of the chromebook. It's not a solution (since they can easily pre-sort citizen vs. non-citizen, and treat one group dramatically worse, even beyond the legal or threat-model requirements), but it's a start.
    - hprotagonist 10y ago
      I've had a lot of practice being stubbornly bright and chipper and polite at bureaucrats. I am happy to be obnoxiously polite for days at a time, if need be.
- hprotagonist 10y ago
  i'm in a position where i'm able to be very happy indeed to make CBP do their jobs and waste as much of their time as possible to prove a point. (white, male, christian background, well educated, "looks like a good guy". might as well exploit those advantages)

rdl 10y ago

It's really depressing that this kind of thing is even needed for the US. As a citizen with a lot of privileged status, I'd personally be pushing back a lot if any US CBP person ever asked me for anything beyond proof of citizenship and the bare minimum to show I'm not carrying contraband. I'd consider standing up to that as a way to help other people who can't as easily stand up to it. On the other hand when I'm visiting a foreign country on a visa, I'm in a similarly disadvantaged position. (As an aside, if anyone in security is ever looking for a trustworthy and accurate journalist, I strongly endorse Andy Greenberg; consistently good at respecting "on the record" vs. "off the record", and he actually asks good questions.)

ndh2 10y ago
> I'd consider standing up to that What does that even mean? They'll detain you or deny entry. Then what?
- rdl 10y ago
  I'm a US citizen. Aside from "is this actually Ryan Lackey, the US citizen?", immigration has no power to keep me out of the country. "Do you have reason to believe I'm someone other than the US Citizen in this passport? Please articulate your specific reasons for concern." is itself a pretty solid validation of "this guy is 1) a US citizen 2) knows the law 3) is likely to have >50 lawyers as friends and will pursue the matter happily. I'm really polite/friendly with ICE/CBP -- usually all I get is "welcome home", very infrequently they ask "where were you?" -- but in principle they can hassle people. Customs has some additional power -- do they believe you're transporting contraband -- illegal items, untaxed items, or dangerous items (agricultural contact). But since I never travel with illegal items, and generally have everything very nicely organized and minimalist, the only real thing they could claim is "you have digital files we want to access", and that is 1) an emerging area of law and 2) exactly the battle I want to fight. In general the law is on the side of citizens not turning over data at borders, although it's nowhere near as settled as most other things.
  - ilaksh 10y ago

ndh2 10y ago

Step 1: Don't travel to the U.S.

danjoc 10y ago

2FA? With a mobile number? Did the author completely forget Snowden, and how all the major phone companies give NSA direct access? Did the author forget the broad NSA information sharing that Obama enacted just before leaving office? Even that damned Coast Guard can get your 2FA code now.

willstrafach 10y ago
> Even that damned Coast Guard can get your 2FA code now. Posting unsourced and absolutely false claims does not help anyone, honestly. I would even consider it harmful.
- danjoc 10y ago
  Before Snowden, they liked to call it tin foil hats. https://theintercept.com/2017/01/13/obama-opens-nsas-vast-trove-of-warrantless-data-to-entire-intelligence-community-just-in-time-for-trump/ https://theintercept.com/2017/01/13/obama-opens-nsas-vast-tr... One of those agencies is the Coast Guard. If the message crosses national boundaries, it's fair game. http://www.nytimes.com/2013/08/08/us/broader-sifting-of-data-abroad-is-seen-by-nsa.html http://www.nytimes.com/2013/08/08/us/broader-sifting-of-data... And before you pass through customs, you are considered outside the country. All legal. Checkmate. Fortunately, I've just discovered that the SMS option isn't required on a Google account. Now you just have to remember to remove your travel yubikey from the account before you fly home.
  - willstrafach 10y ago
    Please review the post linked from the beginning of the linked The Intercept article, here: https://icontherecord.tumblr.com/post/155766682978/fact-sheet-on-eo-12333-raw-sigint-availability https://icontherecord.tumblr.com/post/155766682978/fact-shee... You'll see that SIGINT sharing is not a free-for-all in any manner, it is restricted. It seems dishonest to tell people the Coast Guard can use it to compromise SMS 2FA (I'd be far more worried about other countries compromising SMS 2FA in a close-access scenario, using an "IMSI catcher" or similar device to intercept the incoming message).