7 ms·

--> The current best practice for border crossings --- really anywhere in the world --- is simply not to carry anything you're unwilling to unlock for Customs.

by graeme 10y ago

--> The current best practice for border crossings --- really anywhere in the world --- is simply not to carry anything you're unwilling to unlock for Customs. How do password managers play into this? I'm likely going to be traveling to the US on business. I'll be bringing a travel phone rather than a normal phone (This is my standard travel practice for any country). I could do the same with a computer. I don't mind unlocking that. But passwords are a thornier issue. All of my passwords are stored in a password manager. On my computer, these are actually stored in a physical file, so if CBP cloned my hard drive they'd potentially have all my passwords. That would amount to ~400 passwords I'd need to change. I could make a travel profile for my password manager and only bring in a limited, strictly necessary set of passwords. But then this raises a further issue: do I keep social media passwords on that list, or leave them off? If I kept them off, I could honestly say "I can't login. I didn't want distracting social media on a business trip". But it might be safer just to have them? I could change the passwords after. I'm not sure of the risks of having CBP log into Facebook. This is probably not a likely case I have to worry about, but I'd still like to figure out the best practice.

Rarebox 10y ago
Could you just bring a device with freshly installed Windows / OSX, and clone the whole disk image over the internet once you're inside U.S. ?
- graeme 10y ago
  Well, yes. But as tptacek said: "But non-citizens, possibly including LPRs, cannot: if an alien attempts to cross the border with a device they can't unlock "because they don't have the corresponding 2FA token with them" (as one friend suggested they do), they'll be detained, their devices confiscated, and then put on a flight out of the country." I'm not a US citizen. I don't have anything in particular I care about the CBP seeing. But, I'd rather they not have all of my 400 passwords. I'd then have to change everything, and also be breaking a bunch of bank terms of service. I don't think CBP actually wants my bank info. But with all passwords in a manager, they would get it if they had access. However, with no passwords, they may bar entry.
  - tptacek 10y ago
    I'm traveling overseas this summer, and I don't plan on having my 1Password database handy when I reenter the country.
    - graeme 10y ago
      So you will be a position of "can't login to that site". How does that square with: "if an alien attempts to cross the border with a device they can't unlock "because they don't have the corresponding 2FA token with them" (as one friend suggested they do), they'll be detained, their devices confiscated, and then put on a flight out of the country." I guess they haven't yet started asking for social media passwords, so maybe I'm overthinking this. I'm certainly going to be prepared to unlock any devices. It's the web passwords I'm not sure what to do with.
      - infinite8s 10y ago
        Well, in tptacek's case, I believe he's a US citizen so they can't deny him entry.
        graeme 10y ago
        Hmm. What would be the best practice for a foreign national?
        tptacek 10y ago
        None of us know. It's a real problem.
        zeveb 10y ago
        > What would be the best practice for a foreign national? Understand that you may be denied entry to any country but your own. It's a fact of life which you cannot do anything about, so you might as well accept it. What I do is: - travel with a machine which is not logged into any of my accounts - if asked, I can honestly say that I do not know any of my social-media passwords (because they are all of the form mZOH05WaxeAWqI79myMxcx or SWwDmDOkyHCVdX8eOiTLXC1U1psffeXfFgNx6PaZZhp); if that's unacceptable to customs in any country, they can send me back home - if they press, I can honestly say that my computer back home (not the computer I have with me) has my master password file, and that there is no other copy
gregmac 10y ago
> But then this raises a further issue: do I keep social media passwords on that list, or leave them off? If I kept them off, I could honestly say "I can't login. I didn't want distracting social media on a business trip". To go a step further, what if you don't even have a Facebook account? How do you even prove that, if there are other accounts with the same name as you that show up when searching (and the profile picture is not sufficient to rule it out)? > I'm not sure of the risks of having CBP log into Facebook. There's a non-zero chance you're going to be detained and grilled if any of your friends have talked about terrorism, drugs, have criminal records, or are on or share a name with someone on a terrorist watch list (and that may extend to their friends or further). They could also potentially take a copy of your friends list, posts or any other content and do who knows what with it at some point in the future.
corey_moncure 10y ago
Encrypt your password store using gpg and zx2c4's pass! The GUI app qtpass even works on Windows. I've been using it for months and the system is rock solid and has never let me down. https://www.passwordstore.org/ https://www.passwordstore.org/ They can copy your drive all you want, and you have until 2030 to change your passwords. Alternatively, just store them in a git repo on a server somewhere and access them remotely.
- deleted 10y ago
  [deleted]
- deleted 10y ago
  [deleted]
tptacek 10y ago
If you're not a citizen, I think this is probably pretty simple: don't carry anything across the border that you would be uncomfortable being forced to unlock. There's nothing you can encrypt with a passphrase that is protected from a border search, unless you're comfortable being sent back home, losing your computer hardware, and not being allowed back to the US at least until the next Presidential administration, probably 10 years, and possibly forever. The only point I really want to make: It is a very bad plan to attempt to outsmart CBP with clever encryption strategies. If you want to protect something, don't bring it to a border crossing. CBP's budget is tens of billions of dollars, and they don't have to break your encryption; they just have to fuck up your entry into the country. The math doesn't work out here for nerds.
- graeme 10y ago
  Right. Since they may ask for social media passwords, would that imply making a travel profile for my travel devices that has password access to things like Facebook and a subset of sites I'd need, but not necessarily all 400+ of my logins? I don't care if they login to my Facebook (well, I think I don't). I just don't want to have them have everything, because then I'd have to change it all. To be very clear, not planning to use any encryption strategies. And as you mentioned, being unable to access Facebook is not a sensible option. My question is about what to bring, not how to secure it.
  - deong 10y ago
    It doesn't matter what you have in your password manager. If you're not a US citizen, they can demand your facebook access. If you don't have it, can't unencrypt it, or just feel like telling them to fuck off doesn't matter. You have no legal right to enter the country except with their permission, and they may well tell the person who didn't put their facebook passwords in the password manager to get back on a plane and go home. US citizens have it better in at least that one regard. They can't keep me from entering the country. They can confiscate my laptop, but if I don't want to give them facebook access, there's not much they can do to stop me. They can of course add me to some list that makes my life miserable every time I fly, but there's no constitutional provision that allows preventing a citizen from entering the country.
acejam 10y ago
If your password manager doesn't encrypt it's own files on disk, then you're using the wrong password manager.
- graeme 10y ago
  I'm operating on the assumption they'll ask for the password to that too. That's where the social media passwords are.
neumann 10y ago
I use syncthing. Mostly for syncing all my music and pictures between phone / laptop and home server. For your use case, there is a solution with the caveat that your password manager is unavailable on the flight. Simply have a dumb phone on entry with Syncthing and your Password manager installed but no password file. Once you have been allowed entry into the despotic regime's lands, connect to a starbucks wifi, initiate syncthing and it will pull your password file from your home server / computer etc. If you update your password file, it will be synced back to your home server. When you travel again, disable syncthing, delete your password manager. Or use an ssh script to pull it from your home server.

by graeme 10y ago

Rarebox 10y ago

Could you just bring a device with freshly installed Windows / OSX, and clone the whole disk image over the internet once you're inside U.S. ?

graeme 10y ago
Well, yes. But as tptacek said: "But non-citizens, possibly including LPRs, cannot: if an alien attempts to cross the border with a device they can't unlock "because they don't have the corresponding 2FA token with them" (as one friend suggested they do), they'll be detained, their devices confiscated, and then put on a flight out of the country." I'm not a US citizen. I don't have anything in particular I care about the CBP seeing. But, I'd rather they not have all of my 400 passwords. I'd then have to change everything, and also be breaking a bunch of bank terms of service. I don't think CBP actually wants my bank info. But with all passwords in a manager, they would get it if they had access. However, with no passwords, they may bar entry.
- tptacek 10y ago
  I'm traveling overseas this summer, and I don't plan on having my 1Password database handy when I reenter the country.
  - graeme 10y ago
    So you will be a position of "can't login to that site". How does that square with: "if an alien attempts to cross the border with a device they can't unlock "because they don't have the corresponding 2FA token with them" (as one friend suggested they do), they'll be detained, their devices confiscated, and then put on a flight out of the country." I guess they haven't yet started asking for social media passwords, so maybe I'm overthinking this. I'm certainly going to be prepared to unlock any devices. It's the web passwords I'm not sure what to do with.
    - infinite8s 10y ago
      Well, in tptacek's case, I believe he's a US citizen so they can't deny him entry.
      - graeme 10y ago
        Hmm. What would be the best practice for a foreign national?
        tptacek 10y ago
        None of us know. It's a real problem.
        zeveb 10y ago
        > What would be the best practice for a foreign national? Understand that you may be denied entry to any country but your own. It's a fact of life which you cannot do anything about, so you might as well accept it. What I do is: - travel with a machine which is not logged into any of my accounts - if asked, I can honestly say that I do not know any of my social-media passwords (because they are all of the form mZOH05WaxeAWqI79myMxcx or SWwDmDOkyHCVdX8eOiTLXC1U1psffeXfFgNx6PaZZhp); if that's unacceptable to customs in any country, they can send me back home - if they press, I can honestly say that my computer back home (not the computer I have with me) has my master password file, and that there is no other copy

gregmac 10y ago

> But then this raises a further issue: do I keep social media passwords on that list, or leave them off? If I kept them off, I could honestly say "I can't login. I didn't want distracting social media on a business trip". To go a step further, what if you don't even have a Facebook account? How do you even prove that, if there are other accounts with the same name as you that show up when searching (and the profile picture is not sufficient to rule it out)? > I'm not sure of the risks of having CBP log into Facebook. There's a non-zero chance you're going to be detained and grilled if any of your friends have talked about terrorism, drugs, have criminal records, or are on or share a name with someone on a terrorist watch list (and that may extend to their friends or further). They could also potentially take a copy of your friends list, posts or any other content and do who knows what with it at some point in the future.

corey_moncure 10y ago

Encrypt your password store using gpg and zx2c4's pass! The GUI app qtpass even works on Windows. I've been using it for months and the system is rock solid and has never let me down. https://www.passwordstore.org/ https://www.passwordstore.org/ They can copy your drive all you want, and you have until 2030 to change your passwords. Alternatively, just store them in a git repo on a server somewhere and access them remotely.

deleted 10y ago
[deleted]
deleted 10y ago
[deleted]

tptacek 10y ago

If you're not a citizen, I think this is probably pretty simple: don't carry anything across the border that you would be uncomfortable being forced to unlock. There's nothing you can encrypt with a passphrase that is protected from a border search, unless you're comfortable being sent back home, losing your computer hardware, and not being allowed back to the US at least until the next Presidential administration, probably 10 years, and possibly forever. The only point I really want to make: It is a very bad plan to attempt to outsmart CBP with clever encryption strategies. If you want to protect something, don't bring it to a border crossing. CBP's budget is tens of billions of dollars, and they don't have to break your encryption; they just have to fuck up your entry into the country. The math doesn't work out here for nerds.

graeme 10y ago
Right. Since they may ask for social media passwords, would that imply making a travel profile for my travel devices that has password access to things like Facebook and a subset of sites I'd need, but not necessarily all 400+ of my logins? I don't care if they login to my Facebook (well, I think I don't). I just don't want to have them have everything, because then I'd have to change it all. To be very clear, not planning to use any encryption strategies. And as you mentioned, being unable to access Facebook is not a sensible option. My question is about what to bring, not how to secure it.
- deong 10y ago
  It doesn't matter what you have in your password manager. If you're not a US citizen, they can demand your facebook access. If you don't have it, can't unencrypt it, or just feel like telling them to fuck off doesn't matter. You have no legal right to enter the country except with their permission, and they may well tell the person who didn't put their facebook passwords in the password manager to get back on a plane and go home. US citizens have it better in at least that one regard. They can't keep me from entering the country. They can confiscate my laptop, but if I don't want to give them facebook access, there's not much they can do to stop me. They can of course add me to some list that makes my life miserable every time I fly, but there's no constitutional provision that allows preventing a citizen from entering the country.

acejam 10y ago

If your password manager doesn't encrypt it's own files on disk, then you're using the wrong password manager.

graeme 10y ago
I'm operating on the assumption they'll ask for the password to that too. That's where the social media passwords are.

neumann 10y ago

I use syncthing. Mostly for syncing all my music and pictures between phone / laptop and home server. For your use case, there is a solution with the caveat that your password manager is unavailable on the flight. Simply have a dumb phone on entry with Syncthing and your Password manager installed but no password file. Once you have been allowed entry into the despotic regime's lands, connect to a starbucks wifi, initiate syncthing and it will pull your password file from your home server / computer etc. If you update your password file, it will be synced back to your home server. When you travel again, disable syncthing, delete your password manager. Or use an ssh script to pull it from your home server.