5 ms·

> US Customs officers didn’t even need to ask for his passwords — they were saved in their own system This is also horrifying. So there's a government database

by inlined 10y ago

> US Customs officers didn’t even need to ask for his passwords — they were saved in their own system This is also horrifying. So there's a government database of plaintext passwords and a massive body of people have legitimate access?

piotrkaminski 10y ago
OTOH, not changing all your passwords after having to divulge them under duress is pretty careless, too.
- tempestn 10y ago
  True, but it'd be especially painful if you use a password manager. Presumably they're going to demand the master password, so you're left changing everything. If you were dealing with a reasonable system, a compromise might be to unlock the accounts for them (without them seeing the password) and allow them to review the contents in your presence. That way you know exactly what they've seen, and that they're not holding onto anything, but they should still be able to do any necessary screening. Unfortunately the system appears to be weighted rather more toward maximum intimidation than reasonableness.
  - literallycancer 10y ago
    >True, but it'd be especially painful if you use a password manager. Presumably they're going to demand the master password, so you're left changing everything. So you have to change everything + the master password, that is 1 more than you would have to change, had you not used it. Without a password manager, you could just give them the passwords they wanted, if you remember 20+ different random passwords. Otherwise you are reusing your passwords and so have to change most of them anyway. >If you were dealing with a reasonable system That this could seriously be described as "reasonable" shows just how much things went wrong.
    - tempestn 10y ago
      I use a password manager and certainly wouldn't stop because of this, but no, without one you only have to change the passwords you give them. That would be a handful of passwords to SM accounts and such. If I give them my master password I have to change ALL my passwords. I have several hundred passwords stored. And yes, I agree that having to show border guards your facebook account isn't ideal. It's a hell of a lot more reasonable than just giving them all your passwords and having them run rampant through your digital life without your even knowing what they've done or seen though.
- yestoallthat 10y ago
  If wiping your browser history is "suspicious", then surely so would be changing your password and not divulging the changed one, so how is that any comfort?
  - piotrkaminski 10y ago
    I'm sure you'd be made to divulge the new passwords, but at least the passwords stored in their database -- that could be accessed by god-knows-who -- wouldn't be usable for the weeks or months between cross-border trips.
- Mithaldu 10y ago
  The problem isn't the changing part. The problem is that if there are any shared passwords or patterns you have, they are now stored forever in their database. One can't only act after going through, one has to change all their passwords to throwaway passwords before going through the border.
  - BEEdwards 10y ago
    Wait what? Why are you sharing passwords? That is poor password security right there, even before giving your master key to some rando.
    - Mithaldu 10y ago
      Can we please stop pretending to be surprised and shocked that this is a thing people in general do? It wasn't even funny anymore 10 years ago and nowadays is one of the most tired comments possible.
- deleted 10y ago
  [deleted]
b3lvedere 10y ago
Are you really that shocked that a government has databases like this?
- Bartweiss 10y ago
  Storing plaintext, readable by random border patrol staffers? Yeah. I'm not surprised they have access to a lot of accounts, but that's different from trusting that everyone working the front line at border patrol will use that database securely and ethically.

by inlined 10y ago

piotrkaminski 10y ago

OTOH, not changing all your passwords after having to divulge them under duress is pretty careless, too.

tempestn 10y ago
True, but it'd be especially painful if you use a password manager. Presumably they're going to demand the master password, so you're left changing everything. If you were dealing with a reasonable system, a compromise might be to unlock the accounts for them (without them seeing the password) and allow them to review the contents in your presence. That way you know exactly what they've seen, and that they're not holding onto anything, but they should still be able to do any necessary screening. Unfortunately the system appears to be weighted rather more toward maximum intimidation than reasonableness.
- literallycancer 10y ago
  >True, but it'd be especially painful if you use a password manager. Presumably they're going to demand the master password, so you're left changing everything. So you have to change everything + the master password, that is 1 more than you would have to change, had you not used it. Without a password manager, you could just give them the passwords they wanted, if you remember 20+ different random passwords. Otherwise you are reusing your passwords and so have to change most of them anyway. >If you were dealing with a reasonable system That this could seriously be described as "reasonable" shows just how much things went wrong.
  - tempestn 10y ago
    I use a password manager and certainly wouldn't stop because of this, but no, without one you only have to change the passwords you give them. That would be a handful of passwords to SM accounts and such. If I give them my master password I have to change ALL my passwords. I have several hundred passwords stored. And yes, I agree that having to show border guards your facebook account isn't ideal. It's a hell of a lot more reasonable than just giving them all your passwords and having them run rampant through your digital life without your even knowing what they've done or seen though.
yestoallthat 10y ago
If wiping your browser history is "suspicious", then surely so would be changing your password and not divulging the changed one, so how is that any comfort?
- piotrkaminski 10y ago
  I'm sure you'd be made to divulge the new passwords, but at least the passwords stored in their database -- that could be accessed by god-knows-who -- wouldn't be usable for the weeks or months between cross-border trips.
Mithaldu 10y ago
The problem isn't the changing part. The problem is that if there are any shared passwords or patterns you have, they are now stored forever in their database. One can't only act after going through, one has to change all their passwords to throwaway passwords before going through the border.
- BEEdwards 10y ago
  Wait what? Why are you sharing passwords? That is poor password security right there, even before giving your master key to some rando.
  - Mithaldu 10y ago
    Can we please stop pretending to be surprised and shocked that this is a thing people in general do? It wasn't even funny anymore 10 years ago and nowadays is one of the most tired comments possible.
deleted 10y ago
[deleted]

b3lvedere 10y ago

Are you really that shocked that a government has databases like this?

Bartweiss 10y ago
Storing plaintext, readable by random border patrol staffers? Yeah. I'm not surprised they have access to a lot of accounts, but that's different from trusting that everyone working the front line at border patrol will use that database securely and ethically.