4 ms·

Isn't the counter simple; they ask for your logins to the 1Password vault? I guess this just adds an extra layer of obfuscation. The most secure way I can thin

Isn't the counter simple; they ask for your logins to the 1Password vault? I guess this just adds an extra layer of obfuscation. The most secure way I can think of is to either encrypt your drive (or wipe for travel and online restore once arriving) and physically mail the new password (or hand over to a trusted friend/store location) to the destination. Then there is no way of restoring at the airport. Of course, then they can just detain you indefinitely for not revealing the password you don't know...

31reasons 9y ago
Just travel with a dedicated traveling phone and have your main phone mailed to your destination.
dchest 9y ago
> physically mail the new password Nobody will ever do this.
xiphias 9y ago
,,even if you’re asked to unlock 1Password by someone at the border, there’s no way for them to tell that Travel Mode is even enabled.'' It looks similar to hidden partition in TrueCrypt
- mcgrath_sh 9y ago
  Any subscription-based 1Password can be accessed from the web. Couldn't they just demand those credentials?
  - eridius 9y ago
    Only if you know them. I don't know about you, but I don't have my long random account key memorized (only my master password). You can't log into the website without that account key. Of course, you do need to be able to log in to turn travel mode back on, so if I were to use this I'd probably do something like set up a service to securely send me my account key after I'm expected to have finished crossing the border, or maybe just store it on a remote server that I have access to under the expectation that the TSA can't demand that I SSH into a remote server (especially one they don't even know about). Though if I'm traveling alone (instead of with my wife) I'd probably just call her and ask her to turn travel mode off for me.
    - confounded 9y ago
      That's a great solution if you're a US citizen and want to enjoy showing off to a border guard before being guaranteed entry, but for migrants (who are most affected by this), this kind of 'gotcha' logic would likely be considered insubordinate grandstanding, and get them denied entry.
      - eridius 9y ago
        > this kind of 'gotcha' logic would likely be considered insubordinate grandstanding I'm not sure what you mean. I don't think it's unreasonable for anyone, migrants included, to tell CBP "I don't feel safe traveling with sensitive data, so I don't have any of that data on my computer". What's the 'gotcha' here? CBP isn't the only reason to want to have Travel Mode, there's also the increased risk of having your laptop stolen or misplaced.
        confounded 9y ago
        In your original post, I took > Only if you know them. ... You can't log into the website without that account key. To mean that you'd openly have access to information in front of the guard, and then let them know that you can't access it at this time because of your elaborate scheme (e.g. tell them that it exists, but that they can't have it). That's quite different to just not travelling with the data (or evidence of it existing) at all. > CBP isn't the only reason to want to have Travel Mode No, but it's the only 'reason' that's likely to use serious, life-altering coercion to make you to disable it, if they detect that it exists. It may be better to have no data that suggests capabilities, than openly posses partially disabled capabilities. There's no way for a border agent to tell if you're refusing to disable travel mode because you won't or you can't (and little reason for them to care).
        doubleunplussed 9y ago
        Of course it's not unreasonable, but 'reasonable' is not the relevant criterion here.
- khedoros1 9y ago
  Yes, it does. And you provide them to the password for the local vault. Since you activated travel mode, they'll be able to see your "travel safe" passwords, but no indication that there are other passwords that were recently removed from the vault, and no indication that you entered travel mode.
Dangeranger 9y ago
There are competing reports, but the maximum detention time for US citizens crossing the US border is about four hours. If you are a foreign citizen, you are looking at about twenty four hours, and then refusal of admittance. This information is the case for keeping a cheap back up device(s).
- dgzl 9y ago
  I thought that, according to the NDAA Obama signed, that the military can detain Americans indefinitely without reason.
AceJohnny2 9y ago
They can ask for logins for the vaults they see on your device. But those vaults are the ones you've marked "travel-safe", so you're accepting the risk of these being breached by invasive governmental searches. However, non-travel-safe vaults a) won't show up on your devices, so they can't ask for what they don't know the existence of, and more importantly b) there is no evidence on the device of "hidden" vaults, or that you're in travel mode, so they doubly don't know the existence of those vaults.
- mcgrath_sh 9y ago
  How is the web interface handled? Essentially, where do you turn this on and off? Wouldn't it become standard ptotocol to just demand web credentials for 1Password? This feature is only for subscription based 1Password accounts, so it would seem to me it would just be easiest to delete the app and re-download after crossing?
  - crooked-v 9y ago
    Demanding web logins rather than local logins for anything is a step beyond the fuzzy legal authority currently given to the TSA.
    - DanBC 9y ago
      They already ask for social media account logins.
    - sbov 9y ago
      If you're a resident, they eventually have to let you in. But if you aren't, they can reject you for any reason. This isn't something you can solve with tech. Those of us who are citizens of the US need to vote for politicians who make privacy a priority, and be more politically active in general. I feel like you could even make the play that it's bad for business, because it's impeding business travel. You could even point to this very post as evidence that many companies consider it a Big Deal - the idea that they have to explicitly hide their company secrets in this way because border agents are out of control.
easilyBored 9y ago
"Then there is no way of restoring at the airport." IIRC, the border agent has the power to turn you back, visa or no visa. So there might be a price to pay for getting too cute. They want what they want and trying to avoid that might make them angrier. If you are a US citizen they can make you wait in a room for a few hours and maybe add your name to the "make his life miserable every time he flies" list.
geofft 9y ago
One option is to lock out the passwords for some amount of time, or to do geolocation. Both can be defeated (they can detain you at the airport for a whole day, or they can spoof GPS) but neither of these mechanisms holds up to mass surveillance: you can't detain everyone who goes through the airport, or even all people with 1Password, for a day, nor can you spoof GPS at the security checkpoint because it'll probably leak to airplanes. You have to pick individual travellers and put them in a Faraday cage with a Stingray and an internet connection. I'm not sure what the threat model really is, but it's possible that this will require enough time and resources to disincentivize asking for even more passwords when there's not a very specific suspicion, which might be good enough.

31reasons 9y ago

Just travel with a dedicated traveling phone and have your main phone mailed to your destination.

dchest 9y ago

> physically mail the new password Nobody will ever do this.

xiphias 9y ago

,,even if you’re asked to unlock 1Password by someone at the border, there’s no way for them to tell that Travel Mode is even enabled.'' It looks similar to hidden partition in TrueCrypt

mcgrath_sh 9y ago
Any subscription-based 1Password can be accessed from the web. Couldn't they just demand those credentials?
- eridius 9y ago
  Only if you know them. I don't know about you, but I don't have my long random account key memorized (only my master password). You can't log into the website without that account key. Of course, you do need to be able to log in to turn travel mode back on, so if I were to use this I'd probably do something like set up a service to securely send me my account key after I'm expected to have finished crossing the border, or maybe just store it on a remote server that I have access to under the expectation that the TSA can't demand that I SSH into a remote server (especially one they don't even know about). Though if I'm traveling alone (instead of with my wife) I'd probably just call her and ask her to turn travel mode off for me.
  - confounded 9y ago
    That's a great solution if you're a US citizen and want to enjoy showing off to a border guard before being guaranteed entry, but for migrants (who are most affected by this), this kind of 'gotcha' logic would likely be considered insubordinate grandstanding, and get them denied entry.
    - eridius 9y ago
      > this kind of 'gotcha' logic would likely be considered insubordinate grandstanding I'm not sure what you mean. I don't think it's unreasonable for anyone, migrants included, to tell CBP "I don't feel safe traveling with sensitive data, so I don't have any of that data on my computer". What's the 'gotcha' here? CBP isn't the only reason to want to have Travel Mode, there's also the increased risk of having your laptop stolen or misplaced.
      - confounded 9y ago
        In your original post, I took > Only if you know them. ... You can't log into the website without that account key. To mean that you'd openly have access to information in front of the guard, and then let them know that you can't access it at this time because of your elaborate scheme (e.g. tell them that it exists, but that they can't have it). That's quite different to just not travelling with the data (or evidence of it existing) at all. > CBP isn't the only reason to want to have Travel Mode No, but it's the only 'reason' that's likely to use serious, life-altering coercion to make you to disable it, if they detect that it exists. It may be better to have no data that suggests capabilities, than openly posses partially disabled capabilities. There's no way for a border agent to tell if you're refusing to disable travel mode because you won't or you can't (and little reason for them to care).
      - doubleunplussed 9y ago
        Of course it's not unreasonable, but 'reasonable' is not the relevant criterion here.
khedoros1 9y ago
Yes, it does. And you provide them to the password for the local vault. Since you activated travel mode, they'll be able to see your "travel safe" passwords, but no indication that there are other passwords that were recently removed from the vault, and no indication that you entered travel mode.

Dangeranger 9y ago

There are competing reports, but the maximum detention time for US citizens crossing the US border is about four hours. If you are a foreign citizen, you are looking at about twenty four hours, and then refusal of admittance. This information is the case for keeping a cheap back up device(s).

dgzl 9y ago
I thought that, according to the NDAA Obama signed, that the military can detain Americans indefinitely without reason.

AceJohnny2 9y ago

They can ask for logins for the vaults they see on your device. But those vaults are the ones you've marked "travel-safe", so you're accepting the risk of these being breached by invasive governmental searches. However, non-travel-safe vaults a) won't show up on your devices, so they can't ask for what they don't know the existence of, and more importantly b) there is no evidence on the device of "hidden" vaults, or that you're in travel mode, so they doubly don't know the existence of those vaults.

mcgrath_sh 9y ago
How is the web interface handled? Essentially, where do you turn this on and off? Wouldn't it become standard ptotocol to just demand web credentials for 1Password? This feature is only for subscription based 1Password accounts, so it would seem to me it would just be easiest to delete the app and re-download after crossing?
- crooked-v 9y ago
  Demanding web logins rather than local logins for anything is a step beyond the fuzzy legal authority currently given to the TSA.
  - DanBC 9y ago
    They already ask for social media account logins.
  - sbov 9y ago
    If you're a resident, they eventually have to let you in. But if you aren't, they can reject you for any reason. This isn't something you can solve with tech. Those of us who are citizens of the US need to vote for politicians who make privacy a priority, and be more politically active in general. I feel like you could even make the play that it's bad for business, because it's impeding business travel. You could even point to this very post as evidence that many companies consider it a Big Deal - the idea that they have to explicitly hide their company secrets in this way because border agents are out of control.

easilyBored 9y ago

"Then there is no way of restoring at the airport." IIRC, the border agent has the power to turn you back, visa or no visa. So there might be a price to pay for getting too cute. They want what they want and trying to avoid that might make them angrier. If you are a US citizen they can make you wait in a room for a few hours and maybe add your name to the "make his life miserable every time he flies" list.

geofft 9y ago

One option is to lock out the passwords for some amount of time, or to do geolocation. Both can be defeated (they can detain you at the airport for a whole day, or they can spoof GPS) but neither of these mechanisms holds up to mass surveillance: you can't detain everyone who goes through the airport, or even all people with 1Password, for a day, nor can you spoof GPS at the security checkpoint because it'll probably leak to airplanes. You have to pick individual travellers and put them in a Faraday cage with a Stingray and an internet connection. I'm not sure what the threat model really is, but it's possible that this will require enough time and resources to disincentivize asking for even more passwords when there's not a very specific suspicion, which might be good enough.