4 ms·

This feature really should ask you to commit to your duration of travel beforehand. It's no use if you can be compelled to readd the data.

javajosh 9y ago
That doesn't solve the problem, because you could be detained until the data is accessible again.
- MatthewWilkes 9y ago
  I admit, my threat model doesn't include indefinite detention at a border, but that is a valid concern depending in where you are going. Unfortunately, it's common not to believe people that say they don't know their password, otherwise the solution would be to just change your password and leave it at home without learning it. For me, the time lockout changes the claim you can make to an official from "I don't know the passwords, I have a record that I didn't bring with me, but can retrieve online" to "I don't know the passwords and have no ability to retrieve them while here". For me, that distinction is valuable and the benefits outweigh the risks. But everyone has different requirements and risk sensitivity.
- kortex 9y ago
  It's beyond disturbing that we have reached the point where we are discussing this as a potential feature, and not a plot element of a dystopian scifi.
- IcyPickle 9y ago
  No you can't be detained indefinitely (unless they have evidence to charge you with a crime). You could have your devices confiscated, and as a non-citizen, you could be denied entry.
  - javajosh 9y ago
    I believe you can be detained indefinitely, and without probable cause, by border agents.
paultopia 9y ago
Yes, THIS. THIS. Lying to a federal agent brings a world of hurt (obligatory disclaimer: I am a law professor but I am not YOUR lawyer...). Right now any customs agent with a brain can just ask "do you have that travel mode turned on? Ok, turn it off," and most courts will allow them to force compliance with that order. It would be really useful to be able to honestly say "I can't." It's true, if they really want to make someone give up the info, they can arguably detain that person until the timer expires. But that move is much more costly to the government, as well as subject to all kinds of interesting potential legal challenges. So a timer makes the data strictly more secure, even if not perfectly secure.
kstrauser 9y ago
Better, the feature should _always_ show both "Enable Travel Mode" and "Disable Travel Mode" buttons so that it's not possible to tell whether or not it's enabled. Disabling travel mode should prompt for a password, then return a message like "all vaults protected with this password are now enabled" no matter what the result of the operation is.
- Nition 9y ago
  So if you're in Travel Mode and you don't want them to know, you'd intentionally put in the wrong password to unlock? I agree that sounds like the best option. It's a lot like TrueCrypt's concept of having an encrypted drive with one password, and another, hidden encrypted drive in the same file with a different password. No-one can prove you have the second hidden one.
  - kstrauser 9y ago
    Yes, exactly. It would be impossible to tell whether you even had any Travel-Mode-hidden vaults without exhaustively testing every possible password.
kybernetikos 9y ago
Setting GPS locations where the vault can be readded to your device and disallowing it everywhere else would be good.
- Eliezer 9y ago
  Came here to make the same suggestion, and strongly agree. I should not be able to re-add the vault if I am not in my house.
  - MatthewWilkes 9y ago
    I thought about mentioning this too, as well as things like IP addresses and 2FA. The problem with GPS is proving that the location or request isn't spoofed. Ultimately, the phone is trusted when it supplies coordinates, so a determined adversary can easily circumvent it (for example, a SDR running a GPS spoofer). That's not to say it's a bad idea, as it certainly inproves security, but we are talking about state level targeting here. The other options, like IP and 2FA are more likely to result in failure demand by non-expert users. It's really tricky to get the balance right, as it's hard to justify to yourself a full wipe when going to a relatively low but nonzero risk country.
- SparkyMcUnicorn 9y ago
  GPS location can easily be spoofed, and your ID has an address on it.

javajosh 9y ago

That doesn't solve the problem, because you could be detained until the data is accessible again.

MatthewWilkes 9y ago
I admit, my threat model doesn't include indefinite detention at a border, but that is a valid concern depending in where you are going. Unfortunately, it's common not to believe people that say they don't know their password, otherwise the solution would be to just change your password and leave it at home without learning it. For me, the time lockout changes the claim you can make to an official from "I don't know the passwords, I have a record that I didn't bring with me, but can retrieve online" to "I don't know the passwords and have no ability to retrieve them while here". For me, that distinction is valuable and the benefits outweigh the risks. But everyone has different requirements and risk sensitivity.
kortex 9y ago
It's beyond disturbing that we have reached the point where we are discussing this as a potential feature, and not a plot element of a dystopian scifi.
IcyPickle 9y ago
No you can't be detained indefinitely (unless they have evidence to charge you with a crime). You could have your devices confiscated, and as a non-citizen, you could be denied entry.
- javajosh 9y ago
  I believe you can be detained indefinitely, and without probable cause, by border agents.

paultopia 9y ago

Yes, THIS. THIS. Lying to a federal agent brings a world of hurt (obligatory disclaimer: I am a law professor but I am not YOUR lawyer...). Right now any customs agent with a brain can just ask "do you have that travel mode turned on? Ok, turn it off," and most courts will allow them to force compliance with that order. It would be really useful to be able to honestly say "I can't." It's true, if they really want to make someone give up the info, they can arguably detain that person until the timer expires. But that move is much more costly to the government, as well as subject to all kinds of interesting potential legal challenges. So a timer makes the data strictly more secure, even if not perfectly secure.

kstrauser 9y ago

Better, the feature should _always_ show both "Enable Travel Mode" and "Disable Travel Mode" buttons so that it's not possible to tell whether or not it's enabled. Disabling travel mode should prompt for a password, then return a message like "all vaults protected with this password are now enabled" no matter what the result of the operation is.

Nition 9y ago
So if you're in Travel Mode and you don't want them to know, you'd intentionally put in the wrong password to unlock? I agree that sounds like the best option. It's a lot like TrueCrypt's concept of having an encrypted drive with one password, and another, hidden encrypted drive in the same file with a different password. No-one can prove you have the second hidden one.
- kstrauser 9y ago
  Yes, exactly. It would be impossible to tell whether you even had any Travel-Mode-hidden vaults without exhaustively testing every possible password.

kybernetikos 9y ago

Setting GPS locations where the vault can be readded to your device and disallowing it everywhere else would be good.

Eliezer 9y ago
Came here to make the same suggestion, and strongly agree. I should not be able to re-add the vault if I am not in my house.
- MatthewWilkes 9y ago
  I thought about mentioning this too, as well as things like IP addresses and 2FA. The problem with GPS is proving that the location or request isn't spoofed. Ultimately, the phone is trusted when it supplies coordinates, so a determined adversary can easily circumvent it (for example, a SDR running a GPS spoofer). That's not to say it's a bad idea, as it certainly inproves security, but we are talking about state level targeting here. The other options, like IP and 2FA are more likely to result in failure demand by non-expert users. It's really tricky to get the balance right, as it's hard to justify to yourself a full wipe when going to a relatively low but nonzero risk country.
SparkyMcUnicorn 9y ago
GPS location can easily be spoofed, and your ID has an address on it.