7 ms·

"May I search your laptop?" "Certainly." "But... this is practically empty." "Yes sir. I FedEx'd my SSD to the destination." I have a small SSD in the primary

by chx 9y ago

"May I search your laptop?" "Certainly." "But... this is practically empty." "Yes sir. I FedEx'd my SSD to the destination." I have a small SSD in the primary disk in my T420s, it has just enough to get me through the flight. I keep the primary in the UltraBay with a simple adapter, takes one reboot and no tools to put it back in place. Done. Happy searching! I can't log into anything even if I wanted to because I physically do not have my password store https://www.passwordstore.org/ https://www.passwordstore.org/ with me. (https://github.com/chx/ykgodot https://github.com/chx/ykgodot I wrote this trivial script to automate yubikey neo with pass) Alternative: encode the entire primary disk https://github.com/cornelinux/yubikey-luks https://github.com/cornelinux/yubikey-luks and FedEx the yubikey. Yanking the disk is better, though.

veidr 9y ago
It's a practical approach, and my comment here isn't necessarily aimed at you, chx (since I don't know your citizenship status), but I would add this entreaty to American citizens like me: If you ever get asked that question at the US border, please don't acquiesce to that request. They have the right to ask, and they even have the power to search it regardless of your permission, but despite an alarming drift towards a total surveillance, they have not established the right to force you to unlock/decrypt anything. I'm flying into SFO tomorrow, and I am taking similar precautions as chx so that my laptop doesn't contain any meaningful data[1]. However, if asked to unlock my laptop, I plan to say "No, of course I cannot do that; it violates the most basic security practices and I could and should be fired if I exposed sensitive company data in that manner." And then just sticking with it. It will be inconvenient, especially if they seize my laptop and detain me, but as citizens it is up to us to resist the normalization of behaviors that push the nation further towards the precipice of idiotism. [1]: As an American citizen, I have routinely done this when traveling to authoritarian nations like China; it's hard to express how outraged I am that my own country has degenerated to the point where sound security practices now require these kinds of procedures when traveling to the USA.
- was_boring 9y ago
  Is the goal to resist normalization of the behavior or is to get through the security theater?
  - veidr 9y ago
    It depends. Sometimes, it's really important, and you have to make it through quicky even if that means sacrificing other principles. You have to balance your civic duty as a citizen with whatever else is going on. But hopefully our default mode is to emphasize our responsibility as democratic citizens to lead by example, and to resist degenerate behavior whenever we can...
  - exolymph 9y ago
    Obviously veidr's goal is to resist normalization of the behavior.
  - mcv 9y ago
    Both, but for non-Americans, getting through the security theater is not guaranteed, so they have to focus on that. For Americans, their rights are clearer and they are guaranteed to get through the security theater, so they can afford to fight the normalization of this.
- techsupporter 9y ago
  > If you[, a citizen of the United States,] ever get asked that question at the US border, please don't acquiesce to that request. Absolutely agreed. I will do this[0]. I'm a U.S. citizen with the unequivocal right to enter the country once my citizenship has been established. U.S. citizens are the only ones who can stand up to this madness--either at the border or by influencing and electing people who can change the written law and how it is enforced--and it's our responsibility to do so. I've entered the country several times and have never gotten more than a "passport, please" request (except, oddly, when driving south from Canada; they're rather surly at the Peace Arch, in my experience), which I recognize is very lucky of me. When I travel, I'm enough of a worry-wart that I build in a lot of spare time to get to and from my destination. "Do you want to fly today" and "you'll be screened for four additional hours" are threats that hold no weight with me, thankfully. I'm in no hurry. I'm the ideal test case. I have oodles of paid vacation time, a family full of lawyers, and a ornery streak a kilometer wide. Bring it. 0 - I can't say "I have done this" because it's never come up but I'm resolute. "No" is my answer, if it ever does, and I'm sticking with it.
  - sneak 9y ago
    I have been that guy. All of 2009-2013 or so. After being locked in secondary with no comms, food, or water for hours on hours enough times, one gives up. CBP once kicked me out of a border control point in northern Vermont, in a snowstorm, in February. I had to hitchhike simply to not freeze (my sim didn't work, so no way to call a cab, and they had sent the bus on without me, hours earlier). I've been searched, both well and also simply as intimidation, more times than I can remember. Most searches are not thorough in any capacity, but simple displays of power and dominance. My foreign partners have been repeatedly groped by these pigs. Vacations have been ruined simply by traveling together - they deny foreigners entry. The file still haunts me. Every time I enter, secondary - with associated 30-500 minutes of delay. There's no recourse. I cringe every time I exit the US, for the 2-10 hours I will lose upon my next re-entry. Their capacity to waste your time is infinite. Your time is finite. PS: they can also take all your devices for imaging and keep them for 48 hours - but you will likely have to sue them to get them back after that time. Crossing in can be a >$10k/entry affair if they wish it to be, for you.
- chx 9y ago
  I am a dual Canadian-Hungarian citizen, residing in Vancouver, BC, Canada. I work remotely for a USA client. Avoiding the USA is hard / impossible.
thomasahle 9y ago
> I FedEx'd my SSD to the destination. Are there any examples of laptops / ssds being searched in international mail?
- jonknee 9y ago
  If you take the time to FedEx your SSD to avoid customs you certainly made sure the disk was encrypted...
  - pbhjpbhj 9y ago
    NSA can probably modify the firmware to create some sort of backdoor, if you actually look like that would be worthwhile?
    - apetresc 9y ago
      Maybe the NSA can, maybe the NSA can't - but even if they could, I guarantee that customs/postal workers won't have access to it. Unless the NSA is specifically intercepting your particular SSD (in which case you have much bigger problems), standard enterprise-grade encryption will be good enough for shipping purposes.
      - fencepost 9y ago
        This goes back to the level of protection you need/want, from whom, and whether you're a target of opportunity or a specific target. Are you protecting against "drive-bys", the casually curious, motivated low-resource targeted attacks (e.g. disgruntled former employees, hated neighbors), "small" resource targeted attacks (<$50k?), high-resource attacks or state entities?
    - dogecoinbase 9y ago
      If this is in your threat model, you shouldn't be taking advice from a forum thread.
    - DavideNL 9y ago
deleted 9y ago
[deleted]
epsylon 9y ago
"Why did you FedEx your SSD to the destination? Do you have something to hide? You're gonna have to follow us."
- chii 9y ago
  "everybody's got something to hide! I've got nothing hidden that's illegal."
  - QuinnyPig 9y ago
    If they find even one pirated song on your drive, they've got you on a felony. "Lying to federal officials" is a great catchall they regularly use to force a deal.
- EGreg 9y ago
  That's now. The future is simply interdiction of every device. Actually, every device will just be bugged with a thousand backdoors. The end. Cory Doctorow - general computing is the enemy of governments.
BearGoesChirp 9y ago
You forgot the end of the story: "I'm denying you the ability to enter the country. Next time you let me see everything instead of being a wise guy."
- criddell 9y ago
  If you are an American citizen, can they prevent you from entering the country? I understand they can delay you, but I don't think it can be indefinite.
  - Antrikshy 9y ago
    ^ This right here. They can deny foreigners, but I've always read that they cannot deny Americans in unless their citizenship gets revoked, I guess.
    - YokoZar 9y ago
      Not even that. Your right to enter the country, as a US citizen, is "Absolute, Unconditional, and Irrevocable."
dspillett 9y ago
> "May I search your laptop?" "Certainly." "But... this is practically empty." "Yes sir. I FedEx'd my SSD to the destination." Scratch that last bit. There is no need to reveal that, and it could sound suspicious (like you are trying to hide something specific by circumventing their checks, and trying to look clever (and/or make them look dim) by doing so to boot). Just be honest without giving extra information: "yes sir, this is a travel machine and it just contains what I'm going to need while I'm between locations" if they ask why you would do that then "in case the laptop gets stolen, the less that is on it the less of a worry that could be" strikes me as a perfectly valid reason to be careful. Or perhaps "all the other data and programs I'm going to need are already with the clients/suppliers/other I'm visiting" (which it is as you've posted it, but you don't have to say the thing that might unnecessarily raise suspicion).

by chx 9y ago

veidr 9y ago

It's a practical approach, and my comment here isn't necessarily aimed at you, chx (since I don't know your citizenship status), but I would add this entreaty to American citizens like me: If you ever get asked that question at the US border, please don't acquiesce to that request. They have the right to ask, and they even have the power to search it regardless of your permission, but despite an alarming drift towards a total surveillance, they have not established the right to force you to unlock/decrypt anything. I'm flying into SFO tomorrow, and I am taking similar precautions as chx so that my laptop doesn't contain any meaningful data[1]. However, if asked to unlock my laptop, I plan to say "No, of course I cannot do that; it violates the most basic security practices and I could and should be fired if I exposed sensitive company data in that manner." And then just sticking with it. It will be inconvenient, especially if they seize my laptop and detain me, but as citizens it is up to us to resist the normalization of behaviors that push the nation further towards the precipice of idiotism. [1]: As an American citizen, I have routinely done this when traveling to authoritarian nations like China; it's hard to express how outraged I am that my own country has degenerated to the point where sound security practices now require these kinds of procedures when traveling to the USA.

was_boring 9y ago
Is the goal to resist normalization of the behavior or is to get through the security theater?
- veidr 9y ago
  It depends. Sometimes, it's really important, and you have to make it through quicky even if that means sacrificing other principles. You have to balance your civic duty as a citizen with whatever else is going on. But hopefully our default mode is to emphasize our responsibility as democratic citizens to lead by example, and to resist degenerate behavior whenever we can...
- exolymph 9y ago
  Obviously veidr's goal is to resist normalization of the behavior.
- mcv 9y ago
  Both, but for non-Americans, getting through the security theater is not guaranteed, so they have to focus on that. For Americans, their rights are clearer and they are guaranteed to get through the security theater, so they can afford to fight the normalization of this.
techsupporter 9y ago
> If you[, a citizen of the United States,] ever get asked that question at the US border, please don't acquiesce to that request. Absolutely agreed. I will do this[0]. I'm a U.S. citizen with the unequivocal right to enter the country once my citizenship has been established. U.S. citizens are the only ones who can stand up to this madness--either at the border or by influencing and electing people who can change the written law and how it is enforced--and it's our responsibility to do so. I've entered the country several times and have never gotten more than a "passport, please" request (except, oddly, when driving south from Canada; they're rather surly at the Peace Arch, in my experience), which I recognize is very lucky of me. When I travel, I'm enough of a worry-wart that I build in a lot of spare time to get to and from my destination. "Do you want to fly today" and "you'll be screened for four additional hours" are threats that hold no weight with me, thankfully. I'm in no hurry. I'm the ideal test case. I have oodles of paid vacation time, a family full of lawyers, and a ornery streak a kilometer wide. Bring it. 0 - I can't say "I have done this" because it's never come up but I'm resolute. "No" is my answer, if it ever does, and I'm sticking with it.
- sneak 9y ago
  I have been that guy. All of 2009-2013 or so. After being locked in secondary with no comms, food, or water for hours on hours enough times, one gives up. CBP once kicked me out of a border control point in northern Vermont, in a snowstorm, in February. I had to hitchhike simply to not freeze (my sim didn't work, so no way to call a cab, and they had sent the bus on without me, hours earlier). I've been searched, both well and also simply as intimidation, more times than I can remember. Most searches are not thorough in any capacity, but simple displays of power and dominance. My foreign partners have been repeatedly groped by these pigs. Vacations have been ruined simply by traveling together - they deny foreigners entry. The file still haunts me. Every time I enter, secondary - with associated 30-500 minutes of delay. There's no recourse. I cringe every time I exit the US, for the 2-10 hours I will lose upon my next re-entry. Their capacity to waste your time is infinite. Your time is finite. PS: they can also take all your devices for imaging and keep them for 48 hours - but you will likely have to sue them to get them back after that time. Crossing in can be a >$10k/entry affair if they wish it to be, for you.
chx 9y ago
I am a dual Canadian-Hungarian citizen, residing in Vancouver, BC, Canada. I work remotely for a USA client. Avoiding the USA is hard / impossible.

thomasahle 9y ago

> I FedEx'd my SSD to the destination. Are there any examples of laptops / ssds being searched in international mail?

jonknee 9y ago
If you take the time to FedEx your SSD to avoid customs you certainly made sure the disk was encrypted...
- pbhjpbhj 9y ago
  NSA can probably modify the firmware to create some sort of backdoor, if you actually look like that would be worthwhile?
  - apetresc 9y ago
    Maybe the NSA can, maybe the NSA can't - but even if they could, I guarantee that customs/postal workers won't have access to it. Unless the NSA is specifically intercepting your particular SSD (in which case you have much bigger problems), standard enterprise-grade encryption will be good enough for shipping purposes.
    - fencepost 9y ago
      This goes back to the level of protection you need/want, from whom, and whether you're a target of opportunity or a specific target. Are you protecting against "drive-bys", the casually curious, motivated low-resource targeted attacks (e.g. disgruntled former employees, hated neighbors), "small" resource targeted attacks (<$50k?), high-resource attacks or state entities?
  - dogecoinbase 9y ago
    If this is in your threat model, you shouldn't be taking advice from a forum thread.
  - DavideNL 9y ago

deleted 9y ago

[deleted]

epsylon 9y ago

"Why did you FedEx your SSD to the destination? Do you have something to hide? You're gonna have to follow us."

chii 9y ago
"everybody's got something to hide! I've got nothing hidden that's illegal."
- QuinnyPig 9y ago
  If they find even one pirated song on your drive, they've got you on a felony. "Lying to federal officials" is a great catchall they regularly use to force a deal.
EGreg 9y ago
That's now. The future is simply interdiction of every device. Actually, every device will just be bugged with a thousand backdoors. The end. Cory Doctorow - general computing is the enemy of governments.

BearGoesChirp 9y ago

You forgot the end of the story: "I'm denying you the ability to enter the country. Next time you let me see everything instead of being a wise guy."

criddell 9y ago
If you are an American citizen, can they prevent you from entering the country? I understand they can delay you, but I don't think it can be indefinite.
- Antrikshy 9y ago
  ^ This right here. They can deny foreigners, but I've always read that they cannot deny Americans in unless their citizenship gets revoked, I guess.
  - YokoZar 9y ago
    Not even that. Your right to enter the country, as a US citizen, is "Absolute, Unconditional, and Irrevocable."

dspillett 9y ago

> "May I search your laptop?" "Certainly." "But... this is practically empty." "Yes sir. I FedEx'd my SSD to the destination." Scratch that last bit. There is no need to reveal that, and it could sound suspicious (like you are trying to hide something specific by circumventing their checks, and trying to look clever (and/or make them look dim) by doing so to boot). Just be honest without giving extra information: "yes sir, this is a travel machine and it just contains what I'm going to need while I'm between locations" if they ask why you would do that then "in case the laptop gets stolen, the less that is on it the less of a worry that could be" strikes me as a perfectly valid reason to be careful. Or perhaps "all the other data and programs I'm going to need are already with the clients/suppliers/other I'm visiting" (which it is as you've posted it, but you don't have to say the thing that might unnecessarily raise suspicion).