7 ms·

I think this is the craziest thing. It's easy to just leave an encrypted copy of all your phone's data online, reset your phone to factory settings, travel, an

by ivl 8y ago

I think this is the craziest thing. It's easy to just leave an encrypted copy of all your phone's data online, reset your phone to factory settings, travel, and then restore your data to your phone. Seizing it to search is just... invasive and ineffective.

jjuhl 8y ago
"It's easy to just leave an encrypted copy of all your phone's data online, reset your phone to factory settings, travel, and then restore your data to your phone" - Easy indeed, but having to do so shouldn't be needed.
- nothrabannosir 8y ago
  GP is talking about The Bad Guys. Point being: if you're a Bad Guy, you're gonna encrypt your data. It's easy, and obvious. The likelihood of catching any Bad Guys with this is, therefore, very slim. Far outweighed by the price paid by the Good Guys, who don't go through that rigmarole, and just get their privacy violated. That's the argument, in essence (which I mostly agree with, the childish tone notwithstanding).
  - pmiller2 8y ago
    You will catch some Bad Guys with this approach, but only the ones who are also dumb. That’s not an insignificant portion of them, but it means the smarter ones, who are more dangerous, might get away.
    - ilikehurdles 8y ago
      yeah but this way some middle-manager bureaucrat type gets to pad their numbers and request 15% more budget next year. Catching 15 nobodies a month looks better than catching 1 actual big fish a year.
    - dsfyu404ed 8y ago
      Not to mention that if you're only catching dumb ones there's plenty of other ways to catch dumb ones without violating people's rights.
  - tomatotomato37 8y ago
    I don't think the Bad Guys will even be doing that. Anything elict is going to go through a $20 dollar burner if The Bad Guys are the least bit competent, because carrying anything incrimitating on your person 24/7 is just generally a stupid thing to do
    - mirimir 8y ago
      Indeed. As DPR learned, to his chagrin :(
epicureanideal 8y ago
Right. Like most laws, it will end up being used against ordinary citizens who obey the law 99.9% of the time, to squeeze them for the 0.1% of the time they broke the law either by mistake, or in the same ways that MOST people are breaking the law but nobody cares because law enforcement hasn't singled them out for special treatment.
- majewsky 8y ago
  > it will end up being used to fulfil interrogation/arrest/etc. quotas FTFY
- vinceguidry 8y ago
  This isn't a good argument. The weird thing you realize when you start exploring the law enforcement space is that the vast majority of people that break the law are just, pardon me for not mincing words, just monumentally stupid. They don't take basic precautions. Police wind up dealing with the same people over and over and over and over again. You'd think they'd wise up and learn how to not get caught, but the mindset that leads to criminality is pretty far away from the mindset that leads to careful action. It's only the very rare person that actually breaks the law with intent, and also with the care and forethought to avoid even the most basic law enforcement scrutiny. Organized crime represents the barest fraction of actual crimes committed. So as a result, dragnet-style police tactics are often extremely effective at accomplishing their aims. Which is, of course, why they're employed. This is, sadly, a pure human-rights issue. Sad because the human rights angle is just not very convincing to people who are invested in the status quo. Which is why we still see these types of tactics, even today.
  - syshum 8y ago
    >>>The weird thing you realize when you start exploring the law enforcement space is that the vast majority of people that break the law are just, pardon me for not mincing words, just monumentally stupid. They don't take basic precautions I think you mean most people that get caught breaking the law are monumentally stupid There are plenty of people that break the law everyday and never get caught, unsolved crimes rates are HUGE >>>Police wind up dealing with the same people over and over and over and over again. You'd think they'd wise up and learn how to not get caught, but the mindset that leads to criminality is pretty far away from the mindset that leads to careful action. Recidivism is a complex issue and is not simply down to "you'd think they would wise up", it is mix bag of untreated Mental illness, lack of education, lack of support structures, lack of opportunity, and then even further reduction in opportunity due to a criminal record, and finally once you are "on the radar" of the system the police become aware of you and will target you for greater scrutiny >>>So as a result, dragnet-style police tactics are often extremely effective at accomplishing their aims. I would agree here, but only because their aim is to have a nice press release to "show their effectiveness" and justify their budgets, dragnet policing is pure security theater. it is a show for the taxpayers nothing more
technofiend 8y ago
I'm only speaking to Android but unfortunately many Android apps don't implement cloud backup; if you wipe the app you lose your information or progress. From memory everything from Google's 2FA app authenticator to popular games like Bloons don't do off-device saves at all or automatically. So it's not quite as easy as "just wipe your device and restore a backup." At a minimum you need to root your phone and install a third party backup app like Titanium backup.
- gizmo686 8y ago
  Adb has a backup function you can use to download an apps data. I assume there is a reciprocal function to restore, but I've never used it. The confirmation dialog that comes up on the phone looks like it is intended as an end user backup feature, but I've never seen a way to do it without enabling developer mode.
  - asteli 8y ago
    IME it's a pain in the ass to backup your phone this way -- you have to download and setup development tools, and sometimes things fail in ways that are hard to explain. Inaccessible for the non-technical user, and frustrating for the savvy, aside from android developers. Furthermore, on phones with locked bootloaders (e.g. Pixel) it's impossible to root your phone in order to make the process of doing full-device backups easier. That being said, if anyone knows a way to do full-device backups on the Pixel series phones, let me know.
    - inawarminister 8y ago
      I've used Helium a few times before (by the maker of CWM), does it work on Android P? That reminds me, I just moved 3 Android phones recently (Samsung GN5 broke -> Redmi 4A backup -> Redmi Note 5 replacement), and the only cloud backup that worked were WhatsApp and Line :/ I should backup all my apps for the next time.
- mikeash 8y ago
  Can you not back up the entire phone, including all data from third party apps?
mcculley 8y ago
Easy? My phone currently shows 77.2GB of 256GB used. Can you routinely download 77GB of data in a foreign country as soon as you clear customs?
- post_break 8y ago
  Not as easy but do an encrypted backup on to a laptop. I know it's not the point you're trying to make but just thinking out loud how someone could do this. Do a backup, wipe phone, minimal setup so it has nothing on it but is functioning, pass border then restore.
- raverbashing 8y ago
  Unless you're actually using it as a USB drive, my guess is that this is mostly pictures/videos (which syncs automatically in both Android and iCloud), audio files (which you can backup or use Spotify) and application caches (deletable)
- nutjob2 8y ago
  Yes. Class 4 LTE is widely available and tops out at 150Mbps. I usually get half of that. More to the point you only need your contacts and a few other things immediately.
  - majewsky 8y ago
    You realize that most data plans have limited volume, right? Mine is technically a flatrate, but after 1.5 GB I get throttled to 2G (which is about as fast as dialup).
- ASalazarMX 8y ago
  No, Jesus! Just download the illegal files.
  - yjftsjthsd-h 8y ago
    Doesn't need to be illegal. Any personal info you don't want shared with random strangers should be protected.
ASalazarMX 8y ago
> reset your phone to factory settings, travel, and then restore your data to your phone Except traveling with a blank phone will probably make you more suspicious. What are you trying to hide, citizen?
- jstarfish 8y ago
  Not really. Any agent who believes this is going to quickly learn that there are a significant number of travelers who travel with newly-issued/rental devices. Two of my previous employers would issue thin-client loaner laptops for travel to countries with espionage concerns. Even when I travel internationally myself, I rent phones keyed for the destination network and use them in their factory-reset status. No sense in loading up a device with apps and crap for something I'm only going to need for a week.
joering2 8y ago
I did exactly that and flying back from Germany to Usa, I was heavily questioned at the border as of “why is my phone empty”. It took 3 hours of details i dont want to get into. This is my last time flying with cellphone. Next time im just gonna buy one when i land and leave it with friends for my next european trip.
- freeopinion 8y ago
  It took 3 hours to say, "I wiped it so you wouldn't find anything"?
  - joering2 8y ago
    US boarders have long list of questions you are supposed to be asked every time you enter country, but because its over 800 questions, its impossible and impractical to ask everyone. Someone who travel with entirely wiped out phone is an exception of the rule, I imagine. Sample of questions: - have you ever been associated with Nazi party? - have you ever been associated with any Cuban government agency? - do you know anyone that is terrorist? Etc. Some questions repeat later on, some are constructed different way but ask the same. All questions are only YES or NO. And you clear if you have all NO checked.
    - freeopinion 8y ago
      I keep hearing that the constitution doesn't apply at the border, but it seems too incredible to believe. To the question, "Do you know anyone that is a terrorist?" I would have to answer, "Probably" or at least, "I don't know." I could not truthfully answer, "No." Neither could just about anybody. It seems pretty clear to me that it would be improper to detain somebody because their phone was too clean and they do not know if they know anybody who is a terrorist. Can anybody point to actual case law that supports the claim that such persons are not protected by the constitution? There is a lot of scaremongering in this area, but I haven't seen any actual case law. Of course, I haven't paid much attention either. But the only cases I have seen have been decided in favor of the citizen. I'm pretty sure there is a limit to how long a Highway Patrol officer can keep me on the side of the road without an arrest or a ticket. I know there is a limit to how long I can be detained by police without being charged. There must be a time limit to how long CBP can take to ask me 800 questions. Or rather, how long they could detain me while I answer 0 questions and repeatedly ask for an attorney. I am glad there are people willing to spend the time to hold them accountable when it would be easier to just move on and try to forget the whole thing.
mchahn 8y ago
Sure. Anyone can do it.
closeparen 8y ago
It's easy to "just" tell the police you want a lawyer and won't answer any questions, yet every day people waive this right and confess or are caught in lies. "Ineffective against a clever adversary" and "effective against loads of real-world criminals" are routinely true at the same time. Still crazy.
mikekchar 8y ago
Even stupider: first class personal mail in the US can not be opened without a warrant. So you can mail your iPhone to your destination before you go. My friend was on a list because his father is a high ranking police officer in another country friendly to the US (if you think about something like an executive in the FBI you'll be close). Every time he entered the US, his electronics were seized -- presumably to see if they could get some information about his father (because spying on friendly countries is still a thing). Since he often went to the US to give talks at conferences, he eventually realised that he could mail his laptop to the conference and it would get there every time.
- mandeepj 8y ago
  Hoping, he is keeping talk related data in the cloud. Mail can get delayed or lost
- URSpider94 8y ago
  Sadly, you are mistaken. Domestic First Class mail can not be opened without a warrant, but any mail that crosses a border can be opened and searched at will. Source: https://www.schneier.com/blog/archives/2006/01/us_customs_open.html https://www.schneier.com/blog/archives/2006/01/us_customs_op...
- magnetic 8y ago
  > Even stupider: first class personal mail in the US can not be opened without a warrant. So you can mail your iPhone to your destination before you go. You can, but postal delivery (especially cross border) suffers from a much higher rate of "packet loss" than you keeping your phone with you, and phones can be incredibly useful during travel before you reach your final destination where the phone is supposedly waiting for you (for example, to call/hire transportation, coordinate with people, notify about delays or that you're ok, make alternative arrangements if there are issues, keep track of connections/flight status, not to mention being able to continue to work or use them for entertainment, etc). Also keep in mind that stuff that crosses the border by mail can also be seized for a variety of reasons. And of course, there is the issue of price: if you want to ship your phone across the border and not be without it for too long, with insurance & tracking, it's not going to be particularly cheap.
LanceH 8y ago
Their end goal is to get you to upload your stuff.
imeron 8y ago
The Basecamp guys actually has an internal company guide to do the exact same thing for any travel: https://github.com/basecamp/handbook/blob/master/international-travel-guide.md https://github.com/basecamp/handbook/blob/master/internation...

by ivl 8y ago

jjuhl 8y ago

"It's easy to just leave an encrypted copy of all your phone's data online, reset your phone to factory settings, travel, and then restore your data to your phone" - Easy indeed, but having to do so shouldn't be needed.

nothrabannosir 8y ago
GP is talking about The Bad Guys. Point being: if you're a Bad Guy, you're gonna encrypt your data. It's easy, and obvious. The likelihood of catching any Bad Guys with this is, therefore, very slim. Far outweighed by the price paid by the Good Guys, who don't go through that rigmarole, and just get their privacy violated. That's the argument, in essence (which I mostly agree with, the childish tone notwithstanding).
- pmiller2 8y ago
  You will catch some Bad Guys with this approach, but only the ones who are also dumb. That’s not an insignificant portion of them, but it means the smarter ones, who are more dangerous, might get away.
  - ilikehurdles 8y ago
    yeah but this way some middle-manager bureaucrat type gets to pad their numbers and request 15% more budget next year. Catching 15 nobodies a month looks better than catching 1 actual big fish a year.
  - dsfyu404ed 8y ago
    Not to mention that if you're only catching dumb ones there's plenty of other ways to catch dumb ones without violating people's rights.
- tomatotomato37 8y ago
  I don't think the Bad Guys will even be doing that. Anything elict is going to go through a $20 dollar burner if The Bad Guys are the least bit competent, because carrying anything incrimitating on your person 24/7 is just generally a stupid thing to do
  - mirimir 8y ago
    Indeed. As DPR learned, to his chagrin :(

epicureanideal 8y ago

Right. Like most laws, it will end up being used against ordinary citizens who obey the law 99.9% of the time, to squeeze them for the 0.1% of the time they broke the law either by mistake, or in the same ways that MOST people are breaking the law but nobody cares because law enforcement hasn't singled them out for special treatment.

majewsky 8y ago
> it will end up being used to fulfil interrogation/arrest/etc. quotas FTFY
vinceguidry 8y ago
This isn't a good argument. The weird thing you realize when you start exploring the law enforcement space is that the vast majority of people that break the law are just, pardon me for not mincing words, just monumentally stupid. They don't take basic precautions. Police wind up dealing with the same people over and over and over and over again. You'd think they'd wise up and learn how to not get caught, but the mindset that leads to criminality is pretty far away from the mindset that leads to careful action. It's only the very rare person that actually breaks the law with intent, and also with the care and forethought to avoid even the most basic law enforcement scrutiny. Organized crime represents the barest fraction of actual crimes committed. So as a result, dragnet-style police tactics are often extremely effective at accomplishing their aims. Which is, of course, why they're employed. This is, sadly, a pure human-rights issue. Sad because the human rights angle is just not very convincing to people who are invested in the status quo. Which is why we still see these types of tactics, even today.
- syshum 8y ago
  >>>The weird thing you realize when you start exploring the law enforcement space is that the vast majority of people that break the law are just, pardon me for not mincing words, just monumentally stupid. They don't take basic precautions I think you mean most people that get caught breaking the law are monumentally stupid There are plenty of people that break the law everyday and never get caught, unsolved crimes rates are HUGE >>>Police wind up dealing with the same people over and over and over and over again. You'd think they'd wise up and learn how to not get caught, but the mindset that leads to criminality is pretty far away from the mindset that leads to careful action. Recidivism is a complex issue and is not simply down to "you'd think they would wise up", it is mix bag of untreated Mental illness, lack of education, lack of support structures, lack of opportunity, and then even further reduction in opportunity due to a criminal record, and finally once you are "on the radar" of the system the police become aware of you and will target you for greater scrutiny >>>So as a result, dragnet-style police tactics are often extremely effective at accomplishing their aims. I would agree here, but only because their aim is to have a nice press release to "show their effectiveness" and justify their budgets, dragnet policing is pure security theater. it is a show for the taxpayers nothing more

technofiend 8y ago

I'm only speaking to Android but unfortunately many Android apps don't implement cloud backup; if you wipe the app you lose your information or progress. From memory everything from Google's 2FA app authenticator to popular games like Bloons don't do off-device saves at all or automatically. So it's not quite as easy as "just wipe your device and restore a backup." At a minimum you need to root your phone and install a third party backup app like Titanium backup.

gizmo686 8y ago
Adb has a backup function you can use to download an apps data. I assume there is a reciprocal function to restore, but I've never used it. The confirmation dialog that comes up on the phone looks like it is intended as an end user backup feature, but I've never seen a way to do it without enabling developer mode.
- asteli 8y ago
  IME it's a pain in the ass to backup your phone this way -- you have to download and setup development tools, and sometimes things fail in ways that are hard to explain. Inaccessible for the non-technical user, and frustrating for the savvy, aside from android developers. Furthermore, on phones with locked bootloaders (e.g. Pixel) it's impossible to root your phone in order to make the process of doing full-device backups easier. That being said, if anyone knows a way to do full-device backups on the Pixel series phones, let me know.
  - inawarminister 8y ago
    I've used Helium a few times before (by the maker of CWM), does it work on Android P? That reminds me, I just moved 3 Android phones recently (Samsung GN5 broke -> Redmi 4A backup -> Redmi Note 5 replacement), and the only cloud backup that worked were WhatsApp and Line :/ I should backup all my apps for the next time.
mikeash 8y ago
Can you not back up the entire phone, including all data from third party apps?

mcculley 8y ago

Easy? My phone currently shows 77.2GB of 256GB used. Can you routinely download 77GB of data in a foreign country as soon as you clear customs?

post_break 8y ago
Not as easy but do an encrypted backup on to a laptop. I know it's not the point you're trying to make but just thinking out loud how someone could do this. Do a backup, wipe phone, minimal setup so it has nothing on it but is functioning, pass border then restore.
raverbashing 8y ago
Unless you're actually using it as a USB drive, my guess is that this is mostly pictures/videos (which syncs automatically in both Android and iCloud), audio files (which you can backup or use Spotify) and application caches (deletable)
nutjob2 8y ago
Yes. Class 4 LTE is widely available and tops out at 150Mbps. I usually get half of that. More to the point you only need your contacts and a few other things immediately.
- majewsky 8y ago
  You realize that most data plans have limited volume, right? Mine is technically a flatrate, but after 1.5 GB I get throttled to 2G (which is about as fast as dialup).
ASalazarMX 8y ago
No, Jesus! Just download the illegal files.
- yjftsjthsd-h 8y ago
  Doesn't need to be illegal. Any personal info you don't want shared with random strangers should be protected.

ASalazarMX 8y ago

> reset your phone to factory settings, travel, and then restore your data to your phone Except traveling with a blank phone will probably make you more suspicious. What are you trying to hide, citizen?

jstarfish 8y ago
Not really. Any agent who believes this is going to quickly learn that there are a significant number of travelers who travel with newly-issued/rental devices. Two of my previous employers would issue thin-client loaner laptops for travel to countries with espionage concerns. Even when I travel internationally myself, I rent phones keyed for the destination network and use them in their factory-reset status. No sense in loading up a device with apps and crap for something I'm only going to need for a week.

joering2 8y ago

I did exactly that and flying back from Germany to Usa, I was heavily questioned at the border as of “why is my phone empty”. It took 3 hours of details i dont want to get into. This is my last time flying with cellphone. Next time im just gonna buy one when i land and leave it with friends for my next european trip.

freeopinion 8y ago
It took 3 hours to say, "I wiped it so you wouldn't find anything"?
- joering2 8y ago
  US boarders have long list of questions you are supposed to be asked every time you enter country, but because its over 800 questions, its impossible and impractical to ask everyone. Someone who travel with entirely wiped out phone is an exception of the rule, I imagine. Sample of questions: - have you ever been associated with Nazi party? - have you ever been associated with any Cuban government agency? - do you know anyone that is terrorist? Etc. Some questions repeat later on, some are constructed different way but ask the same. All questions are only YES or NO. And you clear if you have all NO checked.
  - freeopinion 8y ago
    I keep hearing that the constitution doesn't apply at the border, but it seems too incredible to believe. To the question, "Do you know anyone that is a terrorist?" I would have to answer, "Probably" or at least, "I don't know." I could not truthfully answer, "No." Neither could just about anybody. It seems pretty clear to me that it would be improper to detain somebody because their phone was too clean and they do not know if they know anybody who is a terrorist. Can anybody point to actual case law that supports the claim that such persons are not protected by the constitution? There is a lot of scaremongering in this area, but I haven't seen any actual case law. Of course, I haven't paid much attention either. But the only cases I have seen have been decided in favor of the citizen. I'm pretty sure there is a limit to how long a Highway Patrol officer can keep me on the side of the road without an arrest or a ticket. I know there is a limit to how long I can be detained by police without being charged. There must be a time limit to how long CBP can take to ask me 800 questions. Or rather, how long they could detain me while I answer 0 questions and repeatedly ask for an attorney. I am glad there are people willing to spend the time to hold them accountable when it would be easier to just move on and try to forget the whole thing.

mchahn 8y ago

Sure. Anyone can do it.

closeparen 8y ago

It's easy to "just" tell the police you want a lawyer and won't answer any questions, yet every day people waive this right and confess or are caught in lies. "Ineffective against a clever adversary" and "effective against loads of real-world criminals" are routinely true at the same time. Still crazy.

mikekchar 8y ago

Even stupider: first class personal mail in the US can not be opened without a warrant. So you can mail your iPhone to your destination before you go. My friend was on a list because his father is a high ranking police officer in another country friendly to the US (if you think about something like an executive in the FBI you'll be close). Every time he entered the US, his electronics were seized -- presumably to see if they could get some information about his father (because spying on friendly countries is still a thing). Since he often went to the US to give talks at conferences, he eventually realised that he could mail his laptop to the conference and it would get there every time.

mandeepj 8y ago
Hoping, he is keeping talk related data in the cloud. Mail can get delayed or lost
URSpider94 8y ago
Sadly, you are mistaken. Domestic First Class mail can not be opened without a warrant, but any mail that crosses a border can be opened and searched at will. Source: https://www.schneier.com/blog/archives/2006/01/us_customs_open.html https://www.schneier.com/blog/archives/2006/01/us_customs_op...
magnetic 8y ago
> Even stupider: first class personal mail in the US can not be opened without a warrant. So you can mail your iPhone to your destination before you go. You can, but postal delivery (especially cross border) suffers from a much higher rate of "packet loss" than you keeping your phone with you, and phones can be incredibly useful during travel before you reach your final destination where the phone is supposedly waiting for you (for example, to call/hire transportation, coordinate with people, notify about delays or that you're ok, make alternative arrangements if there are issues, keep track of connections/flight status, not to mention being able to continue to work or use them for entertainment, etc). Also keep in mind that stuff that crosses the border by mail can also be seized for a variety of reasons. And of course, there is the issue of price: if you want to ship your phone across the border and not be without it for too long, with insurance & tracking, it's not going to be particularly cheap.

LanceH 8y ago

Their end goal is to get you to upload your stuff.

imeron 8y ago

The Basecamp guys actually has an internal company guide to do the exact same thing for any travel: https://github.com/basecamp/handbook/blob/master/international-travel-guide.md https://github.com/basecamp/handbook/blob/master/internation...