28 ms·
I'm hoping that manufactures will start building a plausible deniability user profile you can log into while leaving your actual profile encrypted, appearing to
by chuckgreenman 8y ago
I'm hoping that manufactures will start building a plausible deniability user profile you can log into while leaving your actual profile encrypted, appearing to be slack space.
This kind of thuggery seems to be getting more common.
- mcv 8y agoKeep data off your devices during travel, and download it once you're safe. If corporate, require external activation by someone from the company before the contents of your device are restored. That way you cannot be forced to divulge any company trade secrets, because you simply don't have access to them while you're crossing the border.
- arethuza 8y agoSo what if you are asked if your device is in its normal state or whether you deleted any data from your device before travelling? Lying in that situation would seem like a very bad idea (I'm not a US national) - I've had a few uncomfortable experiences over the years entering the US and I certainly wouldn't want to do anything that would give cause to escalate things on their side.
- Aromasin 8y agoWhat do they do if you say no in this situation though? Escort you home and inspect your desktop computer there? If I were to tell them that I carry a travel laptop/phone with no information on, there's little they'd be able to do about it unless that in itself was somehow made a crime.
- tome 8y agoSay, "yes I wiped it in case it got lost whilst I was travelling"?
- mcv 8y agoYou can be as honest as you like. Or just say you don't take data with you when you travel. For security reasons. If it's work related, this is trivial to justify: company policy, trade secrets shouldn't fall in the wrong hands, etc. And even if private, phone theft and identity theft are serious concerns.
- arethuza 8y agoOK and engaging full blown paranoia mode: What if they ask me to log into gmail and Office 365 (I use both) so they can see what I was trying to hide?
- mcv 8y agoHave a password you can't remember, so it's in your password safe which is not on this device. According to another comment, 1password has a special travel mode that supports this.
- reitanqild 8y ago> OK and engaging full blown paranoia mode: What if they ask me to log into gmail and Office 365 ... Doesn't sound that paranoid to me: wasn't there talk already a year ago about trying to force people to log into social media accounts when crossing the border?
- 8note 8y agoyes, I'm not importing that data to the USA?
- jrace 8y agoI would hope that admitting to deleting data is not admitting to a crime. I delete data all the time (old emails, texts, pictures, etc...)
- manishsharan 8y agoSome companies issue "China" Laptops to their executives that they must discard after visiting China. Now I believe we all need throw away laptops and cell phones and Facebook accounts for any sort of international travel.
- CaptainZapp 8y agoI'm actually wondering what happens if I'm ever asked about Facebook credentials when travelling to the US. Fact is: I don't do Facebook, nor any other Facebook product, so I'm really not able to hand over any such credentials.
- droithomme 8y agoLike you I don't do Facebook and I have every Facebook domain blocked. No one except my immediate family believes I don't use Facebook and considers it an affront when I say I don't use it in response to their request "What's your Facebook?" Many people can't imagine anyone doesn't have a Facebook account. Anyone who says they don't is presumed a liar who is socially rejecting them by refusing to connect. With TSA/Customs you need to be truthful. If you don't have an account say so. If you have one and say you don't that's a felony.
- BenMorganIO 8y ago2019 appears to have lots of students who, although always on their phone, a good bunch don't have Facebook and consider it outdated. Instagram is the new Facebook.
- mcv 8y agoInstagram is still Facebook.
- mcv 8y agoMost countries aren't that invasive, but it's pretty clear that a visit to the US justifies issuing a special "US" laptop now.
- ape4 8y agoCan they ask for online logins?
- mcv 8y agoMaybe, but you can also hand those over to a trusted party. Would be nice if email services lets you lock your email account until a trusted party unlocks it again.
- Datenstrom 8y agoWhy does this make me think of Harry Potter, the Fidelius Charm, and the secret keeper. Is this really what things have to come to?
- criddell 8y agoFor a lot of websites (like Facebook), that's a violation of their ToS and I'm not sure they can ask you to break a contract.
- roywiggins 8y agoWhat possible interest would the government have in such a rule, and how could government agents possibly be able to know what contracts you've signed? They haven't read the Facebook ToS any more than you or I have. There was a case recently of a NASA scientist being hassled at the border for his phone. He initially refused on the basis that handing it over would compromise his obligations to his employer. It did not work. https://www.theverge.com/2017/2/12/14583124/nasa-sidd-bikkannavar-detained-cbp-phone-search-trump-travel-ban https://www.theverge.com/2017/2/12/14583124/nasa-sidd-bikkan...
- mcv 8y ago> I'm not sure they can ask you to break a contract. Are allowed to? Maybe, maybe not. Will do anyway? Probably yes.
- roywiggins 8y ago
- droithomme 8y agoEven that is not sufficient short of a full factory reset. It can be very difficult to impossible to clear all caches and logs, or even know about them. Once the agent has your password and takes the device into their back room for an hour, you have to assume that all data has been offloaded and the device has had an undetectable rootkit added. This gentleman's expertise is in security and encryption and now he works for Apple, a company that makes products that the US government can't always crack. He was clearly targeted in his encounter because of his current position, based on the questions they were asking. Surreptitious access to his devices is highly desirable to US intelligence services. Any device that you lose physical control of during these encounters must be presumed to be compromised and should be physically destroyed afterwards.
- archgoon 8y ago> Any device that you lose physical control of during these encounters must be presumed to be compromised and should be physically destroyed afterwards. Seems unwise to destroy evidence. Find the rootkit, or have your employer or security researcher do so, prove it's existence, and sue the Government. But yes, definitely get a new laptop.
- 0xDEFC0DE 8y agoI don't think that will go anywhere. How do you prove the government did it and that it wasn't on there before the encounter?
- satokema 8y agoWhy do you need proof? Show it to the internet, there should be other examples too. It's way easier and less legally ambiguous to make people THINK you are rooting their devices than to actually do it and leave actual evidence to be found. They could even be looking for OTHER rootkits instead of installing them. I suspect there's a lot of availability bias going on here as well - how many travelers go through the US per year versus how many of them are famous ex-CTOs that get reposted on HN?
- 8y ago
- cortesoft 8y agoWon't this basically end up in the same situation as the one here? You will be detained for a few hours and then released? He wasn't FORCED to unlock his computer, he was just detained for three hours because he wasn't. Adding technical restrictions won't stop that.
- Tepix 8y agoIf you show that you cooperate yet you can't provide access to anything (because your phone is empty for example) they may treat you better or - if you're a foreigner - not deny you entry.
- kmano8 8y agoFor anyone who has 1Password, they have built-in support for doing this https://support.1password.com/travel-mode/ https://support.1password.com/travel-mode/
- Zak 8y agoAs others have mentioned, lying to the agents is illegal. This isn't: The password to this freshly wiped device is "Orwell1984". Feel free to have a look, but all you'll find is an app called "Secure Erase Free Space". This SD card I'm carrying separately? No, you can't have the password to that. Yes, I know, you can hold it indefinitely.
- navigatesol 8y ago>No, you can't have the password to that. Yes, I know, you can hold it indefinitely. I have a hard time believing that an audience that finds buying a car stressful (as is often stated in Tesla threads) is going to demonstrate assertiveness to a real authority...
- mcv 8y agoOf course there's a relevant xkcd for that: https://xkcd.com/538/ https://xkcd.com/538/ But that's why relying on a trusted external party, like the company you work for, to control your access to your data, is a much more effective strategy. TSA/Chinese police can threaten and bully you, but not your co-worker in a different country following company policy.
- Zak 8y agoThe audience here is not uniform. Andreas Gal is definitely in the target audience for HN and was able to stand up to the border agents.
- chuckgreenman 8y agoPeople on Hacker News are also pretty likely to back ups. Getting your work laptop confiscated by agents will probably only earn you points at work. There's also a good argument to be made that the search is illegal, it's important that everyone stand up for that, even if its stressful. https://www.eff.org/deeplinks/2017/04/bill-rights-border-fourth-amendment-limits-searching-your-data-and-devices https://www.eff.org/deeplinks/2017/04/bill-rights-border-fou...
- every 8y agoA "powerwashed" chromebook functions somewhat like this...
- orev 8y agoThat will do more harm than good. In order to build such a device the feature would need to be advertised, which TSA can see just like everyone else. Then when they see such a device, it becomes incumbent on you to prove you’re not using the feature, even when you’re not using it. So you can never prove you’re not using it and therefor could be detained. You might think you have more rights if you’re in the US, but there are many regimes where you don’t have them. Also: https://xkcd.com/538/ https://xkcd.com/538/
- z2 8y agoYou could on Android add a dummy, unprivileged account under your name and rename your real account "Guest" or something. Not that this stops a motivated person, but it may placate a border officer who really just wants to thumb through your photos and downloads folder.
- halgir 8y agoThis seems like a good idea, but it may land you in even more trouble. If it can be shown that you intentionally misled officers about content on your device, not merely denied questioning, you risk an obstruction of justice charge.
- squarefoot 8y agoHow about enforcing this by contract to shift the responsibility towards the employer, which presumably has more teeth to defend itself from abuses? Say a clause in every IT worker contract stating that when a LEO asks to unlock any device, a predefined user account must be used to log in. In the OP case, I'd hardly believe they'd send SWAT teams to Cupertino to raid Apple offices.
- monocasa 8y agoTrueCrypt had hidden volumes with plausible deniability. Aside: don't use TrueCrypt anymore for other reasons.
- fb03 8y agoBtw, who picked up after TrueCrypt left? VeraCrypt?
- milomilo86 8y agoCouldn't you just login to the guess account on a mac? I'm assuming guess accounts cant read any data from the other existing accounts
- jniedrauer 8y ago> I'm hoping that manufactures will start building a plausible deniability user profile Deniable encryption can actually be very dangerous for people who are detained in places where torture is used. Even if you unlock your device, law enforcement have no proof that you have unlocked your real profile[0]. This is relevant to countries where people can be detained for not unlocking their devices, like Australia. [0]: https://en.wikipedia.org/wiki/Deniable_encryption#Drawbacks https://en.wikipedia.org/wiki/Deniable_encryption#Drawbacks
- gruez 8y agoHence why it needs to be the default. The some sort of problem kinda exists with encryption. If nobody encrypted their phones, having one immediately makes you a suspect. However, if everyone had an encrypted phone (default on ios/android), nobody would bat an eye.
- DanHulton 8y agoAt least with iOS, you can do a factory reset before you leave, and restore it after passing through customs, and for legit reasons - you're paranoid about having your device taken from you while travelling, and you don't want thieves to be able to access your contacts, pictures, whatever. You don't have to specify that you consider customs agents thieves, that's just up to you if you wanna put that lil' spin on it. (But for real, this seems to me to be a bulletproof way to both make sure TSA can't access data on your device AND make sure you get pulled aside "randomly" for an extra-long questioning session.)