6 ms·

I have heard of security researchers setting up their laptops such that the default boot option will take you to a pretty vanilla-looking Ubuntu install with of

by mikece 8y ago

I have heard of security researchers setting up their laptops such that the default boot option will take you to a pretty vanilla-looking Ubuntu install with office apps and the like but when they reboot to do real work they log into a hardened Debian (or equivalent) install on an encrypted volume that even tech savvy CBP agents would have a hard time recognizing existed. This is great for a laptop... I wish there were cell phones that had an option like this. Perhaps the Librem 5 could support this at some point?

duxup 8y ago
An alternative is a chromebook. A few security folks I know power wash their cromebook, and then restore after they get to where they want to be. This also means they're not carrying their usual laptop with a bunch of sensitive things on it... and honestly that a serious chunk of the data loss problem with security it seems, folks with lots of data that straight up doesn't need to go places.... Several of my employers had HR folks with their laptops stolen. Like why did the HR person need to take a laptop downtown... and leave it in their car ... with my SSN and everything else on it. Hell why do they need it on the laptop locally EVER? (well the answer is they don't know how to do anything except work in excel files, but that's is its own problem)
- anonymousab 8y ago
  >and then restore after they get to where they want to be It seems like the clear workaround is to ask travelers if this is the case, and to ask for their passwords to any popular sites that provide this service. A clean laptop workspace* is suspicious on its own. I suppose you could lie about it, gamble that they would have no way of knowing that you're lying. But that's not a fun game to play long term.
  - gregmac 8y ago
    > It seems like the clear workaround is to ask travelers if this is the case, and to ask for their passwords to any popular sites that provide this service. A clean laptop desktop is suspicious on its own. So someone wanting to hide something will simply create false 'clean' accounts they can provide access to, while keeping the stuff they want hidden, hidden. Meanwhile, innocent people are getting their security compromised and privacy violated. Even worse, the authorities could claim the sites they did provide passwords to are 'too clean' and thus they must be hiding something and hold them ... until they give up passwords to accounts that may not even exist? When I was in public school, the school blocked several popular sites from the school network. As an unintended result, it provided me a great education about DNS, forward and reverse proxy servers, VPNs, and related tech as I figured out the dozens of ways to work around the blocks. Think the same thing wouldn't happen here? All you're left with is catching only the stupidest criminals, violating the privacy of innocent people, more than likely finding a bunch of false positives of whatever you're looking for, and at the same time forcing the actual criminals to become smarter about their opsec (making it harder to catch them -- in general, not just at the border) and still not catching them.
  - duxup 8y ago
    I'm not sure legally that would work all that well. I think it is unlikely they'd ask for every account. I'm sure someone has asked for passwords, but legally I don't see that working long term / it being a serious hassle. If the thing simply isn't there on the device, generally speaking as far as a typical border search goes I think legally it ends there. Otherwise your workaround would work for ... everything as it is now, but that's not how they operate at scale.
  - gnopgnip 8y ago
    The point of the lawsuit is that the border search is only supposed to be for contraband being imported, not a general law enforcement search
  - TheAceOfHearts 8y ago
    Use a password manager: you can't give them what you don't know. Oh, and obviously avoid carrying your password vaults with you when crossing the border.
  - wahern 8y ago
    The purpose of border checks is to prevent use of the border for unlawful purposes. Whatever lawful or unlawful activity you're performing on a domestic server, there would be no nexus with the act of crossing a border and therefore under no theory I'm aware of would the government have any additional power to search data not present on your person or personal effects. It's 2019, people. "The network is the computer" was 20 years ago. Kubernetes is the new Linux. Why are people keeping sensitive personal data on a personal computer, the same computer they presumably use to browse the web, and the same one they're worried will be unlawfully accessed at borders or foreign destinations. ssh is still a thing and Wayland hasn't even killed X Windows, yet. I have my own physical servers (pcengines APUs are cheap and reliable; I have like 4 running at the moment), and smartcards to authenticate for remote access to my colocated, locked-down machines.
roywiggins 8y ago
Problem is, if this catches on, CBP will just start asking whether you've got any encrypted volumes. If you say no, you're guilty of lying to a federal law enforcement officer. If you refuse to answer they'll take that to mean yes, and they'll look a lot harder.
- logfromblammo 8y ago
  The legally correct answer to that question is "I do not consent to searches or seizures, and do not answer questions without my legal counsel present". But the practically correct answer is "I don't understand your question." or, more succinctly: "What?" No matter how much it catches on, there will still be people who have no idea what it is, and even if they have it, someone else may have set it up for them so they wouldn't need to know. Even if someone can prove you did understand the literal meaning of the question, you can always plausibly argue that you didn't understand why it was being asked in relation to the questioner's official investigative authority.
  - roywiggins 8y ago
    Of course, you have plenty of defenses, including "I forgot about it". But the existence of a defense doesn't mean you want to have to argue it in court, and intentionally dissembling and/or obfuscating to a border agent is way, way down on my to-do list. > you can always plausibly argue that you didn't understand why it was being asked in relation to the questioner's official investigative authority. I don't think this is a defense. If it is a defense, they'll just preface the question with, "In order to safeguard national security, I need to know if you have any hidden accounts on here that aren't readily visible. Are there any?" Federal agents don't have to warn people that they might be prosecuted for lying. Also, if you lie to a border agent and you are anything other than a US citizen, that can be grounds to revoke your visa and ban you from the country. > Although you must know that your statement is false at the time you make it in order to be guilty of this crime, you do not have to know that lying to the government is a crime or even that the matter you are lying about is "within the jurisdiction" of a government agency. For example, if you lie to your employer on your time and attendance records and, unbeknownst to you, he submits your records, along with those of other employees, to the federal government pursuant to some regulatory duty, you could be criminally liable. https://www.wisenberglaw.com/Articles/How-to-Avoid-Going-to-Jail-under-18-U-S-C-Section-1001-for-Lying-to-Government-Agents.shtml https://www.wisenberglaw.com/Articles/How-to-Avoid-Going-to-...
fredgrott 8y ago
even better option...graphically secure shell into a harden desktop computer when doing online work..than when crossing border back in ...sure they can search all they want but there will be no Social accounts to access or anything else just a blank traditional install of os and apps. Not sure of how to do with a mobile device such as android yet. But what I describe is possible on Macs and MS WIndows and Linux.. Of course it goes without saying not to leave a sarcastic acid readme to cbp as a readme.txt file o the desktop they are searching
xfitm3 8y ago
My employer requires the use of burner devices when traveling abroad. It’s pretty simple - don’t cross borders with sensitive information. It’s a inconvenience but the reality is the legal climate for privacy is abysmal. I hope it changes, but until then, your best bet is to stay well within the law and not make an example out of yourself.
- tehlike 8y ago
  It might be also for corp espionage.

by mikece 8y ago

duxup 8y ago

An alternative is a chromebook. A few security folks I know power wash their cromebook, and then restore after they get to where they want to be. This also means they're not carrying their usual laptop with a bunch of sensitive things on it... and honestly that a serious chunk of the data loss problem with security it seems, folks with lots of data that straight up doesn't need to go places.... Several of my employers had HR folks with their laptops stolen. Like why did the HR person need to take a laptop downtown... and leave it in their car ... with my SSN and everything else on it. Hell why do they need it on the laptop locally EVER? (well the answer is they don't know how to do anything except work in excel files, but that's is its own problem)

anonymousab 8y ago
>and then restore after they get to where they want to be It seems like the clear workaround is to ask travelers if this is the case, and to ask for their passwords to any popular sites that provide this service. A clean laptop workspace* is suspicious on its own. I suppose you could lie about it, gamble that they would have no way of knowing that you're lying. But that's not a fun game to play long term.
- gregmac 8y ago
  > It seems like the clear workaround is to ask travelers if this is the case, and to ask for their passwords to any popular sites that provide this service. A clean laptop desktop is suspicious on its own. So someone wanting to hide something will simply create false 'clean' accounts they can provide access to, while keeping the stuff they want hidden, hidden. Meanwhile, innocent people are getting their security compromised and privacy violated. Even worse, the authorities could claim the sites they did provide passwords to are 'too clean' and thus they must be hiding something and hold them ... until they give up passwords to accounts that may not even exist? When I was in public school, the school blocked several popular sites from the school network. As an unintended result, it provided me a great education about DNS, forward and reverse proxy servers, VPNs, and related tech as I figured out the dozens of ways to work around the blocks. Think the same thing wouldn't happen here? All you're left with is catching only the stupidest criminals, violating the privacy of innocent people, more than likely finding a bunch of false positives of whatever you're looking for, and at the same time forcing the actual criminals to become smarter about their opsec (making it harder to catch them -- in general, not just at the border) and still not catching them.
- duxup 8y ago
  I'm not sure legally that would work all that well. I think it is unlikely they'd ask for every account. I'm sure someone has asked for passwords, but legally I don't see that working long term / it being a serious hassle. If the thing simply isn't there on the device, generally speaking as far as a typical border search goes I think legally it ends there. Otherwise your workaround would work for ... everything as it is now, but that's not how they operate at scale.
- gnopgnip 8y ago
  The point of the lawsuit is that the border search is only supposed to be for contraband being imported, not a general law enforcement search
- TheAceOfHearts 8y ago
  Use a password manager: you can't give them what you don't know. Oh, and obviously avoid carrying your password vaults with you when crossing the border.
- wahern 8y ago
  The purpose of border checks is to prevent use of the border for unlawful purposes. Whatever lawful or unlawful activity you're performing on a domestic server, there would be no nexus with the act of crossing a border and therefore under no theory I'm aware of would the government have any additional power to search data not present on your person or personal effects. It's 2019, people. "The network is the computer" was 20 years ago. Kubernetes is the new Linux. Why are people keeping sensitive personal data on a personal computer, the same computer they presumably use to browse the web, and the same one they're worried will be unlawfully accessed at borders or foreign destinations. ssh is still a thing and Wayland hasn't even killed X Windows, yet. I have my own physical servers (pcengines APUs are cheap and reliable; I have like 4 running at the moment), and smartcards to authenticate for remote access to my colocated, locked-down machines.

roywiggins 8y ago

Problem is, if this catches on, CBP will just start asking whether you've got any encrypted volumes. If you say no, you're guilty of lying to a federal law enforcement officer. If you refuse to answer they'll take that to mean yes, and they'll look a lot harder.

logfromblammo 8y ago
The legally correct answer to that question is "I do not consent to searches or seizures, and do not answer questions without my legal counsel present". But the practically correct answer is "I don't understand your question." or, more succinctly: "What?" No matter how much it catches on, there will still be people who have no idea what it is, and even if they have it, someone else may have set it up for them so they wouldn't need to know. Even if someone can prove you did understand the literal meaning of the question, you can always plausibly argue that you didn't understand why it was being asked in relation to the questioner's official investigative authority.
- roywiggins 8y ago
  Of course, you have plenty of defenses, including "I forgot about it". But the existence of a defense doesn't mean you want to have to argue it in court, and intentionally dissembling and/or obfuscating to a border agent is way, way down on my to-do list. > you can always plausibly argue that you didn't understand why it was being asked in relation to the questioner's official investigative authority. I don't think this is a defense. If it is a defense, they'll just preface the question with, "In order to safeguard national security, I need to know if you have any hidden accounts on here that aren't readily visible. Are there any?" Federal agents don't have to warn people that they might be prosecuted for lying. Also, if you lie to a border agent and you are anything other than a US citizen, that can be grounds to revoke your visa and ban you from the country. > Although you must know that your statement is false at the time you make it in order to be guilty of this crime, you do not have to know that lying to the government is a crime or even that the matter you are lying about is "within the jurisdiction" of a government agency. For example, if you lie to your employer on your time and attendance records and, unbeknownst to you, he submits your records, along with those of other employees, to the federal government pursuant to some regulatory duty, you could be criminally liable. https://www.wisenberglaw.com/Articles/How-to-Avoid-Going-to-Jail-under-18-U-S-C-Section-1001-for-Lying-to-Government-Agents.shtml https://www.wisenberglaw.com/Articles/How-to-Avoid-Going-to-...

fredgrott 8y ago

even better option...graphically secure shell into a harden desktop computer when doing online work..than when crossing border back in ...sure they can search all they want but there will be no Social accounts to access or anything else just a blank traditional install of os and apps. Not sure of how to do with a mobile device such as android yet. But what I describe is possible on Macs and MS WIndows and Linux.. Of course it goes without saying not to leave a sarcastic acid readme to cbp as a readme.txt file o the desktop they are searching

xfitm3 8y ago

My employer requires the use of burner devices when traveling abroad. It’s pretty simple - don’t cross borders with sensitive information. It’s a inconvenience but the reality is the legal climate for privacy is abysmal. I hope it changes, but until then, your best bet is to stay well within the law and not make an example out of yourself.

tehlike 8y ago
It might be also for corp espionage.