11 ms·
When I was a grad student I worried about this, since I was required to keep study participant data and student data confidential. Sounds like this lawyer arri
by dontbenebby 8y ago
When I was a grad student I worried about this, since I was required to keep study participant data and student data confidential.
Sounds like this lawyer arrived at the same plan I did:
Refuse the request, file a lawsuit, and contact the media when released to shame the government that saw fit to violate my rights.
- vbezhenar 8y agoEncrypt the data (probably easiest way is to use encrypted 7z archive), memorize the password, upload the encrypted data into any cloud storage (e.g. Google Drive) and don't care about disclosing anything on your devices.
- viraptor 8y agoDiscover that your password has ended up in a swap file one day and hasn't been overwritten, and chrome left you logged into Google drive. I wouldn't trust this approach not to fail by accident.
- dorgo 8y agoLet the computer you used for encryption and uploading at home.. Take an empty/new notebook/smartphone with you to show at the border? edit: place a big random data file, which looks like encrypted data on your alibi notebook. Refuse to give password and let the government lab try to find the password..
- graedus 8y ago> Let the computer you used for encryption and uploading at home.. Take an empty/new notebook/smartphone with you to show at the border? This is certainly safer, though maybe not possible on the return trip (where you're returning from someplace where you only have access to your laptop). If you need to be this careful, maybe it's best to do your work after livebooting into tails or something like that. > edit: place a big random data file, which looks like encrypted data on your alibi notebook. Refuse to give password and let the government lab try to find the password.. Funny, but unnecessarily risky if you ask me.
- marci 8y agoAm realizing that not so long ago, saying that entering a democratic nation was riskyer if, just a few seconds before customs, you had entered in a command line: head -c 1000000000 /dev/urandom | openssl enc -aes-256-cbc -a > risky.1Giga.file would have been considered tin-foil-hatty, and now we're just getting use to it
- vbezhenar 7y agoI think someone was imprisoned in UK for refusal of giving password. Don't joke with government.
- pmorici 8y agoNot a great idea. You have no reason to believe deleted and cached copies aren’t lingering on you disk unprotected.
- vbezhenar 8y agoIf you're THAT worried, then securely reformat disk and reinstall OS just before travel.
- angott 8y agoYes, that’s something we can do as HN readers, but good luck explaining that to the average lawyer or paralegal.
- wepple 8y agoInstructing then how to power wash their chrome book and then simply login with their you okey again is achievable
- cormacrelf 8y agoOr just set up a rental service for overseas computing. Good thing about non-programmers is they don’t need three days to get 300 pieces of software installed and configured on a new machine.
- morganvachon 8y agoThis action can be flagged as suspicious as well, triggering a deeper investigation into the traveler. It's not always feasible, but the most secure way to protect clients'/employers' data is to encrypt the laptop and phone and ship to your destination via standard shipping services, then ship them back the same way before leaving for home. Carry a well used but non-critical burner laptop ($50 Chromebook off Craigslist) and/or phone ($20 Walmart smartphone) with you that won't wreck your world if it's confiscated and searched. If it is seized, take your receipt and go on about your business. When you get to your destination your actual devices will be waiting for you. You can safely forget about the burner devices.
- whamlastxmas 8y agoFull drive encryption and then using spideroak for cloud storage is a better and easier solution
- fauigerzigerk 8y agoFull disk encryption doesn't help if you share the password that decrypts the disk.
- neya 8y agoIt's easy to break your encryption. Trust me, if you live in a country that has crap laws, they will actually extract the password from you: https://xkcd.com/538/ https://xkcd.com/538/ Edit I'm not saying it's a bad idea to encrypt your drives, just that it doesn't save you from someone determined..
- notatoad 8y agothe parent isn't saying to encrypt your drives, they're saying to encrypt your data and store it separately from your computer - essentially treat any devices you're carrying across the border as compromised before you even reach the border.
- stale2002 8y agoThis post is about western countries. The vast majority of western countries will not literally torture you to death, in order to get rando citizen's phone passwords. Encryption works great for this usecase, that almost everyone in this thread will be using it for. People being tortured for their personal phone password by a rando border guard in basically any country, just isn't something that happens, despite what the internet memes would lead you to believe. Even in supposedly bad countries, I really doubt that this "attack vector" is something that happens frequently.
- cmurf 8y agoHow long can you be detained? And under what conditions? More than a few hours will get the vast majority of people cooperating. I suspect they could detain you for 24 hours, or even several days, but I don't know what the legal limit is for detaining a citizen at the border of their own country. And for quite a lot of other people, even not being personally detained, but having to acquire new devices is inconvenient enough to compel cooperation. Who wants to buy new devices? Who has a need for two sets? It'd only be a cost of business for someone who does a decent amount of traveling and has confidential information to protect. But then, that's a trap too because why should people need a reason? Why are only people with business/legal confidential information a protected class?
- belorn 8y agoFor work data such as the lawyer in the article I would recommend go one step further and not having the password in the first place. You can achieve this by for example having the server admin at work remotely unlock the device at request, have hardware tokens at trusted locations, or software that provide similar effect. No amount of $5 wrench or legal threats can change the situation as it not in your hand to give them access, and you can helpfully give the path forward for the officers to follow. Even better if you have a written company policy with you which spells out that employees don't have capability to unlock devices during travel.
- gingabriska 8y agoHow 5 dollar wrench won't work in this case? Isn't administrator going to follow his order, so he can made to call the administrator and reset keys etc..?
- wereHamster 7y agoThis assumes you can get the wrench close enough to the admin. If they are in another country, one that is outside of your jurisdiction you'll have a hard time applying your wrench.
- dredmorbius 7y agoThe wrench need only be applied to whomever tells the admin to unlock the archive. In a manner that the admin is likely to accept the request.
- AnthonyMouse 7y agoThis is where duress codes can be useful.
- dredmorbius 7y agoQuite. Drill those, though. Under stress, people fall back on learned patterns.
- petre 8y ago7zip uses a vulnerable RNG. It was posted here a while ago.
- isodude 8y agoWhy not reemove the drive and replace it with something basic with a plain os installed? It's quite simple even with MacBooks.
- Fnoord 8y agoI don't know about the US, but here in The Netherlands the technical cops are aware of cold boot attack. As a lawyer crossing a border you should use a device with a secure enclave, and have the device off. Or better: don't cross the border with your device.
- webninja 8y agoOr use Veracrypt with AES25 and a 30+ character password. Good luck NSA trying to break that.
- xvector 8y agoMethinks the NSA could break AES-25 just fine :)
- jMyles 8y ago> don't care about disclosing anything on your devices. I'm not sure this is good advice. I think it's almost certainly better to have an unblemished record of assertion than a mixed record of assertion and acquiescence. Surely the latter appears far more suspicious.
- all_blue_chucks 8y agoUnless that disk had a low-level factory wipe afterward, some amount of that data will still be on the disk somewhere, and law enforcement has all the tools needed to recover it.
- cameronbrown 8y agoWouldn't it just make more sense to keep all the data encrypted on a cloud service and not travel with any of the data physically? One step further would be to not travel with any devices at all, and just purchase something after crossing the border.
- cormacrelf 8y agoThat’s the idea behind 1password’s travel mode. Ostensibly you could do that for an entire device, but the easier you make it for yourself, the easier it is to write legislation saying you have to undo what you did. (Depends on the various jurisdictional constitutionalities of that kind of provision, but still.)
- GoblinSlayer 7y agoOr log into a guest account and let the dude search all he wants, lol.
- grawprog 7y agoRather than an encrypted archive, would an encrypted, hidden partition not work better? Anything sensitive goes on there, have it unmounted and invisible, leave the rest of the system as is let 'em login and search what they see.