3 ms·

It's much easier for a policeman to demand the password to decrypt data when he has you in custody at customs than when it is searched by the mailman. You're c

by mises 7y ago

It's much easier for a policeman to demand the password to decrypt data when he has you in custody at customs than when it is searched by the mailman. You're confusing "not perfect" with "not good". There's an old saying: when outrunning a bear, you don't have to be the fastest guy, you just have to be faster than the slowest guy.

chii 7y ago
> It's much easier for a policeman to demand the password to decrypt data when he has you in custody at customs than when it is searched by the mailman. is that really true? I would expect that they can just perform hardware tampering when you're not present when searching in mailed items, but given that customs might use racial profiling to target you at airport, you may be better off mailing the computer securely, such as using tamper-proof or tamper-evident stickers/bags.
- michaelt 7y ago
  Dragnet demanding your password at the border is something we know they do - there are loads of witnesses saying they were asked for passwords at borders. Dragnet hardware tampering of electronics in the mail is not something we know they do. I've only seen two articles claiming evidence of physical tampering - like a hoax about Dell from 2005 [1] and Bloomberg's dodgy story about spy chips from last year [2] - neither of which seems truthy, and neither of which involved mail interdiction. (Of course, it's widely suspected mailed hardware can be tampered with, but most of the claims/speculation I've read has been about targeted tampering, not dragnet) [1] https://www.snopes.com/fact-check/keyboard-loggers/ https://www.snopes.com/fact-check/keyboard-loggers/ [2] https://techcrunch.com/2018/10/04/bloomberg-spy-chip-murky-world-national-security-reporting/ https://techcrunch.com/2018/10/04/bloomberg-spy-chip-murky-w...
- dontbenebby 7y ago
  >I would expect that they can just perform hardware tampering when you're not present On what legal authority? The border search exemption is about searching, not tampering. The issue is more that border agents are taking advantage of a law written before the age of computers to use powers the founders probably never intended. I seriously doubt that there's any legal basis to bug a computer just because it was shipped internationally. So if the threat model is being asked for your password, not being present when the device crosses is a good mitigation. (If you've done enough bad things they government is targeting you specifically, YMMV)
dragonwriter 7y ago
> Unless you are under an active investigation, the chances of your mailed laptop or phone being intercepted and searched are far, far less than if they are on your person at the border. Inbound international mail is also subject to search by customs, that doesn't just happen to stuff the owner carries across the border.
- Scoundreller 7y ago
  Just send it like most other things in this situation are sent: in pieces.

by mises 7y ago

chii 7y ago

> It's much easier for a policeman to demand the password to decrypt data when he has you in custody at customs than when it is searched by the mailman. is that really true? I would expect that they can just perform hardware tampering when you're not present when searching in mailed items, but given that customs might use racial profiling to target you at airport, you may be better off mailing the computer securely, such as using tamper-proof or tamper-evident stickers/bags.

michaelt 7y ago
Dragnet demanding your password at the border is something we know they do - there are loads of witnesses saying they were asked for passwords at borders. Dragnet hardware tampering of electronics in the mail is not something we know they do. I've only seen two articles claiming evidence of physical tampering - like a hoax about Dell from 2005 [1] and Bloomberg's dodgy story about spy chips from last year [2] - neither of which seems truthy, and neither of which involved mail interdiction. (Of course, it's widely suspected mailed hardware can be tampered with, but most of the claims/speculation I've read has been about targeted tampering, not dragnet) [1] https://www.snopes.com/fact-check/keyboard-loggers/ https://www.snopes.com/fact-check/keyboard-loggers/ [2] https://techcrunch.com/2018/10/04/bloomberg-spy-chip-murky-world-national-security-reporting/ https://techcrunch.com/2018/10/04/bloomberg-spy-chip-murky-w...
dontbenebby 7y ago
>I would expect that they can just perform hardware tampering when you're not present On what legal authority? The border search exemption is about searching, not tampering. The issue is more that border agents are taking advantage of a law written before the age of computers to use powers the founders probably never intended. I seriously doubt that there's any legal basis to bug a computer just because it was shipped internationally. So if the threat model is being asked for your password, not being present when the device crosses is a good mitigation. (If you've done enough bad things they government is targeting you specifically, YMMV)

dragonwriter 7y ago

> Unless you are under an active investigation, the chances of your mailed laptop or phone being intercepted and searched are far, far less than if they are on your person at the border. Inbound international mail is also subject to search by customs, that doesn't just happen to stuff the owner carries across the border.

Scoundreller 7y ago
Just send it like most other things in this situation are sent: in pieces.