21 ms·

Pair Locking Your iPhone

583 points by arkadiyt 7y ago

kazinator 7y ago
> Pair locking is a useful feature to protect yourself against invasive device searches. Probably also a good way to get onto no-fly lists, and spend hours in detention, etc.
- phs318u 7y ago
  Given the same approach is used by organisations to manage their devices, I doubt this is likely to play out that way. However, if you're already a person of interest, this is unlikely to make you that much safer as any reasonable grounds for search would be used to exercise warrants against any computers you own. So, I suspect it's a reasonable protection for "slightly-more-tech-savvy-than-average" Joe's wishing to protect against opportunistic or capricious fishing for stuff, with sufficient plausible deniability ("yeah, it's a company phone") that would dissuade casual/random searches.
  - bigiain 7y ago
    That's probably a good reason to choose an organisation name that looks enough like your employer, for added believability...
- Spivak 7y ago
  Pair locking is also probably enabled on a lot of people’s work phones so you at least get plausible deniability there.
  - latchkey 7y ago
    Yes, just set the organization to 'Apple, Inc.'
  - londons_explore 7y ago
    If it's enabled on enough people's work phones, you can be sure an exploit will be used to bypass it...
- 8fingerlouie 7y ago
  I sure hope not. I work for a financial institution and our phones are locked down hard, including pair locking. This is done as a requirement from the FSA as a result of having access to confidential data on the phone. None of the data is stored on the phone, or even cached there, but it's still pair locked. I regularly bring my phone through US customs, and i've yet to have any problems. Granted, i travel from a visa waiver country, and am a white male, so my experience is probably not typical. My personal phone gets backed up and wiped before travelling, and is usually just running a selection of "basic apps" - phone, messages, and a few utilities. Once i arrive at the hotel i restore it from the real backup, and repeat before leaving again. 10-15 years ago this was the procedure i would follow when traveling to China or Russia, but modern times has expanded this to include the U.S.A. and GB. If it's just a short trip (1-2 days) i just bring my company phone though.
  - vbezhenar 7y ago
    Why your experience as a white male not typical? Are white males a minority in US? I think it's rather the opposite: your experience probably is most typical.
- jwr 7y ago
  I find this whole discussion (including the above comment) surreal, given that we are talking about the country that used to be called "the land of the free" and that claims superiority over countries that restrict freedoms.
  - taneq 7y ago
    The more I hear about the U.S. the less I want to go there, for any reason, ever. I'm sure the people are lovely but the government is scary.
    - dangus 7y ago
      American Exceptionalism taught us that it's so much different than other places. In reality, it's not really any different than any other place, and the way the government treats citizens and non-citizens isn't much different than the way any other generally functioning country would. The only difference is that we have especially well-known patriotic freedom-based songs and sayings. You shouldn't be scared to come. As a non-citizen, I could be detained/searched if I travelled to France or Germany or any other Western European country for next to no reason and it would be legal there as well, wouldn't it? To be honest, the most rigorous part of the entry process in the USA compared to other countries is the customs agents that are out to prevent you from bringing in foreign agricultural products.
      - germanier 7y ago
        I can only speak about Germany. While some form of searching at the border is legal, the power of border police and customs agents are much more restricted than those of the US counterparts, especially when it comes to cases without adequate suspicion. Apart from legal questions, what matters more is how it's handled in practice.
    - jen729w 7y ago
      Aussie/British here so YMMV if you’re from somewhere less white. Go to the States. It’s amazing. Almost none of what you read here actually happens. I’ve been a bunch of times in the last few years and the border people have been nothing but lovely. The countryside is amazing. The food is ridiculous. The people are extraordinary — and I’m a leftie who happily says that of the good folk of Alabama. We can’t wait to go back. Next road-trip will probably take us from Washington state to Chicago.
- jMyles 7y ago
  ...but it's no different in that respect than declining to unlock, which I imagine pretty much everyone on this site will do in such a situation. > get onto no-fly lists Source? I can't find evidence that anyone has ever been added to a no-fly list for declining to unlock.
  - outworlder 7y ago
    Because these lists are freely searchable, right?
    - Majestic121 7y ago
      Apparently, yes : https://www.no-fly-list.com/ https://www.no-fly-list.com/ Maybe there are other unofficial lists, but this one is searchable
      - jakobegger 7y ago
        Is this satire?
        Keverw 7y ago
        That's exactly what I was thinking too about that site being satire. They even got a disclaimer but it's lightly colored text on a lightly colored background so hard to read. The data ("the Data") displayed herein is provided "as is" with no warranty whatsoever, neither express nor implied, and no claims are made regarding its accuracy, veracity, or suitability. Inclusion of persons in the Data does not imply or allege their participation in terrorist activities. The Data is intended to be used for reference purposes only, and should not be relied upon as the sole determining factor of an individual's participation or non-participation in terrorist activities. All persons are presumed innocent until proven otherwise. By using this web site you agree to release from liability and hold harmless the Terrorist Security Administration (TSA), its employees and affiliates for any errors, inaccuracies or omissions in the Data. The TSA is an independent, non-government organization and is in no way affiliated with any branch of any government, corporation, individual or other entity, whether real or imaginary."
jakobdabo 7y ago
You can also do a hardware mod by swapping some data pins on the connector and soldering a special cable just for you.
- pfundstein 7y ago
  Sneaky, I like it. But you'll definitely will need an above-average soldering station, and skill.
  - StavrosK 7y ago
    Way above average. Those USB ports are nigh-impossible to solder, I'm not even sure how you'd "swap the data pins".
- Trav5 7y ago
  Ha, the up side of my failed usb port I guess... I can only wirelessly charge is the downside...
- toomuchtodo 7y ago
  Any reason one couldn’t remove the lightning port entirely? And charge only wirelessly (Qi), using Bluetooth for audio?
  - nobodyshere 7y ago
    The only reason might be something only available through the lightning port. The only thing I can imagine is trying to restore from backup if the OS got messed up for some reason or the screen is broken and touch UI is not an easy option.
    - toomuchtodo 7y ago
      Depending on your threat model, it might be suitable to have it removed and roll the dice if something goes wrong. Would be swank if Apple had an option to wipe the device and flush the secure enclave if it can detect physical tampering (momentary contact closure) with the traces for the port that was removed.
withinrafael 7y ago
Very interested to hear if anything like this exists on the Android side.
sdan 7y ago
Asking general HN audience: Are you willing to do this? I don't travel often, but this looks like a good option to have... although I don't really do any finicky stuff with machines/phones/etc that I use regularly. if I were using a RPI3 as a phone then I'd 100% do something like this (hope you understand the analogy).
- 14 7y ago
  I would say the only good option is to try only travel to countries that respect privacy and realise scanning phones is security theatre. Because if you go to a country and they want access to your phone these kind of tricks will prevent them from opening it but ultimately I imagine you would be sent back to where you came from.
  - hughes 7y ago
    I don't think avoiding the USA is a realistic option for a lot of HN readers.
    - sjwright 7y ago
      Excluding conferences^ and events there's nothing special about the HN audience (other than affluence) that makes them particularly likely—relative to people in a hundred other industries—to need to travel to the USA. ^ ...which are mostly money-making scams anyway, targeting fat corporate and university budgets in return for limited benefit. Rarely do you learn anything that you couldn't otherwise learn from published materials a few days later.
      - cosmic_ape 7y ago
        re:conferences: That's not quite right. In conferences you also meet people, some of whom you knew before and some that you didn't. You get to talk, and ask questions. The ROI of this may be questionable, but it does have value.
        7y ago
clamprecht 7y ago
I wish Apple would introduce a "Border crossing mode". Not gonna happen.
- deleted 7y ago
  [deleted]
- urda 7y ago
  Unrelated, 1Password has a great travel mode https://support.1password.com/travel-mode/ https://support.1password.com/travel-mode/ It will only allow vaults marked "safe for travel", everything else is removed from device. Once you get past the security theater you can re-enable the non-travel vaults from your computer.
- OriginalPenguin 7y ago
  Luckily Android has that mode. They call it "Lockdown". Here's some info on it: https://www.digitaltrends.com/mobile/how-to-use-android-9-pie-lockdown-mode/ https://www.digitaltrends.com/mobile/how-to-use-android-9-pi...
  - rusteh1 7y ago
    Does this provide any protection? I've never undergone any sort of 'digital search' do they force you to provide your passcode? Do the forensics tools they use bypass user level protections like pin codes/finger prints?
    - rendall 7y ago
      They can ask. You can refuse. If you refuse they can seize your device. If you are not a US citizen, they can deny you entry to the country. Read the EFF Digital Privacy guide for the Full Monty: https://www.eff.org/wp/digital-privacy-us-border-2017 https://www.eff.org/wp/digital-privacy-us-border-2017
    - yusi-san 7y ago
      Forensics tools like Cellbrite can actually bypass protections like pin code, schema then image your phone to do further searches.
noident 7y ago
If you want to keep your phone secure, enable a long passcode, turn on full device encryption, and turn it off. If you are a US citizen, you can't be turned away at the border or forced to unlock the device. If you're not a US citizen or don't want to be harrassed by customs, bring a burner phone. Tools like Cellebrite can and do take advantage of security vulnerabilities. Turning off pair locking lulls users into a false sense of security and is therefore harmful. Further, only restricting CBP searches to "manual" searches isn't enough and does plenty of damage to your privacy.
- ibreakthings 7y ago
  It's worth noting that if you go this route, they cannot turn you away but they can hold you for quite some time, and they can keep your phone while they investigate further when they release you.
- saagarjha 7y ago
  You can also press the lock button five times to make it refuse to unlock without a valid passcode.
  - sokoloff 7y ago
    Just tried that (iPhone 8) and it did reject my fingerprint but only after issuing a loud WHOOP WHOOP “Emergency SOS” and 3 second countdown to make an emergency call (presumably 911). Hardly a stealth move to pull at the border!
    - saagarjha 7y ago
      Oh, I keep that feature off so I didn’t realize it also will dial the emergency number. Thanks for the heads up!
    - lysium 7y ago
      Press and hold volume up and lock button. No sound.
- ehsankia 7y ago
m0zg 7y ago
This is a dumb idea if you want to actually take your flight in this situation instead of spending hours discussing privacy with TSA agents. But I also wonder what is it that they expect to find during these searches. In the world where I can transfer my criminal activity data through the likes of Dropbox (in encrypted form, of course), why would I have it on my phone or a laptop? What's the goal here?
- ixtli 7y ago
  As a US citizen i would only expect someone to force me to unlock my phone at a US port of entry, not when leaving. And yeah i'm willing to waste their time on my way back from the trip if they try to waste mine.
  - m0zg 7y ago
    That only works if you don't have a connecting flight to catch. If you do, your willingness to waste time might plunge considerably. That's what they count on.
    - ixtli 7y ago
      Yeah that’s why I said port of entry. I meant that this is fine for me if I’m exiting the airport.
  - sneak 7y ago
    As a US citizen you are not required to unlock anything (or answer any questions) when re-entering the US.
    - m0zg 7y ago
      This is true. But it's also true to that your devices could be seized if you don't comply.
- Keverw 7y ago
  Interesting, didn't know the TSA was searching peoples phones now, but the article mentions a tweet and someone also replied with a link where the TSA is being sued. I thought all the TSA could do relating to electronics is swab them or make sure they power on, while customs have the broader authority... but I know people confuse them as the same but they are separate agencies even though both are under the same DHS department. For example custom agents are actual law enforcement with guns, while TSA agents are more like mall security with no guns. It seems like traveling is getting more and more annoying the more I see stuff, already don't like the idea of taking off shoes and stuff. Plus stories of TSA agents stealing stuff. Then customs agents profile people, certain races or solo travelers. Because apparently you aren't allowed to vacation by yourself, and heard woman get looked at even more for solo traveling, they suspect they are coming to marry or carrying drugs. Just seems so outdated some of their thinking, seen on the news more and more people are vacationing alone too. A new trend. It's like something out of the 1950s. I hope though over times things will get better than worse. I know I seen they have some 3D scanners now so in the future might not need to unpack everything, like a laptop, iPad, etc and speed things up. Anything bigger than a phone, not sure if cameras count(maybe depends on if a DSLR or point and shoot size wise) but a lot of stuff to steal if you are a geek or loves to take lots of videos or photos of your vacation. However a friend who travels frequently thinks this is a overworry since so much security cameras and stuff, it'd be stupid to steal. But I know there was a news story where a reporter got his iPad stolen so they took the news van and drove right to the TSA agents house with camera crew in tow to confront him.
Nextgrid 7y ago
Note that this disables the use of Activation Lock, so in case of theft the bad guy can erase the device and resell it. Also this won’t actually protect you against bootrom exploits.
- 2rsf 7y ago
  I don't get the benefit of Activation Lock, a thief will find it out only AFTER your phone was stolen, I doubt they will give it back to you. It's the same as with GPS / Position Car Alarms- it's great for your insurance company, but in most cases I don't want to get my car back damaged or in pieces
  - earenndil 7y ago
    It's like herd immunity: if most phones have an activation lock, then thieves are less incentivized to steal them. Obviously they can still sell them for parts, but they're worth less.
    - Maxious 7y ago
      > The temptation of a smartphone for a thief is dropping, thanks to Apple’s decision to implement a remote kill switch via Find My Phone that can erase and disable a phone once it’s been stolen or gone missing. A new report from Reuters found that iPhone theft dropped by 50 percent in London, 40 percent in San Francisco and 25 percent in New York. https://techcrunch.com/2015/02/11/apples-activation-lock-leads-to-big-drops-in-smartphone-theft-worldwide/ https://techcrunch.com/2015/02/11/apples-activation-lock-lea...
    - 2rsf 7y ago
      In theory it's not needed since you could report your phone's IMEI as stolen and the phone would be block, for some reason it's not common among operators https://www.gsma.com/services/gsma-imei/imei-blacklisting/ https://www.gsma.com/services/gsma-imei/imei-blacklisting/
      - Nextgrid 7y ago
javajosh 7y ago
Isn't it possible that searching your phone at the border is security theater? I think it's likely that the US already has permanent, remote access to most phones.
- saagarjha 7y ago
  > Isn't it possible that searching your phone at the border is security theater? I mean, many people believe that many of the things that the TSA or CBP do are a security theater. > I think it's likely that the US already has permanent, remote access to most phones. There seems to be a large number of cases where law enforcement were denied access to a device and seemingly were stymied by this fact (detaining the owner, etc.) What makes you think that they're doing this just because?
  - javajosh 7y ago
    >What makes you think that they're doing this just because? I don't think they'd do it "just because". I think the NSA has access to all devices, but they don't necessarily share that access with lower-level agencies. And yet, the NSA wouldn't want people to know that they have such good access, and so it would be necessary to a) not act on everything, and b) maintain the appearance that they don't have that access. I think it's likely if only because of the complexity of devices, and the fact that it is easy to hide both intentional and unintentional flaws that would permit access. Certainly there is a huge motivation to use modern devices as part of a panopticon network, which would give anyone a huge advantage in almost every aspect of life - economically, politically, and militarily. Plus, with new and egregiously powerful exploits constantly being found in the wild, who knows what's possible with the total cooperation of manufacturers?
    - lolc 7y ago
      > the NSA wouldn't want people to know that they have such good access Yes, that is not positive evidence however. > it is easy to hide both intentional and unintentional flaws Easy in what way? I don't think it is easy to plant flaws nor easy to keep them hidden. > Certainly there is a huge motivation to use modern devices Doesn't mean it's possible. > who knows what's possible with the total cooperation of manufacturers? Why assume "total cooperation"? The manufacturers have their reputation to lose.
jackvalentine 7y ago
Break the lightning port and charge wirelessly. “Yeah the charging port doesn’t work anymore sorry.”
classified 7y ago
Securing a single phone is a half measure at best, and your phone might get seized. Also, CBP, TSA and colleagues will do what they can to fuck you extra hard when sensing resistance to their ramming their noses up your cavities. The only true remedy is to get the US back on track with being a democracy and respecting the Constitution again.
- blue_devil 7y ago
  Is simply crossing a border a "reasonable" search and seizure under the Fourth Amendment? Is there a legal precedent for that?
  - Keverw 7y ago
    No need for a warrant. So pretty much anyone or anything that is in line to cross a border is automatically fair game. I'm sure there's case law on this. For example suspicionless DUI checkpoints have been ruled legal because the supreme court views it as a minimum intrusion and for the greater good. So wouldn't surprise me if similar grounds are used in the border case. However some state courts have said DUI checkpoints are illegal under state constitutions. For example in Texas, however Texas has border patrol checkpoints. Never knew of that from being from the midwest, but I follow some full time RV vloggers on YouTube and learned about them. It surprised me, since not leaving or entering the country so never expected that traveling within your own country. Within 100 miles of the Mexican border, both permanent and temporary. Then recently in the last several years they do them now for the northern Canadian border too. Maine, New Hampshire, Vermont but temporary for a few days a year. Some people live and work near them so they have to go through a checkpoint every single day, and traffic backups too. So annoying for the local residents, and also might discourage some tourism too, hurting their local small businesses like restaurants. They are supposed to be checking for immigration status, but even looking for other things such as drugs. Even though drug checkpoints in themselves were ruled to not be legal. Since weed is legal in California, federally it's still illegal. So if you drove across California with weed, you could still get in trouble. There's some videos of people challenging them and refuse to answer if they are a citizen. Even border agents claim their dogs can smell if someone is an illegal or not too. So I guess illegals and citizens suddenly have a different scent. They also board buses and trains such as Greyhound and Amtrak going seat to seat asking people of their status. The ACLU has been asking Greyhound to stop allowing them to do this since the buses are considered private property, but there's also arguments since they are commercial they are subject to different laws. https://youtu.be/0SxHkFZV4fw https://youtu.be/0SxHkFZV4fw here's an example of one before getting on a bus or train at the station. here's one in Florida https://youtu.be/U62XSk8uQtU https://youtu.be/U62XSk8uQtU Phoenix on a metro bus. https://youtu.be/XgQVrBGlqx8 https://youtu.be/XgQVrBGlqx8 Spokane, WA City Council had a issue with it too. https://youtu.be/xHKk8oZLA1s https://youtu.be/xHKk8oZLA1s and https://youtu.be/GjbLJqvZVDo https://youtu.be/GjbLJqvZVDo - They get on the bus and go seat to seat asking asking what country they are a citizen of and where they are going... You don't have to answer but cases where they have taken people off the bus and can make you miss it. Pretty sad traveling within the same country or even city. I think they should keep border security at the border and secure the border itself.
deleted 7y ago
[deleted]
kccqzy 7y ago
An alternative: make a full backup of your phone, then restore your phone with a different backup with less personal information, and then once you cross the border you restore your phone using the first backup.
- Osiris 7y ago
  This was super easy when I had TWRP recovery. Is there an official Android way to pull a full system backup?
  - londons_explore 7y ago
    Android full system backups have become less and less 'full' with each version. Stopping piracy, enforcing secure storage for apps (eg. Fingerprint storage), and protecting DRM keys are all fairly incompatible with being able to backup and restore the entire device.
  - jeroenhd 7y ago
    Since the release of Android 6 apps have the ability to back up data to a Google account. I don't know if all apps make use of this feature, but many of the important ones I use do. Just signing in to the right Google account will pose the question of if you want to restore data from a different device or not. There's also a backup mechanism built into ADB. This is a manual process that puts a copy of all apps and information (but probably not security keys) on your computer, optionally encrypted with a PASSWORD. Google deprecated this functionality though. See here for a short guide: https://9to5google.com/2017/11/04/how-to-backup-restore-android-device-data-android-basics/ https://9to5google.com/2017/11/04/how-to-backup-restore-andr... There's always TWRP/Titanium Backup if you have root access, or in the worst case scenario, starting a root shell over ADB in recovery mode and just DD-ing the entire data partition to a file in your computer.
    - zeveb 7y ago
      > Since the release of Android 6 apps have the ability to back up data to a Google account. That does have the unfortunate side-effect of giving Google your application data.
skrebbel 7y ago
> If you lose access to your laptop or pairing record then you will also be locked out of connecting to your phone. I never understood why people do this. What if you pour coffee over the laptop and it'll never boot up anymore? Buy a new phone too?
- M4v3R 7y ago
  That's why you make backups, so even if you lose your laptop, your pairing record is safely backed up somewhere else.
  - alkonaut 7y ago
    If you want to look at it that way, the pairing record is just a digital token that lets you unlock (for reading, the data in) your phone. So it's effectively a kind of password then. It's like having an unlock password in a password manager on your laptop. I don't think it would fly to say at the border that "sorry, can't unlock for you because I don't know my password, it's in a password manager on my laptop".
    - mosselman 7y ago
      What you say is "Sorry, I can't unsupervise that". If you wanted to lie, you could say "Sorry it is supervised by my company, I can't unsupervise it" Alternatively you could encrypt the key or whatever, give that to a friend on a USB stick. Then, at the border, you say "I can't unsupervise that, the keys are managed by a third party." Which is technically the truth... the best kind of truth.
      - alkonaut 7y ago
        They'll just find you are causing trouble and put you in the little room where you'll sit for a number of hours and learn to stop thinking you could pull stunts at the border. They don't really care why you can't show a normal phone with a history of a normal life. They just want to see a normal device with normal data. There is no scenario where a technicality means you don't hand over a device they can read and they go "oh, well if you can't you can't!". Any of: no device, wiped device, locked device, is just seen as suspcicious and you'll be harrassed. Their whole idea is to make anything non-normal uncomfortable for you, so you'll comply (because most people do almost anything including giving up any data, to not have to fly back home or spend hours in a little room).
miguelmota 7y ago
Using an additional burner phone won't cost much and it's probably better than relying on a second device for unlocking your phone, or wiping your phone and restoring it when you arrive, because it's less time consuming and won't raise as much suspicion. I've heard of people shipping their phone to the destination before they fly but I'd be concerned if it gets lost or tampered with.
zw123456 7y ago
I think a cool product would be a cloud phone, where your phone is actually a VM in the cloud and your physical phone would be a bland minimal image. That way if they ever look at it they find nothing. But you can access your VM cloud phone from any device even a burner. You could even buy a burner at the airport after clearing customs and then log into your VM cloud phone.
- geggam 7y ago
  Because the govt cant get your data from a cloud ?
UglycupRawky 7y ago
Isn't this dangerous if you ever loose your computer?
S_A_P 7y ago
Im not sure I will bring a phone with me if I travel abroad. I may get a burner flip phone or something, but no smartphone for sure.
paulsutter 7y ago
Is there really a need to connect to your phone at all, ever? I’ve never found a use for the feature since iCloud > If you lose access to your laptop or pairing record then you will also be locked out of connecting to your phone.
JTbane 7y ago
I don't travel internationally very often, but I'm considering just backing up my entire phone/laptop and wiping it, then restoring from the cloud when I arrive.
thrwo234234 7y ago
I'm all for privacy but isn't this paranoia with device security a distraction ? It's likely that half a dozen companies have access to your contacts list, and Google, Facebook etc. almost certainly log information about the people you call and are in contact with. Anyone who uses an iphone for 'nefarious' purposes is not very smart.
- hannasanarion 7y ago
  It is not a distraction, because suspicionless electronics searches at borders are becoming increasingly common. Facebook knows a lot about you, but do you really want to give all that information to CBP?
  - thrwo234234 7y ago
    It's only a matter of time before Facebook integration with security services (not just the NSA) becomes seamless. In fact it's already happening - Trump has made social media scanning a pre-requisite for US visas (it's likely this will be extended to US citizens). In contrast, the device itself holds relatively little information that can't be obtained from other sources.
techdoctr 7y ago
You could also create an MDM profile from Apple configurator and disable the lighting port to only be used for charging.
- rtkwe 7y ago
  Is there a way to do that that doesn't also disable it's use as the headphone jack?
SamuelAdams 7y ago
Looks like Apple Configurator is only available on Macintosh devices. I only use Windows 10 and Linux computers. Is there any way to lock it using a different OS?
tehalex 7y ago
I do wonder if supervising devices lowers security overall. Apple has been moving a number of the 'heavy hand' management permissions to only apply to supervised devices - for example "global http proxy" [1], which can be loaded onto a device through safari on a link to an plist on an unlocked device or through a management server (MDM), forces all http/https traffic though a proxy only applies on supervised devices. Also Apple announced at WWDC [3] that blocking host pairing in Configurator is going away in favor of the restriction setting blocking it [2] [1] https://developer.apple.com/documentation/devicemanagement/globalhttpproxy https://developer.apple.com/documentation/devicemanagement/g... [2] allowHostPairing restriction at https://developer.apple.com/documentation/devicemanagement/restrictions https://developer.apple.com/documentation/devicemanagement/r... [3] https://developer.apple.com/videos/play/wwdc2019/303/ https://developer.apple.com/videos/play/wwdc2019/303/

583 points by arkadiyt 7y ago

> Pair locking is a useful feature to protect yourself against invasive device searches. Probably also a good way to get onto no-fly lists, and spend hours in detention, etc.

phs318u 7y ago
Given the same approach is used by organisations to manage their devices, I doubt this is likely to play out that way. However, if you're already a person of interest, this is unlikely to make you that much safer as any reasonable grounds for search would be used to exercise warrants against any computers you own. So, I suspect it's a reasonable protection for "slightly-more-tech-savvy-than-average" Joe's wishing to protect against opportunistic or capricious fishing for stuff, with sufficient plausible deniability ("yeah, it's a company phone") that would dissuade casual/random searches.
- bigiain 7y ago
  That's probably a good reason to choose an organisation name that looks enough like your employer, for added believability...
Spivak 7y ago
Pair locking is also probably enabled on a lot of people’s work phones so you at least get plausible deniability there.
- latchkey 7y ago
  Yes, just set the organization to 'Apple, Inc.'
- londons_explore 7y ago
  If it's enabled on enough people's work phones, you can be sure an exploit will be used to bypass it...
8fingerlouie 7y ago
I sure hope not. I work for a financial institution and our phones are locked down hard, including pair locking. This is done as a requirement from the FSA as a result of having access to confidential data on the phone. None of the data is stored on the phone, or even cached there, but it's still pair locked. I regularly bring my phone through US customs, and i've yet to have any problems. Granted, i travel from a visa waiver country, and am a white male, so my experience is probably not typical. My personal phone gets backed up and wiped before travelling, and is usually just running a selection of "basic apps" - phone, messages, and a few utilities. Once i arrive at the hotel i restore it from the real backup, and repeat before leaving again. 10-15 years ago this was the procedure i would follow when traveling to China or Russia, but modern times has expanded this to include the U.S.A. and GB. If it's just a short trip (1-2 days) i just bring my company phone though.
- vbezhenar 7y ago
  Why your experience as a white male not typical? Are white males a minority in US? I think it's rather the opposite: your experience probably is most typical.
jwr 7y ago
I find this whole discussion (including the above comment) surreal, given that we are talking about the country that used to be called "the land of the free" and that claims superiority over countries that restrict freedoms.
- taneq 7y ago
  The more I hear about the U.S. the less I want to go there, for any reason, ever. I'm sure the people are lovely but the government is scary.
  - dangus 7y ago
    American Exceptionalism taught us that it's so much different than other places. In reality, it's not really any different than any other place, and the way the government treats citizens and non-citizens isn't much different than the way any other generally functioning country would. The only difference is that we have especially well-known patriotic freedom-based songs and sayings. You shouldn't be scared to come. As a non-citizen, I could be detained/searched if I travelled to France or Germany or any other Western European country for next to no reason and it would be legal there as well, wouldn't it? To be honest, the most rigorous part of the entry process in the USA compared to other countries is the customs agents that are out to prevent you from bringing in foreign agricultural products.
    - germanier 7y ago
      I can only speak about Germany. While some form of searching at the border is legal, the power of border police and customs agents are much more restricted than those of the US counterparts, especially when it comes to cases without adequate suspicion. Apart from legal questions, what matters more is how it's handled in practice.
  - jen729w 7y ago
    Aussie/British here so YMMV if you’re from somewhere less white. Go to the States. It’s amazing. Almost none of what you read here actually happens. I’ve been a bunch of times in the last few years and the border people have been nothing but lovely. The countryside is amazing. The food is ridiculous. The people are extraordinary — and I’m a leftie who happily says that of the good folk of Alabama. We can’t wait to go back. Next road-trip will probably take us from Washington state to Chicago.
jMyles 7y ago
...but it's no different in that respect than declining to unlock, which I imagine pretty much everyone on this site will do in such a situation. > get onto no-fly lists Source? I can't find evidence that anyone has ever been added to a no-fly list for declining to unlock.
- outworlder 7y ago
  Because these lists are freely searchable, right?
  - Majestic121 7y ago
    Apparently, yes : https://www.no-fly-list.com/ https://www.no-fly-list.com/ Maybe there are other unofficial lists, but this one is searchable
    - jakobegger 7y ago
      Is this satire?
      - Keverw 7y ago
        That's exactly what I was thinking too about that site being satire. They even got a disclaimer but it's lightly colored text on a lightly colored background so hard to read. The data ("the Data") displayed herein is provided "as is" with no warranty whatsoever, neither express nor implied, and no claims are made regarding its accuracy, veracity, or suitability. Inclusion of persons in the Data does not imply or allege their participation in terrorist activities. The Data is intended to be used for reference purposes only, and should not be relied upon as the sole determining factor of an individual's participation or non-participation in terrorist activities. All persons are presumed innocent until proven otherwise. By using this web site you agree to release from liability and hold harmless the Terrorist Security Administration (TSA), its employees and affiliates for any errors, inaccuracies or omissions in the Data. The TSA is an independent, non-government organization and is in no way affiliated with any branch of any government, corporation, individual or other entity, whether real or imaginary."

jakobdabo 7y ago

You can also do a hardware mod by swapping some data pins on the connector and soldering a special cable just for you.

pfundstein 7y ago
Sneaky, I like it. But you'll definitely will need an above-average soldering station, and skill.
- StavrosK 7y ago
  Way above average. Those USB ports are nigh-impossible to solder, I'm not even sure how you'd "swap the data pins".
Trav5 7y ago
Ha, the up side of my failed usb port I guess... I can only wirelessly charge is the downside...
toomuchtodo 7y ago
Any reason one couldn’t remove the lightning port entirely? And charge only wirelessly (Qi), using Bluetooth for audio?
- nobodyshere 7y ago
  The only reason might be something only available through the lightning port. The only thing I can imagine is trying to restore from backup if the OS got messed up for some reason or the screen is broken and touch UI is not an easy option.
  - toomuchtodo 7y ago
    Depending on your threat model, it might be suitable to have it removed and roll the dice if something goes wrong. Would be swank if Apple had an option to wipe the device and flush the secure enclave if it can detect physical tampering (momentary contact closure) with the traces for the port that was removed.

withinrafael 7y ago

Very interested to hear if anything like this exists on the Android side.

sdan 7y ago

Asking general HN audience: Are you willing to do this? I don't travel often, but this looks like a good option to have... although I don't really do any finicky stuff with machines/phones/etc that I use regularly. if I were using a RPI3 as a phone then I'd 100% do something like this (hope you understand the analogy).

14 7y ago
I would say the only good option is to try only travel to countries that respect privacy and realise scanning phones is security theatre. Because if you go to a country and they want access to your phone these kind of tricks will prevent them from opening it but ultimately I imagine you would be sent back to where you came from.
- hughes 7y ago
  I don't think avoiding the USA is a realistic option for a lot of HN readers.
  - sjwright 7y ago
    Excluding conferences^ and events there's nothing special about the HN audience (other than affluence) that makes them particularly likely—relative to people in a hundred other industries—to need to travel to the USA. ^ ...which are mostly money-making scams anyway, targeting fat corporate and university budgets in return for limited benefit. Rarely do you learn anything that you couldn't otherwise learn from published materials a few days later.
    - cosmic_ape 7y ago
      re:conferences: That's not quite right. In conferences you also meet people, some of whom you knew before and some that you didn't. You get to talk, and ask questions. The ROI of this may be questionable, but it does have value.
      - 7y ago

clamprecht 7y ago

I wish Apple would introduce a "Border crossing mode". Not gonna happen.

deleted 7y ago
[deleted]
urda 7y ago
Unrelated, 1Password has a great travel mode https://support.1password.com/travel-mode/ https://support.1password.com/travel-mode/ It will only allow vaults marked "safe for travel", everything else is removed from device. Once you get past the security theater you can re-enable the non-travel vaults from your computer.
OriginalPenguin 7y ago
Luckily Android has that mode. They call it "Lockdown". Here's some info on it: https://www.digitaltrends.com/mobile/how-to-use-android-9-pie-lockdown-mode/ https://www.digitaltrends.com/mobile/how-to-use-android-9-pi...
- rusteh1 7y ago
  Does this provide any protection? I've never undergone any sort of 'digital search' do they force you to provide your passcode? Do the forensics tools they use bypass user level protections like pin codes/finger prints?
  - rendall 7y ago
    They can ask. You can refuse. If you refuse they can seize your device. If you are not a US citizen, they can deny you entry to the country. Read the EFF Digital Privacy guide for the Full Monty: https://www.eff.org/wp/digital-privacy-us-border-2017 https://www.eff.org/wp/digital-privacy-us-border-2017
  - yusi-san 7y ago
    Forensics tools like Cellbrite can actually bypass protections like pin code, schema then image your phone to do further searches.

noident 7y ago

If you want to keep your phone secure, enable a long passcode, turn on full device encryption, and turn it off. If you are a US citizen, you can't be turned away at the border or forced to unlock the device. If you're not a US citizen or don't want to be harrassed by customs, bring a burner phone. Tools like Cellebrite can and do take advantage of security vulnerabilities. Turning off pair locking lulls users into a false sense of security and is therefore harmful. Further, only restricting CBP searches to "manual" searches isn't enough and does plenty of damage to your privacy.

ibreakthings 7y ago
It's worth noting that if you go this route, they cannot turn you away but they can hold you for quite some time, and they can keep your phone while they investigate further when they release you.
saagarjha 7y ago
You can also press the lock button five times to make it refuse to unlock without a valid passcode.
- sokoloff 7y ago
  Just tried that (iPhone 8) and it did reject my fingerprint but only after issuing a loud WHOOP WHOOP “Emergency SOS” and 3 second countdown to make an emergency call (presumably 911). Hardly a stealth move to pull at the border!
  - saagarjha 7y ago
    Oh, I keep that feature off so I didn’t realize it also will dial the emergency number. Thanks for the heads up!
  - lysium 7y ago
    Press and hold volume up and lock button. No sound.
ehsankia 7y ago

m0zg 7y ago

This is a dumb idea if you want to actually take your flight in this situation instead of spending hours discussing privacy with TSA agents. But I also wonder what is it that they expect to find during these searches. In the world where I can transfer my criminal activity data through the likes of Dropbox (in encrypted form, of course), why would I have it on my phone or a laptop? What's the goal here?

ixtli 7y ago
As a US citizen i would only expect someone to force me to unlock my phone at a US port of entry, not when leaving. And yeah i'm willing to waste their time on my way back from the trip if they try to waste mine.
- m0zg 7y ago
  That only works if you don't have a connecting flight to catch. If you do, your willingness to waste time might plunge considerably. That's what they count on.
  - ixtli 7y ago
    Yeah that’s why I said port of entry. I meant that this is fine for me if I’m exiting the airport.
- sneak 7y ago
  As a US citizen you are not required to unlock anything (or answer any questions) when re-entering the US.
  - m0zg 7y ago
    This is true. But it's also true to that your devices could be seized if you don't comply.
Keverw 7y ago
Interesting, didn't know the TSA was searching peoples phones now, but the article mentions a tweet and someone also replied with a link where the TSA is being sued. I thought all the TSA could do relating to electronics is swab them or make sure they power on, while customs have the broader authority... but I know people confuse them as the same but they are separate agencies even though both are under the same DHS department. For example custom agents are actual law enforcement with guns, while TSA agents are more like mall security with no guns. It seems like traveling is getting more and more annoying the more I see stuff, already don't like the idea of taking off shoes and stuff. Plus stories of TSA agents stealing stuff. Then customs agents profile people, certain races or solo travelers. Because apparently you aren't allowed to vacation by yourself, and heard woman get looked at even more for solo traveling, they suspect they are coming to marry or carrying drugs. Just seems so outdated some of their thinking, seen on the news more and more people are vacationing alone too. A new trend. It's like something out of the 1950s. I hope though over times things will get better than worse. I know I seen they have some 3D scanners now so in the future might not need to unpack everything, like a laptop, iPad, etc and speed things up. Anything bigger than a phone, not sure if cameras count(maybe depends on if a DSLR or point and shoot size wise) but a lot of stuff to steal if you are a geek or loves to take lots of videos or photos of your vacation. However a friend who travels frequently thinks this is a overworry since so much security cameras and stuff, it'd be stupid to steal. But I know there was a news story where a reporter got his iPad stolen so they took the news van and drove right to the TSA agents house with camera crew in tow to confront him.

Nextgrid 7y ago

Note that this disables the use of Activation Lock, so in case of theft the bad guy can erase the device and resell it. Also this won’t actually protect you against bootrom exploits.

2rsf 7y ago
I don't get the benefit of Activation Lock, a thief will find it out only AFTER your phone was stolen, I doubt they will give it back to you. It's the same as with GPS / Position Car Alarms- it's great for your insurance company, but in most cases I don't want to get my car back damaged or in pieces
- earenndil 7y ago
  It's like herd immunity: if most phones have an activation lock, then thieves are less incentivized to steal them. Obviously they can still sell them for parts, but they're worth less.
  - Maxious 7y ago
    > The temptation of a smartphone for a thief is dropping, thanks to Apple’s decision to implement a remote kill switch via Find My Phone that can erase and disable a phone once it’s been stolen or gone missing. A new report from Reuters found that iPhone theft dropped by 50 percent in London, 40 percent in San Francisco and 25 percent in New York. https://techcrunch.com/2015/02/11/apples-activation-lock-leads-to-big-drops-in-smartphone-theft-worldwide/ https://techcrunch.com/2015/02/11/apples-activation-lock-lea...
  - 2rsf 7y ago
    In theory it's not needed since you could report your phone's IMEI as stolen and the phone would be block, for some reason it's not common among operators https://www.gsma.com/services/gsma-imei/imei-blacklisting/ https://www.gsma.com/services/gsma-imei/imei-blacklisting/
    - Nextgrid 7y ago

javajosh 7y ago

Isn't it possible that searching your phone at the border is security theater? I think it's likely that the US already has permanent, remote access to most phones.

saagarjha 7y ago
> Isn't it possible that searching your phone at the border is security theater? I mean, many people believe that many of the things that the TSA or CBP do are a security theater. > I think it's likely that the US already has permanent, remote access to most phones. There seems to be a large number of cases where law enforcement were denied access to a device and seemingly were stymied by this fact (detaining the owner, etc.) What makes you think that they're doing this just because?
- javajosh 7y ago
  >What makes you think that they're doing this just because? I don't think they'd do it "just because". I think the NSA has access to all devices, but they don't necessarily share that access with lower-level agencies. And yet, the NSA wouldn't want people to know that they have such good access, and so it would be necessary to a) not act on everything, and b) maintain the appearance that they don't have that access. I think it's likely if only because of the complexity of devices, and the fact that it is easy to hide both intentional and unintentional flaws that would permit access. Certainly there is a huge motivation to use modern devices as part of a panopticon network, which would give anyone a huge advantage in almost every aspect of life - economically, politically, and militarily. Plus, with new and egregiously powerful exploits constantly being found in the wild, who knows what's possible with the total cooperation of manufacturers?
  - lolc 7y ago
    > the NSA wouldn't want people to know that they have such good access Yes, that is not positive evidence however. > it is easy to hide both intentional and unintentional flaws Easy in what way? I don't think it is easy to plant flaws nor easy to keep them hidden. > Certainly there is a huge motivation to use modern devices Doesn't mean it's possible. > who knows what's possible with the total cooperation of manufacturers? Why assume "total cooperation"? The manufacturers have their reputation to lose.

jackvalentine 7y ago

Break the lightning port and charge wirelessly. “Yeah the charging port doesn’t work anymore sorry.”

classified 7y ago

Securing a single phone is a half measure at best, and your phone might get seized. Also, CBP, TSA and colleagues will do what they can to fuck you extra hard when sensing resistance to their ramming their noses up your cavities. The only true remedy is to get the US back on track with being a democracy and respecting the Constitution again.

blue_devil 7y ago
Is simply crossing a border a "reasonable" search and seizure under the Fourth Amendment? Is there a legal precedent for that?
- Keverw 7y ago
  No need for a warrant. So pretty much anyone or anything that is in line to cross a border is automatically fair game. I'm sure there's case law on this. For example suspicionless DUI checkpoints have been ruled legal because the supreme court views it as a minimum intrusion and for the greater good. So wouldn't surprise me if similar grounds are used in the border case. However some state courts have said DUI checkpoints are illegal under state constitutions. For example in Texas, however Texas has border patrol checkpoints. Never knew of that from being from the midwest, but I follow some full time RV vloggers on YouTube and learned about them. It surprised me, since not leaving or entering the country so never expected that traveling within your own country. Within 100 miles of the Mexican border, both permanent and temporary. Then recently in the last several years they do them now for the northern Canadian border too. Maine, New Hampshire, Vermont but temporary for a few days a year. Some people live and work near them so they have to go through a checkpoint every single day, and traffic backups too. So annoying for the local residents, and also might discourage some tourism too, hurting their local small businesses like restaurants. They are supposed to be checking for immigration status, but even looking for other things such as drugs. Even though drug checkpoints in themselves were ruled to not be legal. Since weed is legal in California, federally it's still illegal. So if you drove across California with weed, you could still get in trouble. There's some videos of people challenging them and refuse to answer if they are a citizen. Even border agents claim their dogs can smell if someone is an illegal or not too. So I guess illegals and citizens suddenly have a different scent. They also board buses and trains such as Greyhound and Amtrak going seat to seat asking people of their status. The ACLU has been asking Greyhound to stop allowing them to do this since the buses are considered private property, but there's also arguments since they are commercial they are subject to different laws. https://youtu.be/0SxHkFZV4fw https://youtu.be/0SxHkFZV4fw here's an example of one before getting on a bus or train at the station. here's one in Florida https://youtu.be/U62XSk8uQtU https://youtu.be/U62XSk8uQtU Phoenix on a metro bus. https://youtu.be/XgQVrBGlqx8 https://youtu.be/XgQVrBGlqx8 Spokane, WA City Council had a issue with it too. https://youtu.be/xHKk8oZLA1s https://youtu.be/xHKk8oZLA1s and https://youtu.be/GjbLJqvZVDo https://youtu.be/GjbLJqvZVDo - They get on the bus and go seat to seat asking asking what country they are a citizen of and where they are going... You don't have to answer but cases where they have taken people off the bus and can make you miss it. Pretty sad traveling within the same country or even city. I think they should keep border security at the border and secure the border itself.

deleted 7y ago

[deleted]

kccqzy 7y ago

An alternative: make a full backup of your phone, then restore your phone with a different backup with less personal information, and then once you cross the border you restore your phone using the first backup.

Osiris 7y ago
This was super easy when I had TWRP recovery. Is there an official Android way to pull a full system backup?
- londons_explore 7y ago
  Android full system backups have become less and less 'full' with each version. Stopping piracy, enforcing secure storage for apps (eg. Fingerprint storage), and protecting DRM keys are all fairly incompatible with being able to backup and restore the entire device.
- jeroenhd 7y ago
  Since the release of Android 6 apps have the ability to back up data to a Google account. I don't know if all apps make use of this feature, but many of the important ones I use do. Just signing in to the right Google account will pose the question of if you want to restore data from a different device or not. There's also a backup mechanism built into ADB. This is a manual process that puts a copy of all apps and information (but probably not security keys) on your computer, optionally encrypted with a PASSWORD. Google deprecated this functionality though. See here for a short guide: https://9to5google.com/2017/11/04/how-to-backup-restore-android-device-data-android-basics/ https://9to5google.com/2017/11/04/how-to-backup-restore-andr... There's always TWRP/Titanium Backup if you have root access, or in the worst case scenario, starting a root shell over ADB in recovery mode and just DD-ing the entire data partition to a file in your computer.
  - zeveb 7y ago
    > Since the release of Android 6 apps have the ability to back up data to a Google account. That does have the unfortunate side-effect of giving Google your application data.

skrebbel 7y ago

> If you lose access to your laptop or pairing record then you will also be locked out of connecting to your phone. I never understood why people do this. What if you pour coffee over the laptop and it'll never boot up anymore? Buy a new phone too?

M4v3R 7y ago
That's why you make backups, so even if you lose your laptop, your pairing record is safely backed up somewhere else.
- alkonaut 7y ago
  If you want to look at it that way, the pairing record is just a digital token that lets you unlock (for reading, the data in) your phone. So it's effectively a kind of password then. It's like having an unlock password in a password manager on your laptop. I don't think it would fly to say at the border that "sorry, can't unlock for you because I don't know my password, it's in a password manager on my laptop".
  - mosselman 7y ago
    What you say is "Sorry, I can't unsupervise that". If you wanted to lie, you could say "Sorry it is supervised by my company, I can't unsupervise it" Alternatively you could encrypt the key or whatever, give that to a friend on a USB stick. Then, at the border, you say "I can't unsupervise that, the keys are managed by a third party." Which is technically the truth... the best kind of truth.
    - alkonaut 7y ago
      They'll just find you are causing trouble and put you in the little room where you'll sit for a number of hours and learn to stop thinking you could pull stunts at the border. They don't really care why you can't show a normal phone with a history of a normal life. They just want to see a normal device with normal data. There is no scenario where a technicality means you don't hand over a device they can read and they go "oh, well if you can't you can't!". Any of: no device, wiped device, locked device, is just seen as suspcicious and you'll be harrassed. Their whole idea is to make anything non-normal uncomfortable for you, so you'll comply (because most people do almost anything including giving up any data, to not have to fly back home or spend hours in a little room).

miguelmota 7y ago

Using an additional burner phone won't cost much and it's probably better than relying on a second device for unlocking your phone, or wiping your phone and restoring it when you arrive, because it's less time consuming and won't raise as much suspicion. I've heard of people shipping their phone to the destination before they fly but I'd be concerned if it gets lost or tampered with.

zw123456 7y ago

I think a cool product would be a cloud phone, where your phone is actually a VM in the cloud and your physical phone would be a bland minimal image. That way if they ever look at it they find nothing. But you can access your VM cloud phone from any device even a burner. You could even buy a burner at the airport after clearing customs and then log into your VM cloud phone.

geggam 7y ago
Because the govt cant get your data from a cloud ?

UglycupRawky 7y ago

Isn't this dangerous if you ever loose your computer?

S_A_P 7y ago

Im not sure I will bring a phone with me if I travel abroad. I may get a burner flip phone or something, but no smartphone for sure.

paulsutter 7y ago

Is there really a need to connect to your phone at all, ever? I’ve never found a use for the feature since iCloud > If you lose access to your laptop or pairing record then you will also be locked out of connecting to your phone.

JTbane 7y ago

I don't travel internationally very often, but I'm considering just backing up my entire phone/laptop and wiping it, then restoring from the cloud when I arrive.

thrwo234234 7y ago

I'm all for privacy but isn't this paranoia with device security a distraction ? It's likely that half a dozen companies have access to your contacts list, and Google, Facebook etc. almost certainly log information about the people you call and are in contact with. Anyone who uses an iphone for 'nefarious' purposes is not very smart.

hannasanarion 7y ago
It is not a distraction, because suspicionless electronics searches at borders are becoming increasingly common. Facebook knows a lot about you, but do you really want to give all that information to CBP?
- thrwo234234 7y ago
  It's only a matter of time before Facebook integration with security services (not just the NSA) becomes seamless. In fact it's already happening - Trump has made social media scanning a pre-requisite for US visas (it's likely this will be extended to US citizens). In contrast, the device itself holds relatively little information that can't be obtained from other sources.

techdoctr 7y ago

You could also create an MDM profile from Apple configurator and disable the lighting port to only be used for charging.

rtkwe 7y ago
Is there a way to do that that doesn't also disable it's use as the headphone jack?

SamuelAdams 7y ago

Looks like Apple Configurator is only available on Macintosh devices. I only use Windows 10 and Linux computers. Is there any way to lock it using a different OS?

tehalex 7y ago

I do wonder if supervising devices lowers security overall. Apple has been moving a number of the 'heavy hand' management permissions to only apply to supervised devices - for example "global http proxy" [1], which can be loaded onto a device through safari on a link to an plist on an unlocked device or through a management server (MDM), forces all http/https traffic though a proxy only applies on supervised devices. Also Apple announced at WWDC [3] that blocking host pairing in Configurator is going away in favor of the restriction setting blocking it [2] [1] https://developer.apple.com/documentation/devicemanagement/globalhttpproxy https://developer.apple.com/documentation/devicemanagement/g... [2] allowHostPairing restriction at https://developer.apple.com/documentation/devicemanagement/restrictions https://developer.apple.com/documentation/devicemanagement/r... [3] https://developer.apple.com/videos/play/wwdc2019/303/ https://developer.apple.com/videos/play/wwdc2019/303/