4 ms·

A keylogger, as it seems. So, if you give your phone unlocked to authorities, e.g. during a border check, they can log your passcode and you are now screwed.

squarefoot 5y ago
I think it's time for phone manufacturers, at least the few unknown ones that care for users privacy, to implement plausible deniability in the form of two or more bootable systems where one is the main one and the others boot would be triggered by a special password, so that they would not contain certain phone numbers, messages, etc. and anything installed there wouldn't have access to other partitions/systems. The system should be clever enough to let some innocuous information slip from other systems. For example, let's say a border guard asks me for a password and I give the one that boots the system I'd use when travelling, with no other stuff than a few family photos and cat videos, if he checked the phone calls he would immediately spot that I didn't make a phone call (with that system) in one month or more, which would immediately raise alarms, so there should be a way to tell the other systems to slip in there some information like phone calls to relatives or the restaurant, chats with girlfriend, etc. just so that one could pretend that the system was used daily.
Scoundreller 5y ago
I advise turning your phone off at border crossings. But even that is getting cut down on. Maybe I can set this up with automation and geofencing.
- alias_neo 5y ago
  What does turning the phone off solve? Can you not be compelled to turn it on? I always assumed a border agent in the US would simply insist you turn it on for them, and you have no choice.
  - Scoundreller 5y ago
    Depends on the country. In some places it’s a gray area as customs is allowed to search anything but that’s it. You’re not compelled to open/do anything for them. Yes, they could deny you entry if you’re a visitor, or they could seize it from you and give it back to you in pieces in 6 months, but if your encryption is good enough… Also reduced (but not eliminated) risk of surreptitious malware installation.
  - null0pointer 5y ago
    On iPhone at least when you restart the phone it forces you to use the passcode to unlock the first time. I believe in the US passcodes are protected by the 5th amendment whereas face id or fingerprints are not. So while you can be compelled to unlock your phone with biometrics, you cannot be compelled with the passcode. Your milage may vary in other jurisdictions.
    - alias_neo 5y ago
      And what is the implication for refusing in both cases, passcode vs biometrics? Is one likely to land you in hotter-water than the other due to the 5th protection? I also presume as a foreigner none of these protections would apply anyway?
      - Scoundreller 5y ago
        I think the strategy would be to not use biometrics at all. As a foreigner, you still have rights. It is still US soil. You haven’t done anything illegal by asking to enter with your stuff, but you’ll probably be refused entry and maybe have your phone seized anyway meanwhile a US citizen would be allowed in, but might still be without their phone. I think you’re in-the-clear long-term if you asked to “withdraw your entry request into the USA”. At least that’s the advice I’ve heard if they ask start asking about any drug use history, if you have any, so that you’re not lying but also don’t get yourself banned from entering later. https://www.ctvnews.ca/mobile/canada/pot-use-admission-at-u-s-border-snagging-canadian-boomers-says-lawyer-1.4640051 https://www.ctvnews.ca/mobile/canada/pot-use-admission-at-u-...
      - ac29 5y ago
        If I understand it correctly, refusing either one could land you in detention (or jail) - law enforcement officers have a pretty broad ability to detain people for lawful investigations (or, what they beleive are lawful investigations). The difference is that you'd be released after refusing a passcode (but possibly having to appear in front of a judge with a lawyer), whereas the court could hold you in contempt (and jail) for refusing biometrics.
    - 5y ago
  - dangerbird2 5y ago
    According to the EFF, in most cases, you can invoke your 5th amendment rights to prevent CBP from making you give up a password, particularly if you claim the content of the password (as opposed to the data the password is protecting) is personal and protected under the right to avoid self-incrimination. Of course, CPB has plenty of perfectly legal ways to get you to "voluntarily" comply: from making you miss your connecting flight, to putting you through enhanced security in the future, to denying entry if you're a non-resident. https://www.eff.org/deeplinks/2017/04/bill-rights-border-fifth-amendment-protections-account-passwords-and-device https://www.eff.org/deeplinks/2017/04/bill-rights-border-fif...
- onethought 5y ago
  iPhone you can just open the power off menu then cancel, and Face ID is reset. (Passcode required)
zionic 5y ago
They have probably found an exploit to non-persistently install a 3rd party keyboard (what a mistake that feature was!) that writes all content to unprotected disk. All apps have this ability (to write to disk that is “always available”) That’s how I’d do it anyways.

squarefoot 5y ago

I think it's time for phone manufacturers, at least the few unknown ones that care for users privacy, to implement plausible deniability in the form of two or more bootable systems where one is the main one and the others boot would be triggered by a special password, so that they would not contain certain phone numbers, messages, etc. and anything installed there wouldn't have access to other partitions/systems. The system should be clever enough to let some innocuous information slip from other systems. For example, let's say a border guard asks me for a password and I give the one that boots the system I'd use when travelling, with no other stuff than a few family photos and cat videos, if he checked the phone calls he would immediately spot that I didn't make a phone call (with that system) in one month or more, which would immediately raise alarms, so there should be a way to tell the other systems to slip in there some information like phone calls to relatives or the restaurant, chats with girlfriend, etc. just so that one could pretend that the system was used daily.

Scoundreller 5y ago

I advise turning your phone off at border crossings. But even that is getting cut down on. Maybe I can set this up with automation and geofencing.

alias_neo 5y ago
What does turning the phone off solve? Can you not be compelled to turn it on? I always assumed a border agent in the US would simply insist you turn it on for them, and you have no choice.
- Scoundreller 5y ago
  Depends on the country. In some places it’s a gray area as customs is allowed to search anything but that’s it. You’re not compelled to open/do anything for them. Yes, they could deny you entry if you’re a visitor, or they could seize it from you and give it back to you in pieces in 6 months, but if your encryption is good enough… Also reduced (but not eliminated) risk of surreptitious malware installation.
- null0pointer 5y ago
  On iPhone at least when you restart the phone it forces you to use the passcode to unlock the first time. I believe in the US passcodes are protected by the 5th amendment whereas face id or fingerprints are not. So while you can be compelled to unlock your phone with biometrics, you cannot be compelled with the passcode. Your milage may vary in other jurisdictions.
  - alias_neo 5y ago
    And what is the implication for refusing in both cases, passcode vs biometrics? Is one likely to land you in hotter-water than the other due to the 5th protection? I also presume as a foreigner none of these protections would apply anyway?
    - Scoundreller 5y ago
      I think the strategy would be to not use biometrics at all. As a foreigner, you still have rights. It is still US soil. You haven’t done anything illegal by asking to enter with your stuff, but you’ll probably be refused entry and maybe have your phone seized anyway meanwhile a US citizen would be allowed in, but might still be without their phone. I think you’re in-the-clear long-term if you asked to “withdraw your entry request into the USA”. At least that’s the advice I’ve heard if they ask start asking about any drug use history, if you have any, so that you’re not lying but also don’t get yourself banned from entering later. https://www.ctvnews.ca/mobile/canada/pot-use-admission-at-u-s-border-snagging-canadian-boomers-says-lawyer-1.4640051 https://www.ctvnews.ca/mobile/canada/pot-use-admission-at-u-...
    - ac29 5y ago
      If I understand it correctly, refusing either one could land you in detention (or jail) - law enforcement officers have a pretty broad ability to detain people for lawful investigations (or, what they beleive are lawful investigations). The difference is that you'd be released after refusing a passcode (but possibly having to appear in front of a judge with a lawyer), whereas the court could hold you in contempt (and jail) for refusing biometrics.
  - 5y ago
- dangerbird2 5y ago
  According to the EFF, in most cases, you can invoke your 5th amendment rights to prevent CBP from making you give up a password, particularly if you claim the content of the password (as opposed to the data the password is protecting) is personal and protected under the right to avoid self-incrimination. Of course, CPB has plenty of perfectly legal ways to get you to "voluntarily" comply: from making you miss your connecting flight, to putting you through enhanced security in the future, to denying entry if you're a non-resident. https://www.eff.org/deeplinks/2017/04/bill-rights-border-fifth-amendment-protections-account-passwords-and-device https://www.eff.org/deeplinks/2017/04/bill-rights-border-fif...
onethought 5y ago
iPhone you can just open the power off menu then cancel, and Face ID is reset. (Passcode required)

zionic 5y ago

They have probably found an exploit to non-persistently install a 3rd party keyboard (what a mistake that feature was!) that writes all content to unprotected disk. All apps have this ability (to write to disk that is “always available”) That’s how I’d do it anyways.