15 ms·
It's a literal national security issue. I know people who have two factor codes and password vaults on their phone's that if compromised by a competent attacke
by hayst4ck 3y ago
It's a literal national security issue.
I know people who have two factor codes and password vaults on their phone's that if compromised by a competent attacker could compromise nearly every major corporation in America.
Imagine if a foreign intelligence agency managed to get a border guard asset.
Even from a reciprocity point of view, if we search other people's phones, that sets expectations that ours can get searched too. It's dangerous precedent all around.
- aio2 3y agoWhat are you talking about? They can already search our phones. Just have them call Google or Apple and all's said and done.
- CobrastanJorji 3y agoYou should probably tell the person who keeps information on their phone that could compromise most US major corporations to stop having that on their phone, or at least to stop traveling internationally with that phone.
- toomuchtodo 3y agoI have seen in more than one remote first org handbook instructions to wipe your corp devices prior to border transit, and restore upon arriving at your destination.
- ArchOversight 3y agoExcept that CBP claims that within 100 miles of the US border they have jurisdiction.
- xeromal 3y agoThat includes airports as well so it's defacto the entire US
- RajT88 3y agoI guess it's 100 miles from any "external boundary" as well as "points of entry", but not "100 miles from points of entry". https://www.aclu.org/other/constitution-100-mile-border-zone https://www.aclu.org/other/constitution-100-mile-border-zone But then there's also this: > In practice, Border Patrol agents routinely ignore or misunderstand the limits of their legal authority in the course of individual stops, resulting in violations of the constitutional rights of innocent people. These problems are compounded by inadequate training for Border Patrol agents, a lack of oversight by CBP and the U.S. Department of Homeland Security, and the consistent failure of CBP to hold agents accountable for abuse. No matter what CBP officers and Border Patrol agents think, our Constitution applies throughout the United States, including within this “100-mile border zone.”
- ROTMetro 3y agoIgnorance of the law is no defense... unless you are a Federal agent violating people's Constitutional rights. America in a nutshell.
- gammajmp 3y agoThis isn't true. But, 100 miles from our two borders is incredibly abusive enough.
- rand85632 3y agoYou’re forgetting the coastlines, near which a large percentage of Americans live.
- gammajmp 3y agoYou're right. I meant to say that international airports don't yield a 100 mile radius for the CBP to perform arbitrary stops. Shorelines count; the whole situation is ridiculous.
- deleted 3y ago[deleted]
- rayiner 3y agoMan, that 100 mile thing is one of the most successful misinformation campaigns I’ve seen in law.
- bumby 3y agoCan you elaborate on what's misinformation?
- 49erfangoniners 3y agoThat's nothing. Check out what the U.S. has done for centuries to misinform us all about the treaties it signed with indigenous tribes, technically binding under the Constitutional
- Spooky23 3y ago[flagged]
- hiatus 3y ago> They need to meet the reasonable suspicion standard to initiate a stop. You mean, "it smells like weed"?
- deleted 3y ago[deleted]
- 49erfangoniners 3y agoIn this forum right now in fact
- throwaway742 3y agoOdd because I have been detained at CBP checkpoints inside the US without any sort of reasonable suspicion.
- deleted 3y ago[deleted]
- nirav72 3y agoAre you a U.S citizen or permanent resident? If not, then the CBP has more flexibility on who they detain.
- throwaway09223 3y agoResident status can't be determined until after detaining someone. Your comment is self-contradictory.
- nirav72 3y agoNot sure how I'm contradictory. If you're a permanent resident, therefore you have a green card. That is a form of documentation you have to show at the CBP counter before they determine if you're lawful alien or U.S citizen. The line for U.S Citizens and permanent residence is the same. Every port of entry in the U.S has a sign that literally says - "U.S Citizens Or Permanent Residence". All other visa holders have a separate queue and detention usually starts after they've determined if a person has a valid visa or not or is a U.S citizen/permanent resident (green card)
- jayofdoom 3y agoStop traveling internationally with that phone: yes, very possible. Stop keeping that information on their phone: not always possible. Many highly-secure places require you to coordinate with an application on your phone when authenticating. In my experience, there is rarely a non-mobile option presented to users.
- bboygravity 3y agoJust a reminder that those same companies store that same information on things like Google Drive and OneDrive. That means any and all of that information is already in the hands of the US government.
- nullsense 3y agoAre we talking crypto backdoors or like the CEO of SolarWinds?
- hayst4ck 3y agoSmall c compromise, not big C. These are invented toy examples, but when I say compromise I mean things like chat logs, public transportation/taxi ride history, supply chain attacks, etc. If you want to think about the attack surface, look at companies that serve other companies and ask "what can someone with root on all of this companies machines do?" and more importantly "How mature are these companies security teams?" Imagine compromising a law firm, a public relation agency, or a newspaper. A VPN provider, a corpnet provider, or a cloud provider. My password vault doesn't have my ssh keys, but it does have my no 2fac required github recovery tokens. Phones have a lot more than just security tokens. They could provide information useful for phishing or extortion, too. I think you asked this because I used a rather grand example and that's fair. If I were to look at my post critically I think I under-stated both the potential security mitigations in place by competent security teams and the difficulty of really compromising someone's phone, and therefore somewhat overstated the problem. When playing war games, you give your opponent every conceivable advantage somewhat grounded in reality, and I have given this idealized attacker the advantage of an incompetent security team, easy compromise of phone, and lack of political consequences for taking a phone out of someone's sight and/or compelling them to enter passwords by threat of force. If you had an intelligence agency with a significant amount of APT penetration, you might look up every person who requests a visa on LinkedIn and determine if they can amplify the position of your APTs. Maybe you have compromised a taxi app or and and know what hotel they are going to and you can steal a notebook when they leave the room. I think phone out of your possession is a credible attack, maybe less so today, absolutely 10 years ago it was. Pegasus is a thing, and there were definitely rumors that Chinese police had a little USB stick they could put into peoples phones that would install an app that then disappears from the home screen. For as long as I can remember, it is hammered into every person who works around security that "no physical security means no security." Losing possession of your phone is the loss of physical security.
- ipaddr 3y ago
- emodendroket 3y ago> Even from a reciprocity point of view, if we search other people's phones, that sets expectations that ours can get searched too. This is actually a favored method to do an end-run around your rights: just get a foreign state to violate them instead.
- qingcharles 3y agohttps://en.wikipedia.org/wiki/Five_Eyes https://en.wikipedia.org/wiki/Five_Eyes
- lern_too_spel 3y agoThe Five Eyes agreements are the exact opposite of what GP claims, which of course is illegal and would have been leaked by any number of whistleblowers if true. https://www.pbs.org/newshour/world/an-exclusive-club-the-five-countries-that-dont-spy-on-each-other https://www.pbs.org/newshour/world/an-exclusive-club-the-fiv...
- roblabla 3y agoSnowden showed they absolutely spied on each other and shared documents, though the legality question is still not exactly set. From the wikipedia on Five Eyes: > Documents leaked by Snowden in 2013 revealed that the FVEY has been spying on one another's citizens and sharing the collected information with each other, although the FVEY nations maintain that this was done legally. It has been claimed that FVEY nations have been sharing intelligence in order to circumvent domestic laws, but only one court case in Canada has found any FVEY nation breaking domestic laws when sharing intelligence with a FVEYs partner.[11][12][13][14]
- lern_too_spel 3y ago> Snowden showed they absolutely spied on each other and shared documents [citation needed] The very first sentence you quoted doesn't cite any of Snowden's docs that says that. The very next sentence you quoted has a bunch of citations that say the opposite. In fact, conspiracy theorists speculated what you claim after Snowden dumped his documents, but none of Snowden's documents corroborated that claim. Previously discussed: https://news.ycombinator.com/item?id=35763700 https://news.ycombinator.com/item?id=35763700
- XorNot 3y agoHonestly this is where the current phone industry is letting us down with soldered on memory though. This whole strategy depends on the fact that by the time you realize you might not want to have your "real" phone on you, you can't do anything about it. From a technical perspective we need a phone where you can dump out the main memory chips and swap in a blank firmware image quickly.
- nomel 3y agoIt seems like the "easy" route would be a thin client phone, with just a charge port.
- userbinator 3y agoIt's worth noting that eMMC, which is the used as the "hard drive" of most smartphones, evolved from what was originally a removable media format: https://en.wikipedia.org/wiki/MultiMediaCard https://en.wikipedia.org/wiki/MultiMediaCard I suspect it's possible to design a phone which entirely uses removable storage, but beyond devboard-like systems, I'm not aware of any.
- catherd 3y agoI'm working on a phone which can be configured to dump the memory if someone fails to unlock it properly, keeping only a dummy profile. There is also a way to restore the deleted info from a backup server once you have the phone back.
- rblatz 3y agoIn what world is it faster to tear apart your phone swap in random spare blank chips and turn it back on then to ask your phone to wipe its security key and mark all space as free?
- XorNot 3y agoTrue: a decent chunk of my annoyance is Android still doesn't have an "exact restore" function for it. A wiped android doesn't get all it's apps and my home screen organization back.
- Spooky23 3y agoWhy? They’ve almost certainly already compromised the provider. Even RSA hardware tokens were compromised by the Chinese military.
- modriano 3y agoI don't follow. This decision doesn't stop the Mexican or Canadian governments from searching the phones of people going from the US to Mexico or Canada. It stops US CBP agents from searching the phones of people entering the US. Are you saying the national security issue is that CBP might get hacked by an entity that then gets access to the phone scans? Or that Mexico and Canada will just reciprocate the practice?
- Seattle3503 3y agoThat is correct, it is both. US soft power can influence international norms. US agents not having access to travel devices means US international travelers can reduce their risk exposure. Travelers can chose not to visit countries that will search their devices. If the US searches phones, it is is much harder for a US traveler to manage the risk.
- modriano 3y agoThe US is in an extremely lucky geographical position; we're protected on the east and west by oceans, we only have one neighbor each to the north and south, and both of those neighbors are friendly. But as a result, we don't really know the languages or customs of other nations around the world well enough to do espionage; we're really not great at Human Intelligence (or HumInt). But we are the more technologically advanced nation, and our Signals Intelligence (or SigInt) capabilities are the best on earth by a wide margin. (Interesting tangent: Russia is the opposite, and it's mainly geography and demographics that ingrained a KGB, HumInt tradition so deeply in their culture. The Russian state kept conquering different groups as it expanded across Asia and has had to manage a massive number cultures, many with their own languages, in order to avoid revolts). So, as much as I like the idea of being free to take my phone to another nation without my rigorous digital hygiene routine, I know that the US is never going to cast off its great defensive and offensive SigInt advantages. And I doubt this kind of case could ever make it past an appellate court, because every appellate judge knows that limiting Presidential power in any way immediately dashes any hopes of making it the running for a Supreme Court appointment.
- 3y ago
- vkou 3y ago> by a competent attacker could compromise nearly every major corporation in America. > Imagine if a foreign intelligence agency managed to get a border guard asset. Sounds like a great reason for Corp IT to not allow anything too important to go on mobile devices. (Which is already how Corp IT in most well-ran firms operates, not because they are afraid of compromised border assets, but because they are afraid of a million other, mundane reasons for why corp access on a phone can turn into a security and compliance problem.)
- swiftcoder 3y agoDirect corp net access from the phone isn't generally the risk here - typical BigTech corp employees carry a 2fac generator on their work phone, and that is supposed to secure access to both the corp net and the 3rd party password manager in which the corp net passwords are stored
- dragonwriter 3y ago> I know people who have two factor codes and password vaults on their phone’s that if compromised by a competent attacker could compromise nearly every major corporation in America. That is a national security concern. And, no, I don’t mean “warrantless searches of those devices raise national security concerns”, I mean, that state of affairs irrespective of US government search policies is a national security concern.
- xvector 3y agoI've worked at a security software engineer at multiple FAANG where I've held the proverbial "keys to the kingdom." It was a strange feeling knowing that my compromise could lead to the complete and total takeover of the companies I worked at. Realistically, these companies are already compromised by multiple nation-state actors; regardless, I'm glad to not have that responsibility hanging over my head anymore.
- formerly_proven 3y agoThe dichotomy between your comment and the sneering of Xooglers in the recent "RCEs on Google engineer workstations is not a security issue" is interesting.
- kelnos 3y agoPut more simply/directly: if these people put those credentials on their phones in the first place, they should be embarrassed by their security hygiene. More than embarrassed: possibly fired, or at least have that access taken away until they take a basic infosec awareness course.
- mikeweiss 3y agoSounds like the people you know and who ever they work for are the security risks pal.
- coffeeblack 3y agoIf they have password and 2FA on the same device, then it's not 2FA. Tell them to get an external TOTP generator, at least.
- prmoustache 3y agoMost people need access to their password manager through their smartphone. Having an external TOTP generator do not help much if said system also allow fallback to calling or sending an SMS, which most do in case TOTP generator is lost. So in many case 2FA is broken unless you decorelate access to app/password and sim card, which mean accessing your apps/systems through a second device instead of your main phone such as another simless phone, laptop, ipod touch, or tablet. Most people would never do that for conveniency reason...But in that case the same search rules/laws apply to second device anyway so it doesn't change anything to the core issue.
- last_responder 3y ago>if compromised by a competent attacker could compromise nearly every major corporation in America. This is either bullshit or those people are idiots carrying around that kind of information on a cell phone and crossing borders with it.