4 ms·

The usual fare: log out, disable biometrics, use long pins and passwords, power off. Prefer a burner device, or clean your device and restore when you arrive.

by nine_k 7mo ago

The usual fare: log out, disable biometrics, use long pins and passwords, power off. Prefer a burner device, or clean your device and restore when you arrive. I remember how Google's internal guidelines for travel circa 2011 required to remove any material under NDA from your laptop when traveling to China or Russia; you had to restore it over the VPN after a safe arrival. Funny that now the same precautions apply to the US :((

joe_mamba 7mo ago
>you had to restore it over the VPN after a safe arrival How do you restore it via VPN? Don't you first need a workable OS to connect to VPN first?
- f1shy 7mo ago
  “Remove material under NDA” not format blank the computer.
- nine_k 7mo ago
  You have a working OS! But you're logged out, all sensitive data is removed (safely overwritten with random data first), and you don't have the means to connect to the VPN or anything corporate (it was before zero-trust architecture), even at gunpoint. You can check your flight status, or look up a cafe nearby to eat, etc. But you have to go to a Google office in the destination city, identity yourself, and get the trusted bits restored on your corp machine. This, together with an OTP device, finally allowed you to reconnect to the internal network (and go check fresh memegen).
  - tpetry 7mo ago
    I do understand why all these steps are required. And they are good. But how should zero-trust architecture solve that? You‘re still authenticated what the core problem is.
    - nine_k 7mo ago
      Zero-trust architecture just can work without a VPN, unless the network is blocked. Otherwise everything should be similar.
Lord_Zero 7mo ago
Do you need to disable biometrics if you simply reboot? my Pixel 10 Pro XL wont let me in without pin after reboot. Biometrics wont work until that first unlock.
- spwa4 7mo ago
  The guidelines also say that if the border agents of China or Russia ask you point blank, to give them access. It is not worth risking your personal safety for your device. That includes your PIN and password, and in China and Russia's case, whether or not that's actually allowed by law.
Ms-J 7mo ago
All solid advice. I would like to add as a reminder to encrypt all devices as well. Leave as little plaintext data as possible. Veracrypt has the ability to create hidden volumes, regardless of OS.
- nine_k 7mo ago
  This goes without saying!
belorn 7mo ago
This has been the recommendation when traveling to the US since 2001, only that the worry was NSA rather than ICE. The procedure that I got recommended in 2005 was to install a second fresh operative system (preferable windows) on the laptop on a separate partition/disk, make a copy of the old boot partition and disk encryption headers, encrypt the copy and store it online for later retrieval, and then overwrite the old boot with the new installation. Make sure to leave the old partitions alone. The restore is then as simple as downloading the encrypted backup, decrypt and dd it back in place. Repeat the process before taking the trip back. It was advisable to test the processes before to familiarize yourself to it, and to use the fresh installation a bit so it wasn't completely blank.
TheNewsIsHere 7mo ago
> I remember how Google's internal guidelines for travel circa 2011 required to remove any material under NDA from your laptop when traveling to China or Russia; you had to restore it over the VPN after a safe arrival. I made this suggestion when I served on the security team at a major cybersecurity player. When we had our company-wide annual internal conference it was always in person. This meant that basically everyone, with basically cumulative access to everything, and all our code, would be traveling across a multitude of borders at once. Some of which were less friendly than the US (at that time). This was rejected as impractical for developers and redundant for everyone else. So I suggested locking the accounts of everyone who was traveling between the time they left and the time they arrived. This would have the side effect of signing them out of our most sensitive systems and removing certain highly confidential data from laptops. This was also rejected as “unnecessary”. That company now counts a healthy proportion of the Fortune 500 amongst their customer base. I hope things are not so cavalier anymore.

by nine_k 7mo ago

joe_mamba 7mo ago

>you had to restore it over the VPN after a safe arrival How do you restore it via VPN? Don't you first need a workable OS to connect to VPN first?

f1shy 7mo ago
“Remove material under NDA” not format blank the computer.
nine_k 7mo ago
You have a working OS! But you're logged out, all sensitive data is removed (safely overwritten with random data first), and you don't have the means to connect to the VPN or anything corporate (it was before zero-trust architecture), even at gunpoint. You can check your flight status, or look up a cafe nearby to eat, etc. But you have to go to a Google office in the destination city, identity yourself, and get the trusted bits restored on your corp machine. This, together with an OTP device, finally allowed you to reconnect to the internal network (and go check fresh memegen).
- tpetry 7mo ago
  I do understand why all these steps are required. And they are good. But how should zero-trust architecture solve that? You‘re still authenticated what the core problem is.
  - nine_k 7mo ago
    Zero-trust architecture just can work without a VPN, unless the network is blocked. Otherwise everything should be similar.

Lord_Zero 7mo ago

Do you need to disable biometrics if you simply reboot? my Pixel 10 Pro XL wont let me in without pin after reboot. Biometrics wont work until that first unlock.

spwa4 7mo ago
The guidelines also say that if the border agents of China or Russia ask you point blank, to give them access. It is not worth risking your personal safety for your device. That includes your PIN and password, and in China and Russia's case, whether or not that's actually allowed by law.

Ms-J 7mo ago

All solid advice. I would like to add as a reminder to encrypt all devices as well. Leave as little plaintext data as possible. Veracrypt has the ability to create hidden volumes, regardless of OS.

nine_k 7mo ago
This goes without saying!

belorn 7mo ago

This has been the recommendation when traveling to the US since 2001, only that the worry was NSA rather than ICE. The procedure that I got recommended in 2005 was to install a second fresh operative system (preferable windows) on the laptop on a separate partition/disk, make a copy of the old boot partition and disk encryption headers, encrypt the copy and store it online for later retrieval, and then overwrite the old boot with the new installation. Make sure to leave the old partitions alone. The restore is then as simple as downloading the encrypted backup, decrypt and dd it back in place. Repeat the process before taking the trip back. It was advisable to test the processes before to familiarize yourself to it, and to use the fresh installation a bit so it wasn't completely blank.

TheNewsIsHere 7mo ago

> I remember how Google's internal guidelines for travel circa 2011 required to remove any material under NDA from your laptop when traveling to China or Russia; you had to restore it over the VPN after a safe arrival. I made this suggestion when I served on the security team at a major cybersecurity player. When we had our company-wide annual internal conference it was always in person. This meant that basically everyone, with basically cumulative access to everything, and all our code, would be traveling across a multitude of borders at once. Some of which were less friendly than the US (at that time). This was rejected as impractical for developers and redundant for everyone else. So I suggested locking the accounts of everyone who was traveling between the time they left and the time they arrived. This would have the side effect of signing them out of our most sensitive systems and removing certain highly confidential data from laptops. This was also rejected as “unnecessary”. That company now counts a healthy proportion of the Fortune 500 amongst their customer base. I hope things are not so cavalier anymore.