4 ms·

I think it's enough to shut down you phone. Then it needs a pin, and you're entitled to not give that over, I believe. So you should be safe, apart from some ki

by pkulak 2mo ago

I think it's enough to shut down you phone. Then it needs a pin, and you're entitled to not give that over, I believe. So you should be safe, apart from some kind of rubber-hose cryptanalysis.

gbriel 2mo ago
If you’re a U.S. citizen: CBP cannot deny you entry to the United States merely because you refuse to unlock the phone. If you’re a non-citizen seeking admission: refusal is much riskier. The important wrinkle is that CBP’s published policy expressly guarantees that a person being admitted as a U.S. citizen won’t be denied entry solely because CBP couldn’t inspect the device. It doesn’t give lawful permanent resident (green card holders) that same explicit statement. Instead, it says refusal by a “foreign national” can be considered in an admissibility determination.
- porkpieshoe 2mo ago
  [dead]
- rootusrootus 2mo ago
  Isn't the guarantee for citizens a bit stronger than CBP's policy? I don't think they can lawfully deny entry of a citizen, period.
  - technothrasher 2mo ago
    They cannot (lawfully) deny entry. But they can admit you and then immediately detain and/or arrest you.
    - rootusrootus 2mo ago
      Sure, if they have a warrant or probable cause, just like any other law enforcement officer.
      - kelnos 2mo ago
        In theory, yes, but in practice they can do whatever they want, and suing them after the fact is going to be expensive, and have a high probability of not working out for you. When interacting with border officials (or any LEOs, for that matter), be polite, don't get hostile or aggressive, but also be firm and don't volunteer any information that you're not required to give.
      - inigyou 2mo ago
        Not unlocking your phone is probable cause. Non-criminals readily submit for inspection. (We can fix this by refusing inspection even when we are not criminals)
- cesarepavese 2mo ago
  this only applies if they don't refuse to acknowledge your papers as valid and/or they haven't previously put you on some hidden list of people of interest, in which case the instance where you get to prove you're who you say you are will be mediated, like the rest of the (as per the current system) nonpeople, by as many layers of humilliation and risk to your life and health as they can place.
TheqO 2mo ago
If you don't give a pin, they can seize your devices (Andrew Tate on his 1st visit to Florida said that he refused to give pin and they seized phone and laptop)
- stickfigure 2mo ago
  They can't keep them, you'll get the devices back. Use a temp phone in the mean time. Sad that we have to accept this as a risk of international travel, but here we are.
  - joebates 2mo ago
    They can absolutely keep them. Or they can just "lose" them "accidentally". Who exactly would force them to give them back? Or put another way, who exactly will punish them if they break the law?
    - iamnothere 2mo ago
      They can’t keep them permanently, but unfortunately they have in the past kept them from some people for years, until the hardware was past its useful life. It’s a good idea to only travel with electronics you don’t mind losing (and not just because of this).
      - garciasn 2mo ago
        You have a worldview that’s incompatible with the reality of the current US legal system where things work the way you believe they should, rather than the way they actually do. Morality and direct commonsense interpretations of law do not apply when there are literally unlimited resources stacked against you. But, assuming you can wait the potential ~10y to receive your device back that it will take to get your device returned to you, good on you. If you think that the current SCOTUS will rule in your favor, good on you. The reality is, we live in a time where the most horrendous interpretation of the law is the one that will happen. And it won’t be in your favor.
overfeed 2mo ago
> So you should be safe, apart from some kind of rubber-hose cryptanalysis. There are vendors that sell the technology to adversarially access phone data, the "Before First Unlock" is the safest state a phone can be, but it's not infallible. The safest option is to have a burner or factory-reset phone with nothing on it, even if the hack succeeds.
- ratelimitsteve 2mo ago
  I've worked with Cellebrite, the industry standard in IT forensics for unlocking and imaging phones. It just runs a series of known exploits. PIN lock, data encryption and regular updates will beat it most of the time.
  - armadyl 2mo ago
    > I've worked with Cellebrite Any chance you want to do a public service and publish the latest compatibility matrix? Just joking, obviously…
  - trollbridge 2mo ago
    When I interact with the general public, I get a nice reminder that most people don't do a decent PIN lock, don't have encryption on unless it's the default for that platform, and don't do regular updates. Lots of reasons why (phone is out of space to do an update; not signed in properly to Apple / Google account; kids use their phone so they want an easy to remember PIN on it, etc. etc.)
- wat10000 2mo ago
  Before First Unlock with recent hardware and an up to date OS is probably sufficiently infallible for an average person. I wouldn't want to rely on it if I was engaged in espionage, but for someone who won't get the NSA pulled into the case, I'd be pretty confident. This leaked Cellebrite support matrix shows that BFU was secure against them for iPhones that were nearly four years old at the time, and I doubt it's become significantly worse since then: https://ia800405.us.archive.org/32/items/inseyets-offline-ufed-version-10.2-user-manual/iOS%2BSupport%2BMatrix%2B7.69.1.pdf https://ia800405.us.archive.org/32/items/inseyets-offline-uf...
Terr_ 2mo ago
> Then it needs a pin A compromise to this is that many phones have a "lockdown" mode, where it isn't fully off but refuses to accept biometrics until a code/pattern is used to bring it to a more day-to-day mode. It's less-secure than being fully off, but it also means if you do need to access your phone you can do so more-quickly.
- inigyou 2mo ago
  Just reboot it. The disk is encrypted until you unlock it.
dawnerd 2mo ago
That’s probably why they’ve been pushing the MPC app heavily.
globular-toast 2mo ago
Only a matter of time until mandatory key disclosure like the UK and other countries. This overrides even the right to silence.
- ErroneousBosh 2mo ago
  The US had that looooong before the UK did.

by pkulak 2mo ago

I think it's enough to shut down you phone. Then it needs a pin, and you're entitled to not give that over, I believe. So you should be safe, apart from some kind of rubber-hose cryptanalysis.

gbriel 2mo ago

If you’re a U.S. citizen: CBP cannot deny you entry to the United States merely because you refuse to unlock the phone. If you’re a non-citizen seeking admission: refusal is much riskier. The important wrinkle is that CBP’s published policy expressly guarantees that a person being admitted as a U.S. citizen won’t be denied entry solely because CBP couldn’t inspect the device. It doesn’t give lawful permanent resident (green card holders) that same explicit statement. Instead, it says refusal by a “foreign national” can be considered in an admissibility determination.

porkpieshoe 2mo ago
[dead]
rootusrootus 2mo ago
Isn't the guarantee for citizens a bit stronger than CBP's policy? I don't think they can lawfully deny entry of a citizen, period.
- technothrasher 2mo ago
  They cannot (lawfully) deny entry. But they can admit you and then immediately detain and/or arrest you.
  - rootusrootus 2mo ago
    Sure, if they have a warrant or probable cause, just like any other law enforcement officer.
    - kelnos 2mo ago
      In theory, yes, but in practice they can do whatever they want, and suing them after the fact is going to be expensive, and have a high probability of not working out for you. When interacting with border officials (or any LEOs, for that matter), be polite, don't get hostile or aggressive, but also be firm and don't volunteer any information that you're not required to give.
    - inigyou 2mo ago
      Not unlocking your phone is probable cause. Non-criminals readily submit for inspection. (We can fix this by refusing inspection even when we are not criminals)
cesarepavese 2mo ago
this only applies if they don't refuse to acknowledge your papers as valid and/or they haven't previously put you on some hidden list of people of interest, in which case the instance where you get to prove you're who you say you are will be mediated, like the rest of the (as per the current system) nonpeople, by as many layers of humilliation and risk to your life and health as they can place.

TheqO 2mo ago

If you don't give a pin, they can seize your devices (Andrew Tate on his 1st visit to Florida said that he refused to give pin and they seized phone and laptop)

stickfigure 2mo ago
They can't keep them, you'll get the devices back. Use a temp phone in the mean time. Sad that we have to accept this as a risk of international travel, but here we are.
- joebates 2mo ago
  They can absolutely keep them. Or they can just "lose" them "accidentally". Who exactly would force them to give them back? Or put another way, who exactly will punish them if they break the law?
  - iamnothere 2mo ago
    They can’t keep them permanently, but unfortunately they have in the past kept them from some people for years, until the hardware was past its useful life. It’s a good idea to only travel with electronics you don’t mind losing (and not just because of this).
    - garciasn 2mo ago
      You have a worldview that’s incompatible with the reality of the current US legal system where things work the way you believe they should, rather than the way they actually do. Morality and direct commonsense interpretations of law do not apply when there are literally unlimited resources stacked against you. But, assuming you can wait the potential ~10y to receive your device back that it will take to get your device returned to you, good on you. If you think that the current SCOTUS will rule in your favor, good on you. The reality is, we live in a time where the most horrendous interpretation of the law is the one that will happen. And it won’t be in your favor.

overfeed 2mo ago

> So you should be safe, apart from some kind of rubber-hose cryptanalysis. There are vendors that sell the technology to adversarially access phone data, the "Before First Unlock" is the safest state a phone can be, but it's not infallible. The safest option is to have a burner or factory-reset phone with nothing on it, even if the hack succeeds.

ratelimitsteve 2mo ago
I've worked with Cellebrite, the industry standard in IT forensics for unlocking and imaging phones. It just runs a series of known exploits. PIN lock, data encryption and regular updates will beat it most of the time.
- armadyl 2mo ago
  > I've worked with Cellebrite Any chance you want to do a public service and publish the latest compatibility matrix? Just joking, obviously…
- trollbridge 2mo ago
  When I interact with the general public, I get a nice reminder that most people don't do a decent PIN lock, don't have encryption on unless it's the default for that platform, and don't do regular updates. Lots of reasons why (phone is out of space to do an update; not signed in properly to Apple / Google account; kids use their phone so they want an easy to remember PIN on it, etc. etc.)
wat10000 2mo ago
Before First Unlock with recent hardware and an up to date OS is probably sufficiently infallible for an average person. I wouldn't want to rely on it if I was engaged in espionage, but for someone who won't get the NSA pulled into the case, I'd be pretty confident. This leaked Cellebrite support matrix shows that BFU was secure against them for iPhones that were nearly four years old at the time, and I doubt it's become significantly worse since then: https://ia800405.us.archive.org/32/items/inseyets-offline-ufed-version-10.2-user-manual/iOS%2BSupport%2BMatrix%2B7.69.1.pdf https://ia800405.us.archive.org/32/items/inseyets-offline-uf...

Terr_ 2mo ago

> Then it needs a pin A compromise to this is that many phones have a "lockdown" mode, where it isn't fully off but refuses to accept biometrics until a code/pattern is used to bring it to a more day-to-day mode. It's less-secure than being fully off, but it also means if you do need to access your phone you can do so more-quickly.

inigyou 2mo ago
Just reboot it. The disk is encrypted until you unlock it.

dawnerd 2mo ago

That’s probably why they’ve been pushing the MPC app heavily.

globular-toast 2mo ago

Only a matter of time until mandatory key disclosure like the UK and other countries. This overrides even the right to silence.

ErroneousBosh 2mo ago
The US had that looooong before the UK did.