21–30 of 124 posts
Earlier quoted context omitted.
> It's now common for border agents in the US to demand login credentials for social media accounts, and search all electronic devises. Can you define common?
The ESTA form asks for social media accounts (though not passwords, and ostensibly providing the accounts is "optional"): https://esta.cbp.dhs.gov/esta/
Earlier quoted context omitted.
> It's now common for border agents in the US to demand login credentials for social media accounts, and search all electronic devises. Can you define common?
The ESTA form asks for social media accounts (though not passwords, and ostensibly providing the accounts is "optional"): https://esta.cbp.dhs.gov/esta/
Then again, I used my social media and general web presence as partial justification for the current O-1 visa so ... oh well.
At least they can't find anything by googling my legal name.
I like the idea of using a sequence to unlock the phone, or specific finger to wipe the phone, and a different finger to load into a "clean" environment. That would be a usable mix of secret knowledge, physical security, and convienience.
A system like that would need to do more than provide a clean slate. It wouldn't be plausible that someone would be using a worn phone without having installed any apps on it. Also, I don't know how the phone would be able to obscure the contents of a micro-SD card, for example.
It just need to provide the mechanism with proper sandboxing. You still have to make this alternative look reasonable.
> I don't know how the phone would be able to obscure the contents of a micro-SD card, for example
You wouldn't use something like that for plausible deniability.
The worst thing to do, when facing rubber hoses, or legalistic equivalents thereof, is to lie. Especially if you're not a well-trained lier. And especially if there may be independent evidence that would trip you up. The best option is having nothing to hide. When crossing hazardous borders, sensitive stuff should be securely in the cloud. And when coercion is likely, a third party should control access to it.
Except that travellers may be (and sometimes are being) asked for login credentials to online accounts.
There's even an easy local solution: encrypt your data with a friend's public key (sealed box in libsodium parlance). It may be seized and intercepted, but you can't possibly decrypt it.
That's probably the kind of scheme Snowden used when he arranged his inability to decrypt his NSA data even if captured and tortured by some foreign country.
> If it isn’t baked-in to the operating system, the fact that the journalist was using some out-of-the-ordinary software itself, which may or may not have undeniable tells, would likely be a red flag and induce liberal use of the rubber hose.
This is in fact a thought that I've had about Truecrypt/Veracrypt: given a user, it seems the probability of them having a hidden volume is high. It might be deniable in the cryptographic sense, but it's very highly suggestive.
The pre-boot authentication phase is far harder to attack than an operating system that has already booted, so the only solution I can see is a typical hidden volume setup with two independent operating systems. The capability needs to be baked into both iOS and Android by default.
Cloud backup, wipe and restore is also nice, but not necessarily an option for some people depending on the circumstance. On this front, I wish Android would stop sucking. From what I understand of iOS, it's simple and easy to do this with iCloud, and you end up with basically perfect backup restorations.
Why it's even acceptable for western border agents to rifle through people's private digital lives is mind boggling. It has zero national security value (there's already a large intelligence apperatus that does this at internet-scale), so the only real reason has to be to catch non-technical people lying about their immigration status. Somehow that justifies violating everyone's rights in the process.
The worst thing to do, when facing rubber hoses, or legalistic equivalents thereof, is to lie. Especially if you're not a well-trained lier. And especially if there may be independent evidence that would trip you up. The best option is having nothing to hide. When crossing hazardous borders, sensitive stuff should be securely in the cloud. And when coercion is likely, a third party should control access to it.
isn't this a contradiction? Given how the NSA and co have backdoors in the cloud and such, and can order the operators of said cloud service to release information from their users.
If you have sensitive stuff, best not to cross any borders I'd say. Stay away from the US.
Android had user profiles for a while. If you associate different fingerprints or different pin codes with different accounts, you can have your sneaky account with all the warcrime photos and the "open" account which is full of dick pics and selfies, as per usual. Almost no new technology required. This all assumes the border guard is simply going to go through texts, pictures and maybe open up a facebook or similar…
Just need to switch user before you get off the plane.
IANAL, but AFAIK there is a strict line between not providing incriminating evidence (legal, protected under 5th Amendment) and destroying evidence (criminal).