321–330 of 483 posts
I'm breathlessly waiting for the "We will not go to Canada! Move the conferences out of Canada!" posts.
Why aren't plausible deniability passwords a feature in operating systems? Especially since many now offer full disk encryption. What would happen to these searches if plausible deniability passwords became more widely used?
I took a workshop on custom Kali builds where they specifically spoke about LUKS headers and shipping them via email/gdrive to yourself and removing them from the physical device. It renders the partition useless. This was viewed as a better alternative than something like TrueCrypt with decoy passwords since if the government can ever prove you did it then that's obstruction. With the headers gone and no local copy…
Then you can mail those flash drives around and backup them as you need. I think it is even possible to use Yubikey for dm-crypt in plain mode.
Perhaps add something to its login files that'll automatically wipe the main account data.
Earlier quoted context omitted.
If you're THAT worried, then securely reformat disk and reinstall OS just before travel.
This action can be flagged as suspicious as well, triggering a deeper investigation into the traveler. It's not always feasible, but the most secure way to protect clients'/employers' data is to encrypt the laptop and phone and ship to your destination via standard shipping services, then ship them back the same way before leaving for home. Carry a well used but non-critical burner laptop ($50 Chromebook off Craigsli…
Absolutely not. Any time your hardware is physically out of your control is a time when someone could install a hardware keylogger or replace your ethernet card with one that exfiltrates data or whatever.
The most secure option is to travel with an encrypted hdd/phone on you with no way to decrypt them, and separately acquire the private key (e.g. via shipping a secure hardware token which is made to be tamper resistant to a trusted friend at your destination).
If the devices leave your control for more than a few minutes, consider the hardware compromised and never unlock them again.
Laptops simply are not made to be highly resistant to an attacker with physical access, whereas hardware keys are, so it's not a good idea to ship them.
If you do ship them, you'll have to do a physical examination for suspicious hardware at your destination, (as you presumably did when you first received them if you're that paranoid), and it's damn hard to find a good lab for that in some countries.
Your advice is good as a way that's secure for most people's threat models, but it is a far cry from being the most secure solution, and I'd argue it's much less secure than simply carrying them with you.
Earlier quoted context omitted.
Encrypt the data (probably easiest way is to use encrypted 7z archive), memorize the password, upload the encrypted data into any cloud storage (e.g. Google Drive) and don't care about disclosing anything on your devices.
For work data such as the lawyer in the article I would recommend go one step further and not having the password in the first place. You can achieve this by for example having the server admin at work remotely unlock the device at request, have hardware tokens at trusted locations, or software that provide similar effect. No amount of $5 wrench or legal threats can change the situation as it not in your hand to give…
Earlier quoted context omitted.
Your advice to mail ahead your secure computer is not good. Mailed electronics are just as susceptible to search, if not more so, as what you keep with you. I think the reality we have to grapple with, regardless of rights violated, is that if you want to cross a nation border, it's best to assume that all nations involved will end up with a copy of all the data (hopefully encrypted) you move across that border. In t…
It's much easier for a policeman to demand the password to decrypt data when he has you in custody at customs than when it is searched by the mailman. You're confusing "not perfect" with "not good". There's an old saying: when outrunning a bear, you don't have to be the fastest guy, you just have to be faster than the slowest guy.
Inbound international mail is also subject to search by customs, that doesn't just happen to stuff the owner carries across the border.
Earlier quoted context omitted.
Shouldn’t matter. The key thing is to have a strong password, and disable any biometric authentication beforehand. (You can do this by squeezing the side buttons for a few seconds until the “power off” screen appears. The phone will then require a password before reenabling biometric authentication.)
Will that also terminate the in-memory ephemeral key that’s set up at first login to permit background app refreshes?
I have asked this question before, but never really got a satisfiable answer: why do governments (not just USA/canada) spend these resources to check data physically at a border? It's not like you need to 'smuggle' any form of data physically. I mean, any data considered to be dangerous (like terrorist attack plans, atomic bomb designs or political inside information) can be accessed across borders via the internet.…
This might partially answer your question... I had my laptop searched at the border once. It was my work laptop. They told me the same thing, if I didn't share the password they would confiscate my computer. It felt wrong that they should be able to search my computer, but I also felt bullied because I was going to need my computer the next day if I wanted to work and I think most people, including my boss at the tim…
Earlier quoted context omitted.
Can't you just use a tool like 'shred' to securely delete the file(s) ?
My understanding is that shred hasn't been reliable for many years now due to smarter and less predictable firmware in modern storage devices. Basically, you can't trust that your SSD deleted the data it said it did, or that it writes data to the place you told it.