I don't care if they login to my Facebook (well, I think I don't). I just don't want to have them have everything, because then I'd have to change it all.
To be very clear, not planning to use any encryption strategies. And as you mentioned, being unable to access Facebook is not a sensible option. My question is about what to bring, not how to secure it.
US citizens have it better in at least that one regard. They can't keep me from entering the country. They can confiscate my laptop, but if I don't want to give them facebook access, there's not much they can do to stop me. They can of course add me to some list that makes my life miserable every time I fly, but there's no constitutional provision that allows preventing a citizen from entering the country.
I wonder, though, if you don't have FB etc. accounts, do they believe you?
I'm certainly not suggesting that Trump isn't stupid enough to think having CBP attempting to guess whether 800,000 grandmothers every hour are lying about not knowing what Facebook is would be a plan he could seamlessly roll out, but I think any such plan would crater pretty spectacularly.
A large majority of people do have FB accounts, and even care about their FB accounts as illustrated by their worries about providing access to them.
For most people they wouldn't bother to look, only a tiny fraction of travelers get their devices checked. And if you really don't have FB etc. accounts, they may believe you - I have little reason to doubt that; I feel that if that was their policy then we'd hear about many such cases.
However, if you claim that you don't have a FB account and their automated system (seeded by the information submitted by the airline before your arrival) shows a FB account with your face, then that seems a sure way to get turned back at a border.
Which, amusingly, is a Facebook spammer strategy — clone someone's account, including profile picture. So even if you delete your account, there may be a spammer clone that shows up in CBP's database.
We here know that we should change our password and logout of existing sessions ASAP after being made to do it, but our non-technical family members may not.
"Add TSA as a friend" is borderline reasonable, (pun intended) "give us your password" is not even close.
It also damages public awareness of importance of maintaining secure and private passwords more generally.
That it's unreasonable and unacceptable doesn't mean that it's illegal. Despite your and my hopes, not all unreasonable and unacceptable things are illegal.
> What about 'login with Facebook' sites?
Don't do that then.
> We here know that we should change our password and logout of existing sessions ASAP after being made to do it, but our non-technical family members may not.
If you've given access to your account to someone else, you've already lost, whether you log out quickly afterwards or not.
Don't put yourself in a position in which you must log into an account you care about.
People do 'login with Facebook'; people will (perhaps grudgingly) log in for them/hand over their password.
You won't, I won't, but people will because they're asked to by the uniformed officer, despite how mad it is.
I'm just amazed at the lack of significant opposition to this, there doesn't even really seem to be any opposition. Here on HN where one might expect it to be most opposed, we're merely discussing how to mitigate the effects (you can't, don't go - or be prepared to be turned around).
I wouldn't pay for my own travel to the USA (while I've been before, and enjoyed my trips, etc.) because I'm not an idiot - and handing over a password is idiotic - and I can't really afford a wasted trip. Sure, sunk cost, whatever - the cost/risk isn't worth it, at least for now until it's shown that they rarely do it, and really it's only x,y,z countries from where I do not hail.
I'm amazed at all the many ways people will give up their rights, and yet folks continue to advocate for their rights to be taken away.
> Here on HN where one might expect it to be most opposed, we're merely discussing how to mitigate the effects (you can't, don't go - or be prepared to be turned around).
I can't change the law, but I can change my behaviour.
> I wouldn't pay for my own travel to the USA (while I've been before, and enjoyed my trips, etc.) because I'm not an idiot - and handing over a password is idiotic - and I can't really afford a wasted trip. Sure, sunk cost, whatever - the cost/risk isn't worth it, at least for now until it's shown that they rarely do it, and really it's only x,y,z countries from where I do not hail.
a) they rarely do it (roughly 4,500 times last year, IIRC)
b) any country might do it, and many do; this is not a U.S.-only thing
My mistake, I hadn't heard of this until recently (and clearly didn't read the article properly) and assumed it was a new policy under Trump.
At a rate of around 0.0012%, and assuming it's more targeted than random, my actual chance of being asked is much lower, yes sure, that probably is worth the risk of being turned around.
The really great thing about having a Republican (even if only technically) president is that the news media suddenly rediscover the virtues of small government, and the dangers of an unbalanced power structure (a similar phenomenon holds with Democratic presidents & conservatives). It'd be awesome if people would just be principled, but apparently that is too much to ask.
> At a rate of around 0.0012%, and assuming it's more targeted than random, my actual chance of being asked is much lower, yes sure, that probably is worth the risk of being turned around.
Yes, but I just carry a clean device with no access to my accounts. I can honestly and without deception say that I cannot do what is asked.
The general consensus seems to be that you'll be turned around.
I think this applies whether or not you are a citizen, whether or not you entering the U.S. or another state, and frankly whether we're talking about electronic data or not. If you don't want it searched, examined or confiscated, don't enter a nation state with it!
> It is a very bad plan to attempt to outsmart CBP with clever encryption strategies. If you want to protect something, don't bring it to a border crossing.
Excellent advice. You can't outsmart customs with clever encryption strategies.
But you're much more vulnerable if you bring data with you. The first level of protection is making a backup, formatting your devices as new, and restoring once you're on US soil. Better yet is not bringing devices at all. But certainly don't bring secrets with you: bank records, medical records, and military secrets should never be carried with you through customs.
Say you're talking to your friendly neighborhood CBP officer and they say this:
"I think you're an immigration risk and, accordingly, I'm issuing an Order for Expedited Removal. You get on the next plane back home." Your passport gets tagged with a 5 year timeout.
However, they could say something like:
"I think you're not eligible for the Visa Waiver Program, because some factors suggest you're an immigration risk. I recommend you withdraw your application for entry into the United States and voluntarily get on the next plane back home." You will not get timed out for 5 years.
Note that the second one is neither a recommendation nor a request.
Disclaimer: IANAL but IA someone who has to have an anomalously-good-for-most-Americans understanding of immigration procedure.
And potentially any other country that has the "have you been denied access to any country for any reason" rider on its immigration questionaires.
The only point I really want to make:
It is a very bad plan to attempt to outsmart CBP with clever encryption strategies. If you want to protect something, don't bring it to a border crossing. CBP's budget is tens of billions of dollars, and they don't have to break your encryption; they just have to fuck up your entry into the country. The math doesn't work out here for nerds.