News for hackers. Stuff that matters.
Re:1Password Travel Mode: Protect your data when crossing bo... by techsupporter on Wednesday May 24, 2017 @01:13AM (#14407744)
> If you[, a citizen of the United States,] ever get asked that question at the US border, please don't acquiesce to that request.

Absolutely agreed. I will do this[0]. I'm a U.S. citizen with the unequivocal right to enter the country once my citizenship has been established. U.S. citizens are the only ones who can stand up to this madness--either at the border or by influencing and electing people who can change the written law and how it is enforced--and it's our responsibility to do so.

I've entered the country several times and have never gotten more than a "passport, please" request (except, oddly, when driving south from Canada; they're rather surly at the Peace Arch, in my experience), which I recognize is very lucky of me. When I travel, I'm enough of a worry-wart that I build in a lot of spare time to get to and from my destination. "Do you want to fly today" and "you'll be screened for four additional hours" are threats that hold no weight with me, thankfully. I'm in no hurry.

I'm the ideal test case. I have oodles of paid vacation time, a family full of lawyers, and a ornery streak a kilometer wide. Bring it.

0 - I can't say "I have done this" because it's never come up but I'm resolute. "No" is my answer, if it ever does, and I'm sticking with it.

Re:1Password Travel Mode: Protect your data when crossing bo... by sneak on Wednesday May 24, 2017 @03:46AM (#14408208)
I have been that guy. All of 2009-2013 or so.

After being locked in secondary with no comms, food, or water for hours on hours enough times, one gives up. CBP once kicked me out of a border control point in northern Vermont, in a snowstorm, in February. I had to hitchhike simply to not freeze (my sim didn't work, so no way to call a cab, and they had sent the bus on without me, hours earlier).

I've been searched, both well and also simply as intimidation, more times than I can remember. Most searches are not thorough in any capacity, but simple displays of power and dominance.

My foreign partners have been repeatedly groped by these pigs. Vacations have been ruined simply by traveling together - they deny foreigners entry.

The file still haunts me. Every time I enter, secondary - with associated 30-500 minutes of delay.

There's no recourse.

I cringe every time I exit the US, for the 2-10 hours I will lose upon my next re-entry.

Their capacity to waste your time is infinite. Your time is finite.

PS: they can also take all your devices for imaging and keep them for 48 hours - but you will likely have to sue them to get them back after that time. Crossing in can be a >$10k/entry affair if they wish it to be, for you.

Re:1Password Travel Mode: Protect your data when crossing bo... by wuschel on Wednesday May 24, 2017 @03:54AM (#14408240)
This sounds like the reprisals citizens of the totalitarian states in the Warsaw Pact had to endure. Heads up for pushing against it.

Out of curiosity, do you know if there are any people trying to challenge these rulings/treatment they receive in court?

Re:1Password Travel Mode: Protect your data when crossing bo... by Cthulhu_ on Wednesday May 24, 2017 @05:10AM (#14408603)
At least in those - and I'm sure this still happens - you could bribe the officials.

Actually is that possible in the US or do the border officials still have a stick up their arse? I mean if you work for a big multinational IT company, surely they can provide a few hundred bucks to bribe someone to skip security. Bribing the police is normal in a lot of countries.

Re:1Password Travel Mode: Protect your data when crossing bo... by gambiting on Wednesday May 24, 2017 @05:53AM (#14408785)
Yeah. My father described the experience of crossing borders between East Germany/Poland/Belarus/Ukraine in the 80s early 90s as the exact same theatre -

" -sir, we have to strip your car to search it for contraband.

-Ok, how long it's going to take?

- About 24-48 hours, but it might take longer if we see anything suspicious

- ok, what do I do in the meantime?

- you can sit on the bench there

- for 48 hours?

- that's correct

- I happen to have this nice bottle of vodka, would you like it as a thank you for your hard service?

- hmmmm I have to check with my superior [ comes back 5 minutes later] - that's fine, we don't need to check your car today, have a safe journey"

Nowadays I'm being told that this practice has been eradicated almost everywhere, but it basically relied on border control agents making your life as miserable as physically possible in hope that you will pay up. If you decided not to, they would eventually let you go, but you're wasting only your own time, they had infinite amount of it and perfect justification for everything they did.

Re:1Password Travel Mode: Protect your data when crossing bo... by justincormack on Wednesday May 24, 2017 @08:12AM (#14409392)
You can get a 10 year prison sentence or so for bribery. In any country in the world, you can be prosecuted there, or in the US or Europe. You will probably also be fired.
Re:1Password Travel Mode: Protect your data when crossing bo... by 77pt77 on Wednesday May 24, 2017 @12:12PM (#14411106)
> You will probably also be fired.

Please elaborate on that.

Re:1Password Travel Mode: Protect your data when crossing bo... by groby_b on Wednesday May 24, 2017 @02:03PM (#14412088)
Any large company has an ethics code. Bribing government employees is usually a rather big no-no in that code.
Re:1Password Travel Mode: Protect your data when crossing bo... by 794CD01 on Wednesday May 24, 2017 @03:36PM (#14412815)
Any large company also makes allowances for differences in local laws and customs when applying their ethics code.
Re:1Password Travel Mode: Protect your data when crossing bo... by groby_b on Wednesday May 24, 2017 @05:22PM (#14413568)
Yeah... no. (The FCA[4] makes that fairly hard)

Amazon: "Employees may not bribe anyone for any reason, whether in dealings with governments or the private sector. " [3]

Apple: "Apple does not offer or accept bribes or kickbacks in any form, and we do not tolerate corruption in connection with any of our business dealings." [2]

Google: "The rule for us at Google is simple – don’t bribe anybody, anytime, for any reason."[1]

[1] https://abc.xyz/investor/other/google-code-of-conduct.html [2] http://files.shareholder.com/downloads/AAPL/0x0x803576/DAFD8... [3] http://phx.corporate-ir.net/phoenix.zhtml?c=97664&p=irol-gov... [4] https://en.wikipedia.org/wiki/Foreign_Corrupt_Practices_Act

Re:1Password Travel Mode: Protect your data when crossing bo... by specialist on Wednesday May 24, 2017 @09:45AM (#14409936)
Thank you for sharing your experiences.

For future, for the rest of us, I'm wondering what civil disobedience would look like. Something akin to malicious compliance, work to rule, or...? Actions (or inactions) that we can take to make the whole process infeasible.

For example... Whenever a telemarketer cold calls me, I try to take up as much of their time as possible. Increase their costs, reduce their conversion rate.

I also try to lie as much as possible for forms, surveys, etc. Muddy the data. Increase their costs.

Re:1Password Travel Mode: Protect your data when crossing bo... by mirimir on Wednesday May 24, 2017 @07:22AM (#14409137)
> PS: they can also take all your devices for imaging and keep them for 48 hours - but you will likely have to sue them to get them back after that time.

You don't really want them back, anyway. So you just don't carry anything valuable, in any sense.

Re:1Password Travel Mode: Protect your data when crossing bo... by sneak on Wednesday May 24, 2017 @07:43AM (#14409233)
If only running three companies afforded me the ability to be without a computer, phone, or tablet for 24-48h while they are shipped/replaced.

That's called a vacation.

What you describe is simply impractical for a person in my line of work.

Re:1Password Travel Mode: Protect your data when crossing bo... by mirimir on Wednesday May 24, 2017 @07:54AM (#14409292)
If you're running three companies, you can carry throwaway devices.
Re:1Password Travel Mode: Protect your data when crossing bo... by sneak on Wednesday May 24, 2017 @09:11AM (#14409726)
You misunderstand me; it is not the issue of the cost of the device, but the 2-4h on each side of imaging and restoring (for mobiles) or the 4-8h on each side for computers.
Re:1Password Travel Mode: Protect your data when crossing bo... by mirimir on Wednesday May 24, 2017 @09:34AM (#14409868)
Employees can handle imaging and restoring. You can send an employee in advance, who will have devices ready for you on arrival. So all that gets handled while you're in transit.
Re:1Password Travel Mode: Protect your data when crossing bo... by DonHopkins on Wednesday May 24, 2017 @04:12PM (#14413064)
When you can't even trust your own Blood Boy [1] not to get stoned, eat twinkies, and write a tell-all expose about you, how are you supposed to hire an employee trustworthy enough to handle all of your most sensitive keys and information? (Let alone three of them, one for each company.)

[1] https://www.theverge.com/2017/5/22/15676696/hbo-silicon-vall...

Re:1Password Travel Mode: Protect your data when crossing bo... by sneak on Wednesday May 24, 2017 @03:46PM (#14412888)
If you have any methods for hiring employees trustworthy enough to backup and reimage my most secure computing device with the most sensitive data, and somehow do so on notice given only via ESP, at several major world airports, please do let me know.

I guess I could get a fourth phone, the one I use only for talking to my Airport Phone Guy, who would somehow be incorruptible enough to not hijack my bitcoin wallet or take copies of my camera roll (which, if used strategically, could alternately make or ruin entire careers or companies).

I'll be over here in the Real World.

Re:1Password Travel Mode: Protect your data when crossing bo... by mirimir on Thursday May 25, 2017 @06:01AM (#14416305)
I don't know smartphones. But for machines with SSDs or HDDs, imaging and restoring software FDE volumes doesn't involve decryption. I don't know about hardware-based FDE, however. I use Linux VMs, and you can just copy LUKS-encrypted VDI files. If you're paranoid, you can backup and wipe the LUKS header, and send it separately.
Re:1Password Travel Mode: Protect your data when crossing bo... by sneak on Thursday May 25, 2017 @06:39AM (#14416447)
Thanks, but my phones and tablet are my primary systems and even just resyncing breadwallet alone takes a half hour or more. You have no idea what you are talking about.
Re:1Password Travel Mode: Protect your data when crossing bo... by tutufan on Sunday May 28, 2017 @06:05PM (#14436293)
Can you just keep your devices stateless? This works for me.
Re:1Password Travel Mode: Protect your data when crossing bo... by akvadrako on Wednesday May 24, 2017 @03:57AM (#14408254)
Any idea why this happens to you? Your story suggests some targeting.
Re:1Password Travel Mode: Protect your data when crossing bo... by veidr on Wednesday May 24, 2017 @04:44AM (#14408463)
I was once on a list that got me secondary searching every single time I flew in the USA, for several years.

This was back in the 1990s, when asking for your password wasn't a thing I've ever heard of them doing, but also when me bringing 128-bit encryption software (aka the US version of Netscape Navigator) to Japan, where I was a foreign student, was a serious crime akin to arms smuggling.

Of course, I never found out for sure why I was on that list, and eventually I apparently wasn't on it anymore. But during that time I did read a fascinating article in some magazine, by Nathan Myhrvold (the now-infamous patent troll scumbag). Apparently, he was on the same list, despite being a super rich fat white guy from Microsoft.

His theory was that he got on the list by buying one-way plane tickets in cash. That resonated with me, because I often did the same thing back then… I just never really knew when I wanted to come back, and I didn't have much credit on my one credit card.

That's obviously both circumstantial and anecdotal, however I don't think it really takes too much to get on one of these secret (and very probably unlawful, but effectively un-challengeable) lists.

Re:1Password Travel Mode: Protect your data when crossing bo... by adventured on Wednesday May 24, 2017 @08:33AM (#14409516)
> he was on the same list, despite being a super rich fat white guy from Microsoft.

What could the "fat" part of that possibly have to do with anything related to targeting, other than as a cheap excuse for you to denigrate Myhrvold?

Re:1Password Travel Mode: Protect your data when crossing bo... by veidr on Wednesday May 24, 2017 @11:34AM (#14410760)
Well, I really just meant it more in the sense of him being a typical/normal/mainstream/not-unusual American.

But also, yeah: fuck Nathan Myhrvold. He's a smarmy piece of shit whose parasitical exploitation of America's societal weaknesses and dysfunction far outweighs all the modest contributions he's ever made. I hope he trips and falls face-first into one of his large sous-vide contraptions.

(That time, I was denigrating him on purpose.)

Re:1Password Travel Mode: Protect your data when crossing bo... by ratacat on Wednesday May 24, 2017 @09:21AM (#14409782)
Thank you for this.
Re:1Password Travel Mode: Protect your data when crossing bo... by EGreg on Wednesday May 24, 2017 @09:45AM (#14409933)
Probably means he looked more "safe" and "complacent" and that didn't stop them.
Re:1Password Travel Mode: Protect your data when crossing bo... by letmein on Wednesday May 24, 2017 @02:48PM (#14412427)
Myhrvold is a scumbag now, but back in the 90's he pulled off a heroic fuck you to NSA.

NSA didn't want to allow Microsoft to build RSA into Windows and export it. Even though the cat was out of the bag and foreign OEMs and vendors were already selling RSA. NSA wanted Microsoft to not give users more than 40 bits of encryption keys.

So Myhrvold, as President of Microsoft, flippantly offered to pad the keys generated by Windows with NSA's public RSA key. Win Win. Users can export more than 40 bits, and NSA gets a backdoor.

Microsoft won and was allowed to export software using RSA. No doubt that little stunt put Myhrvold on some Watchlist for Life.

It's too bad he became evil after he became a billionaire and started only caring about money and Yachts and hob knobbing with other 1% elites.

Re:1Password Travel Mode: Protect your data when crossing bo... by sneak on Wednesday May 24, 2017 @04:54AM (#14408522)
For five years or so, I (a US citizen) politely but firmly refused to answer a single question put to me whilst re-entering the United States, as is my human right.
Re:1Password Travel Mode: Protect your data when crossing bo... by SamBam on Wednesday May 24, 2017 @09:43AM (#14409921)
Not even "Was your trip business or pleasure?"

Border guards have the power to prevent you from entering the country if they believe your business is unlawful, and asking those questions is one of the ways they decide. We can question whether border guards ought to exist, but, given that they do, refusing to answer their questions seems like a ticket to a back room for hours.

You really never answered their questions on every entry?

Re:1Password Travel Mode: Protect your data when crossing bo... by sneak on Wednesday May 24, 2017 @04:03PM (#14413004)
The fifth amendment does not go away suddenly at the border (4A notwithstanding).

If exercising my human rights is "a ticket to a back room for hours", then something is fundamentally broken in our society. You should try it; without doing so you actually have no data about the practical perimeter of your basic rights. This stuff isn't printed in the newspaper.

Yes, I really never answered their questions, except the ones about citizenship and nationality and place of birth—which I answered by presenting my passport.

"Business or pleasure?" is a vague, leading question designed to get you to volunteer as much information as possible. Sometimes I replied "no" or "yes" to that one, with an occasional "On advice of my attorney I decline to answer questions from police except in writing and via counsel" thrown in to break up the monotony.

Never talk to the police.

Re:1Password Travel Mode: Protect your data when crossing bo... by 77pt77 on Wednesday May 24, 2017 @12:16PM (#14411132)
> Border guards have the power to prevent you from entering the country if they believe your business is unlawful

No. The USA can never deny entry to citizens (nor any other country). They may arrest you on the spot, but can't deny you entry.

Green card holders is a different story, they have no right to enter and are at the discretion of the authorities.

Re:1Password Travel Mode: Protect your data when crossing bo... by Tunecrew on Wednesday May 24, 2017 @12:05PM (#14411040)
I don't believe they can prevent US citizens from entering the US.