This post is about western countries. The vast majority of western countries will not literally torture you to death, in order to get rando citizen's phone passwords.

Encryption works great for this usecase, that almost everyone in this thread will be using it for.

People being tortured for their personal phone password by a rando border guard in basically any country, just isn't something that happens, despite what the internet memes would lead you to believe.

Even in supposedly bad countries, I really doubt that this "attack vector" is something that happens frequently.

How long can you be detained? And under what conditions? More than a few hours will get the vast majority of people cooperating. I suspect they could detain you for 24 hours, or even several days, but I don't know what the legal limit is for detaining a citizen at the border of their own country.

And for quite a lot of other people, even not being personally detained, but having to acquire new devices is inconvenient enough to compel cooperation. Who wants to buy new devices? Who has a need for two sets? It'd only be a cost of business for someone who does a decent amount of traveling and has confidential information to protect.

But then, that's a trap too because why should people need a reason? Why are only people with business/legal confidential information a protected class?

> How long can you be detained? And under what conditions

The answer is not very long. I'd call "a couple days" to be not a big deal, and not at all equivalent to being tortured to death, like the person I was responding to was implying would happen.

So yes, encryption does work, and all that will happen to you is that you could be moderately inconvenienced.

But even that I would expect to be rare. Most border security would just look at your computer, or whatever, not find anything on it (because the thing you show them just looks like an empty computer), and move on their way.

The narrative that I was responding to was this idea that technology solutions can always be bypassed, by torture or something, therefore technology solutions are worthless. And that's just not true.

An extremely effective technology solutions to an incompetent border guard that is interrogating you is for all your devices to just appear like there isn't anything on them, like a new factory default computer that you just bought.

A guard will just look at that, not see anything, and then move on to the rest of his crappy job.

I gather it could be indefinite detention. Say 5 hour detention then they ask again. Then detention again. Repeat.

I think a couple days is good enough because people will miss holidays, work, plans etc. That's Western nations "torture" equivalent of a wrench

> . Say 5 hour detention then they ask again. Then detention again. Repeat.

Ok, and does this happen in real life?

The answer is no. It does not. In almost any western country in the world, the low paid border security guards are not detaining people in mass for days on end.

This stuff just isn't really happening to any large degree.

You can go to jail for years in the UK for refusing to disclose a password to law enforcement.[0]

[0] https://nakedsecurity.sophos.com/2018/09/04/how-refusing-to-...

And how often does that happen, in real life?

The answer is "not that often".

The example you gave was of someone who was suspected of murder.

The amount of people who are in the population of "people suspected of murder, and are jailed for not giving up their password", is a very small population size.

So as long as the government makes a pinky promise to never use their power elsewhere it's okay? Think at least a little about the future. They might be doing it now for a good cause, but how long is that going to last? There's nothing stopping them from jailing anybody who refuses to give up their password, because what's jailable is the act of not giving up your password.

> So as long as the government makes a pinky promise to never use their power elsewhere it's okay?

I never made any claims about what is or it is not OK.

The only claim that I am making is that this whole "XKCD wrench meme" is dumb, and that encryption actually works really well for the vast majority of people in the vast majority of usecases.

That's all. Encryption works, and you are not going to be tortured, or locked up forever, because you refused the order of a low paid border guard.

Such situations are extremely rare, and it is annoying that people keep bringing them up when they basically don't happen to anyone.

the parent isn't saying to encrypt your drives, they're saying to encrypt your data and store it separately from your computer - essentially treat any devices you're carrying across the border as compromised before you even reach the border.

If I'm understanding vbezhenar correctly, the implied step after uploading the encrypted file to a cloud storage service is to securely delete it from the computer you're carrying. Then, the authorities won't know that there is anything to beat out of you with their $5 wrench.

Yeah, but you still get beat with the $5 wrench. And if it was going to work in compelling you to give the password, it will still be pretty effective getting you to provide access to the cloud storage and the encryption password to it.

A couple of people would get beaten with the wrench the first few times it happened, but after a few weeks and a few high profile cases from Fortune 500 employees of "my CIO is the only one with the key", they'd move on to other targets or other methods.

How does the low paid border security drone even know you have a cloud storage account?

What country do you live in that has to worry about people being tortured to death on a frequent basis?

This stuff just doesn't happen often, despite what a silly XKCD comic would lead you to believe.

Encryption actually works pretty damn well, for basically all usecases that a normal person would come across.

The world is not a James Bond spy move.

You're not going to be tortured to death, but there are quite a few things that the government can do to make your life miserable.

The $5 wrench isn’t what most people have to worry about; it’s the 5-hour detention without charge.

5 hour detention is nothing - expensed vacation :)

Extraordinary rendition to the Guantanamo Bay is what concerns me.

Maybe also have some relatively uninteresting encrypted files which you can hand over in this situation?

I'm not saying any of this is likely. But, as the topic was raised, if they break you and you start talking, you will volunteer the information. They don't need to know before hand.

That said, the most practical scenario here is to keep your important files secured somewhere else, cloud or elsewhere, and when they ask you to unlock your phone or laptop you say "Sure!" Because there's nothing to find and you're compliant and helpful so they quickly let you go after a proforma search.

> The world is not a James Bond spy move.

Yeah, there is no James Bond outside the books and screen. But thermorectal cryptanalysis is out there and still beats most of cyphers with ease. And it's not letal!

But it will not work if you do not know the password. (It can also be time locked with false data; they don't know whether or not it is the real data.)