U.S. Visitors May Have to Hand Over Social Media Passwords | Hacker News Reader

U.S. Visitors May Have to Hand Over Social Media Passwords

nbcnews.com

61 pointserelde57 comments

Why stop with social media? Why not email and other accounts as well, just to be safe?

It's one thing to ask for social media user IDs (which still bothers me), but this is taking it to another level.

I already have to submit my financial details, history of past travel..At some point, you will come to a place where there's enough 'data' for anyone to conclude anything they want. Sort of like, if all you have is a hammer, everything will look like a nail.

Sad.

It is time for everyone to start building fictional aliases of themselves to hand over.

You might be interested to listen to this talk at DEF CON. Chris Rock (the speaker) tells you how to one could forge new identities, SSN, etc.

https://www.youtube.com/watch?v=m1lhGqNCZlA

https://news.ycombinator.com/item?id=12528544

My female Canadian friend was interrogated in a Canadian airport by an American border agent because she made the unfortunate mistake of having a connecting flight in the States on the way to visit me in Mexico.

The agent asked her if she was a "good girl" and then demanded access to her phone's Facebook Messenger to see if she'd been offering or planning sex services.

She of course complied. What else are you going to do? Cancel your plans and stay home during your vacation leave?

It's a great job to have if you're a creep and/or resent women.

Please report this incident to US Customs and Border Patrol, as well as DHS.

https://www.cbp.gov/contact

https://www.dhs.gov/department-white-pages

EDIT: Sorry to piggyback.

For your own security/privacy when traveling (I'm sorry, as a US citizen), bring a dumb phone just for calling, and wipe your iPhone (if its an iPhone) before transiting a customs checkpoint. Restore from iCloud when you're safely out of the airport. If asked what the dumb phone is for, "I break my iPhone all the time."

> Restore from iCloud when you're safely out of the airport.

"Sir, your phone appears to have been reset. Please connect it to iCloud and sync now".

If they can compel access to apps and social media why would iCloud et al be any different?

Keep a separate sparse iCloud account if you don't think you have the soft skills to work around that unlikely scenario.

Will it stay unlikely in the long term?

Who knows. You won't like my advice though: leave the country if the surveillance state reaches a crescendo.

As a tech worker, I'm employable anywhere in the world, and can have my family and all of our belongings out of the country in 12 hours. My heart goes out to everyone who doesn't have such flexibility. It's not fair to those impacted that these are the times we live in.

That's not to say we give up. We try to fix this fuckery until the very end.

Had she left the secured area of the airport to go outside or offsite and then re-enter? I can't imagine American DHS agents roaming free in a Canadian airport... especially confronting a Canadian citizen inside Canada.

You typically go through passport control for the US at the Canadian airport if you are flying to the US.

This sort of shit is why I go through FB periodically and delete nearly everything. What bullshit.

We should actually hope that they 'take it too far' and apply it broadly - because the first day it went into force the blowback would be mesmerizingly big.

There was some blowback from immigration and that affected relatively few.

But this will hit millions of people every day with a huge WTF? It'll go to every CEO and media person in America very quickly as a 'very material issue', unlike some policies which companies support/resist for populist or political reasons.

If they just do it to 'select people' ... then it would be something on blogs, sometimes in the press yada yada but maybe not so mainstream.

Reminds me of a question on the US visa waiver form asking whether you are or ever have been a Nazi. Because everybody knows that Nazis cannot lie, and international terror organizations cannot create dummy social media accounts.

Green card application includes a form that has that and more. Are you a communist, have you been convicted of genocide, have you ever used a prostitute ...

I really wish I had taken a picture of that form, the majority of questions were idiotic.

The I-485, right?

https://www.uscis.gov/i-485

That's the one. That's good for a laugh.

I also used to think those questions are idiotic, but maybe there is a point to them. Now many people are worrying like, all these people coming from a different culture, do they understand our culture?

So maybe these questions serve as a simple reminder - don't do these things.

Actually, I think it would be better to ask about U.S. Bill of Rights, but hopefully you get my point.

That is not the purpose of the form.

Also -

"Have you received public assistance in the United States from any source, including the U.S. Government or any State, county, city, or municipality (other than emergency medical treatment), or are you likely to receive public assistance in the future?"

I was unaware that that was a problem in the US. It also asks about things that are legal in other countries and you are penalized if you answer honestly.

Its not idiotic, its procedural. In the future, if they want to get you, they can find something in that form.. like using a prostitute and throw the book at you.

Doesn't make it any less idiotic.

This is because you probably can't be prosecuted for being a Nazi, but you can for falsifying a government document.

That's exactly it. A knowing falsehood on your green card application invalidates your greencard- whether they find it now, tomorrow, in 10 years ..

The questions are precisely so they can be held against you - at any time.

I don't think anyone who really wanted to get into the US would have a problem handing over A social media password. Whether that's a password for an account specifically created to be reviewed by immigration authorities is another matter entirely.

What makes DHS think they would be reviewing a real social media account?

I think this is not about reviewing social media accounts. This is about giving DHS and CBP a pretense to deny entry to anyone they feel like, based on gut feelings, prejudices, whatever.

I would have a problem with it. And I would really want to get into US, possibly, because I work for an American company. But it's not my job to create fake social media accounts, sorry.

I don't think filling out visa applications, in general, is anyone's job (unless maybe you're a personal assistant for someone who travels internationally a lot). It's not about what is and is not your job. If that's what a country requires to allow you entry, and you want to enter, that's what you do.

I am just a normal programmer, not a spy. Visa application is acceptable (I have done that in the past), forging social media accounts is not (I in fact I do have FB account but God knows where the password is).

I think the point they were making was that regardless of how you feel emotionally about giving up specific information, it has no effect on whether a country allows you to enter. So go ahead and do only what you feel is "acceptable", just don't be surprised when you are turned away at the border for not filling out all of the required documents.

Welp, time for Facebook, Twitter, et al. to intentionally make themselves inaccessible from locations/networks coincident with US ports of entry.

"To protect our produ^H^H^H^H^Hcustomers' privacy, we have decided to block access to all accounts that we can ascertain within reasonable certainty to be temporarily crossing an international border. We apologize for the inconvenience, and service will be restored once you get further away from the port of entry, or as soon as those in charge of US customs decide to stop being asshats."

Finally, a real Catch-22: give the password, you violate the Facebook ToS and potentially the CFAA as a result. Don't give the password, you get held by DHS (and possibly sexually assaulted in a "strip search") as punishment before being sent back at your expense.

America, I think our relationship is over.

Give them something which resembles a password? How will they know?

Give them the password, then change it afterwards?

Have an alternative account used just for immigrations?

Claim you have no social media accounts, or deactivate them before entering the country (we know FB doesn't delete, only deactivates)?

Change the name on the social media accounts?

Or do the right thing and tell them to go f* themselves because it's a huge invasion of privacy and none of their business. It's unfortunate most people won't have this option.

I've been trying to give the Trump administration a chance, but this is getting more ridiculous and more embarrassing every day.

2 Factor Authentication (Facebook, Twitter, Instagram (through Facebook), Google) really puts a damper on this and helps you remember that the U.S. government (and esp leadership) is sorely behind when it comes to security

In which way would that help? It's access what is wanted, not the password. If you have 2FA, other ways will be found.

I don't believe that there is a technical solution. This is a purely political thing. If this becomes policy the US becomes entirely off-limits for me although I don't have any social media account.

In the short term if they ask for passwords and they are provided people with 2FA might slip through unviolated. That is until laws catch up.

The problem I see is that I'll be able to share my password, but somebody won't be able to log in. They'd come back and be confused. If I give them the 2 factor, the computer needs to be there, or they need to say it over radio, and even if they say it over radio, it would be a race before it expires.

And yes, presumably, they could work with facebook or the NSA for a portal that bypasses 2 factor, but then they don't need my password.

Facebook, Twitter, etc. should shut down DHS' and other TLAs' Facebook and Twitter pages if those organizations are purposefully violating the companies' TOS, including the accounts of the leadership who presumably know about and authorize these rules. Up to and including the official POTUS Twitter account as well as @realdonaldtrump.

Just because the government can "legally" get access to anything they want doesn't mean they get to live consequence-free.

Now out of diplomatic reciprocity other countries can do it to us

Brazil already conducts enhanced scrutiny of Americans..

" American citizens are both photographed and fingerprinted as part of their immigration clearance process. This is because Brazil practices diplomatic reciprocity and processes American citizens entering Brazil the same way the U.S. processes Brazilian citizens entering the United States. This is most assuredly NOT the place to demonstrate any displeasure with this process. More that a few Americans (including at least one airline pilot) have been arrested, fined (thousands of dollars) and ejected from the country forever for making an obscene gesture during this process."

http://www.brazil-help.com/brazil_travel_tips.htm

http://www.economist.com/blogs/gulliver/2013/02/tourist-visa...

If people want to self-identify as rude and unable to understand the difference between creators and implementers of policy, I vote we let them.

I'd rather they were turned back at the border. It would be great if we could apply this to people currently in the nation as well.

Note that this predates the Trump administration.

I think that's the only real power that other countries can exercise - force Americans (especially business travelers) to experience what the US is forcing on visitors in the US.

Soon: People leaving the US will have to hand over social media credentials, too.

Do you think they'll stop at "foreigners"?

Will not having a social media presence be considered a red flag?

This is one of my worries. I had a rarely-used FB account for a few years, but deleted it when I realized the privacy concerns.

No FB, twitter, IG, Gmail, LinkedIn, etc. Nothing. You can't find me through a Google search except for my public-facing professional certifications (which are required to be public-facing).

I wonder if one day this will get me on a list as some kind of "lone wolf" even though I'm quite social (in the in-person sense).

Perhaps all new policies should have to be applied first to legislators.

Want a password requirement? Fine, submit yours first, Congressman; we won't abuse it, "promise".

Want inane questions and forms with high fees? Fine, Congressman, first you must fill out every last form yourself (don't forget to have a new picture taken, and thumbprints!). If you still think it's reasonable after all that, we can talk.

While phrases like these might sound nice on the surface, they are entirely unenforceable. How do you intend to make this happen?

I had to renew my ESTA[1] recently and was somewhat surprised to find that the form is now 6 pages instead of 6 fields, and asks for all sorts of weird stuff like the name, address and phone number of someone on the United States who can verify your identity.

[1] https://esta.cbp.dhs.gov/esta/

What would happen if Twitter or Facebook implemented a "Crossing the Border" mode. When you set it up you get a fake password that logs into a fake version of your account with plausible looking but innocuous content.

Then after some time, perhaps 72 hours this an all traces of it are erased. That ought to last until some new legislation specifically prohibits it.

Before going to the US change your keyboard to Tibetan, change the password and give them your password in dzongkha notation written on a paper form. Make sure it is at least 16 symbols long. འགོ་དང་པ་བཅའ་མར་གཏོགས་དོ་ཡོདཔ།

At which point they may just ask you to type in your password yourself.

At which point they need to provide a tibetan keyboard; unless they'll be able to thoroughly inspect your mobile device that may not have wifi.

The only have instruction to ask for password. They cannot force you to do something. You do not have to give them access to your password manager.

Sure, they can't force you to do something, but they can make your entry dependent on your doing something, as long as you're not a citizen.

But they cannot go against the instruction they have. I.e. they cannot force you to defecate into your pants just to be sure you are not holding USB flash drive there. Same applies here. They can ask for password, but they cannot force you to actually enter it. Its illegal.

give them a stage account?

Reply on news.ycombinator.com