Hacker News Reader

Comment by M_Grey | Hacker News Reader

Solution: No Facebook (which is a solution to so many other problems too), partition and hide what you don't want browsed by some inept CBP agent, and then play your part in their security theatre. It might even be nice if someone could make some programs that offer false home screens for various devices that only open when a given password is input... your CBP "clean slate".

Don't say, "I don't have x,y,z..." accounts... have them, have accounts you never use and hand them over. Have your real identity online not be publically linked to your real identity for the purposes of something as trivial as social media.

View on HN

It is probably a bad idea to try to fool a federal agent with "false home screens"... but I upvoted nonetheless because of the "No Facebook" part.

A feature I really would want to see from social media is read-only, time limited passwords. You provide this to a 3rd party and they can see everything you do, but change nothing. Upon first activation, you grant 72hrs access and don't have to remember to change the password again. If this activation does not happen within 15 days of first activation, the password is invalidated.

Acknowledging that this is a valid use case has many benefits. Social media provider can check if the password is used from government or corporate IP addresses and block non legitimate access (like, a rouge CBP employee stealing credentials and stalking individuals from his home computer). It would also be possible to keep logs of which information was accessed/consulted by each one time password, which can be used during investigations if some form or another of abuse is reported, etc.

The words "inept CBP agent" get you in trouble here. If you're a citizen, by all means, play chicken! If not: remember, they have vastly more resources than you do. Money buys a lot of forensics techniques --- in fact, governments are better at computer forensics than software developers. They're the ones doing it all the time, and funding all the research.

They don't have to decrypt. They just have to decide you're suspicious enough to confiscate equipment and bar you from entry.

> They just have to decide you're suspicious enough to confiscate equipment and bar you from entry.

That's fine with me. I don't take anything to a foreign country which I'm not willing to lose, and I have no problem turning around & heading back home if the country I wish to visit turns out to have unacceptable rules.

If someday I visit someplace that has an implicit rule, 'all visitors must have Facebook accounts,' then I'll just go back home.

Hold on, once again, because you're oversimplifying the situation here. You might be comfortable being turned back at the US border, but there are plenty of people who aren't in that situation --- they're children, or are coming to take care of their children, &c --- and being turned back at the border can mean it's very difficult to return to the country under any circumstances for years afterwards.

I think you're looking for an argument, but I'm not. It's always been possible for a country to turn a visitor away (talk to folks who've been to Israel and try to travel to an Arab country …), and that does have consequences which one must be prepared for.

I'm certainly not going to claim that 'all your password are belong to us!' is a good or desirable policy, but I am going to claim that anyone who travels between countries must be prepared to deal with the local regime, no matter how ill-conceived its rules may be.

One of the pieces of important advice I am planning on passing on to my children is: Never have children with someone who has citizenship of a country that you don't.

Given that border agents may go as far as cloning hard drive contents, what advantage does an additional partition have? A thorough search may uncover the hidden/encrypted partition, which then becomes another item for which you'd be requested to provide "technical assistance."

They aren't going to inspect the HD partitions at the border. They clone for a later time - at which point, you'd already be admitted and are not obliged to assist them.

"Have your real identity online not be publically linked to your real identity" is actually not so simple, as it requires cooperation of everyone you know. Would your mom, spouse or boss have your "account that you never use" in their social network contacts or your real online identity?

All kinds of advertising companies and spammers have such information obtained from people who share their contact list with some free app, providing a permanent link between your real name (which they entered in their contact list), your real phone number, and various online accounts. Would you be so sure that the gov't agents don't have it? IIRC there were some cases where some agencies simply bought such data from advertising info aggregators.

It's not about keeping secrets at that level, and frankly I'm a lot less sure about my ability to evade advertisers than the CBP. Advertisers are hooked into everything, as therefore so are aggregators. That said, the aggregators and advertisers can be blocked, ignored, and spoofed. Even if you don't, they don't get physical access to your devices, they don't get to clone your HDD and keep a copy!

By contrast, the CBP doesn't have the profit motive or apparatus to keep a "file" on each of us and match that file on the fly with our testimony at the border. You don't need to fool them in some grand way, just the digital equivalent of a false bottom with a safe hidden underneath. Beyond that, share some basic crap and explain you're not that into social media, but share what you have.

They're not going to be shocked that some people have little presence, what's going to get them interested is refusing to unlock something or conveniently forgetting passwords.

Reply on news.ycombinator.com