Hacker News Reader

If you're not a citizen, I think this is probably pretty simple: don't carry anything across the border that you would be uncomfortable being forced to unlock. There's nothing you can encrypt with a passphrase that is protected from a border search, unless you're comfortable being sent back home, losing your computer hardware, and not being allowed back to the US at least until the next Presidential administration, probably 10 years, and possibly forever.

The only point I really want to make:

It is a very bad plan to attempt to outsmart CBP with clever encryption strategies. If you want to protect something, don't bring it to a border crossing. CBP's budget is tens of billions of dollars, and they don't have to break your encryption; they just have to fuck up your entry into the country. The math doesn't work out here for nerds.

Say you bring no electronic hardware. Could they make you login to your social media accounts from one of their computers?

Yes, they can.

This is unclear. They can ASK, but as far as I know it's unsettled territory whether this is refusable.You can definitely refuse it as a USC and I would bet, as an LPR. Gets trickier when on any other visa as then your entry is essentially all "discretion"

The problem is that it's pretty much CBP's discretion whether you --- a non-citizen --- are being responsive. There aren't statutes for this stuff.

Any speculation as to what might happen in that situation if your password is non-trivial and not with you?

What about 2-factor? Should i just disable it?

Right. Since they may ask for social media passwords, would that imply making a travel profile for my travel devices that has password access to things like Facebook and a subset of sites I'd need, but not necessarily all 400+ of my logins?

I don't care if they login to my Facebook (well, I think I don't). I just don't want to have them have everything, because then I'd have to change it all.

To be very clear, not planning to use any encryption strategies. And as you mentioned, being unable to access Facebook is not a sensible option. My question is about what to bring, not how to secure it.

It doesn't matter what you have in your password manager. If you're not a US citizen, they can demand your facebook access. If you don't have it, can't unencrypt it, or just feel like telling them to fuck off doesn't matter. You have no legal right to enter the country except with their permission, and they may well tell the person who didn't put their facebook passwords in the password manager to get back on a plane and go home.

US citizens have it better in at least that one regard. They can't keep me from entering the country. They can confiscate my laptop, but if I don't want to give them facebook access, there's not much they can do to stop me. They can of course add me to some list that makes my life miserable every time I fly, but there's no constitutional provision that allows preventing a citizen from entering the country.

So basically, as a non-US citizen, if you don't bring a device that can log into your Facebook account, they might deny you entry? Of course rhey might deny you entry for any reason, and them caring so much about your social media accounts is probably a sign you're on a shitlist somewhere, so maybe it doesn't matter so much.

I wonder, though, if you don't have FB etc. accounts, do they believe you?

I think the only way to interpret this that's even remotely practical to implement is that while they have the right to ask anything of anyone, in practice, it will likely be targeted. If they're asking, they probably already know quite a bit about you, including whether they think you match some social media profile they've red-flagged.

I'm certainly not suggesting that Trump isn't stupid enough to think having CBP attempting to guess whether 800,000 grandmothers every hour are lying about not knowing what Facebook is would be a plan he could seamlessly roll out, but I think any such plan would crater pretty spectacularly.

There's a big factor of subjective evaluation, but it can be quite effective.

A large majority of people do have FB accounts, and even care about their FB accounts as illustrated by their worries about providing access to them.

For most people they wouldn't bother to look, only a tiny fraction of travelers get their devices checked. And if you really don't have FB etc. accounts, they may believe you - I have little reason to doubt that; I feel that if that was their policy then we'd hear about many such cases.

However, if you claim that you don't have a FB account and their automated system (seeded by the information submitted by the airline before your arrival) shows a FB account with your face, then that seems a sure way to get turned back at a border.

So, basically there probably going to be honest people where they would tell the truth, that they don't use thefcnkfacebook but because some scammer has created a fake profile of them would be turned back at the border. Amazing brave new world we live in...

> shows a FB account with your face

Which, amusingly, is a Facebook spammer strategy — clone someone's account, including profile picture. So even if you delete your account, there may be a spammer clone that shows up in CBP's database.

Why is this being accepted as even remotely reasonable? What about 'login with Facebook' sites?

We here know that we should change our password and logout of existing sessions ASAP after being made to do it, but our non-technical family members may not.

"Add TSA as a friend" is borderline reasonable, (pun intended) "give us your password" is not even close.

It also damages public awareness of importance of maintaining secure and private passwords more generally.

> Why is this being accepted as even remotely reasonable?

That it's unreasonable and unacceptable doesn't mean that it's illegal. Despite your and my hopes, not all unreasonable and unacceptable things are illegal.

> What about 'login with Facebook' sites?

Don't do that then.

> We here know that we should change our password and logout of existing sessions ASAP after being made to do it, but our non-technical family members may not.

If you've given access to your account to someone else, you've already lost, whether you log out quickly afterwards or not.

Don't put yourself in a position in which you must log into an account you care about.

You're missing my point entirely:

People do 'login with Facebook'; people will (perhaps grudgingly) log in for them/hand over their password.

You won't, I won't, but people will because they're asked to by the uniformed officer, despite how mad it is.

I'm just amazed at the lack of significant opposition to this, there doesn't even really seem to be any opposition. Here on HN where one might expect it to be most opposed, we're merely discussing how to mitigate the effects (you can't, don't go - or be prepared to be turned around).

I wouldn't pay for my own travel to the USA (while I've been before, and enjoyed my trips, etc.) because I'm not an idiot - and handing over a password is idiotic - and I can't really afford a wasted trip. Sure, sunk cost, whatever - the cost/risk isn't worth it, at least for now until it's shown that they rarely do it, and really it's only x,y,z countries from where I do not hail.

> I'm just amazed at the lack of significant opposition to this

I'm amazed at all the many ways people will give up their rights, and yet folks continue to advocate for their rights to be taken away.

> Here on HN where one might expect it to be most opposed, we're merely discussing how to mitigate the effects (you can't, don't go - or be prepared to be turned around).

I can't change the law, but I can change my behaviour.

> I wouldn't pay for my own travel to the USA (while I've been before, and enjoyed my trips, etc.) because I'm not an idiot - and handing over a password is idiotic - and I can't really afford a wasted trip. Sure, sunk cost, whatever - the cost/risk isn't worth it, at least for now until it's shown that they rarely do it, and really it's only x,y,z countries from where I do not hail.

a) they rarely do it (roughly 4,500 times last year, IIRC)

b) any country might do it, and many do; this is not a U.S.-only thing

> they rarely do it (roughly 4,500 times last year, IIRC)

My mistake, I hadn't heard of this until recently (and clearly didn't read the article properly) and assumed it was a new policy under Trump.

At a rate of around 0.0012%, and assuming it's more targeted than random, my actual chance of being asked is much lower, yes sure, that probably is worth the risk of being turned around.

> My mistake, I hadn't heard of this until recently (and clearly didn't read the article properly) and assumed it was a new policy under Trump.

The really great thing about having a Republican (even if only technically) president is that the news media suddenly rediscover the virtues of small government, and the dangers of an unbalanced power structure (a similar phenomenon holds with Democratic presidents & conservatives). It'd be awesome if people would just be principled, but apparently that is too much to ask.

> At a rate of around 0.0012%, and assuming it's more targeted than random, my actual chance of being asked is much lower, yes sure, that probably is worth the risk of being turned around.

Yes, but I just carry a clean device with no access to my accounts. I can honestly and without deception say that I cannot do what is asked.

> I can honestly and without deception say that I cannot do what is asked.

The general consensus seems to be that you'll be turned around.

Login with gmail/Facebook isn't that awful. They won't get your login credentials and you don't have to set a password. It's kind of like having a super fast "verification email" every time you log in.

Yes, but my point is that a user who has handed over Facebook access has with it handed over 'login with Facebook' access.

What do you think would happen if you don't have facebook?

> If you're not a citizen, I think this is probably pretty simple: don't carry anything across the border that you would be uncomfortable being forced to unlock.

I think this applies whether or not you are a citizen, whether or not you entering the U.S. or another state, and frankly whether we're talking about electronic data or not. If you don't want it searched, examined or confiscated, don't enter a nation state with it!

> It is a very bad plan to attempt to outsmart CBP with clever encryption strategies. If you want to protect something, don't bring it to a border crossing.

Excellent advice. You can't outsmart customs with clever encryption strategies.

But if they can force you unlock your Facebook, can't they force you unlock your Gmail, AWS, Salesforce, internal company archive or some actually classified missile bunker?

If you know something they want to know and they decide to make you reveal it, then you have the choice of going back home or revealing it. Entering the USA is not a right unless you are a citizen.

But you're much more vulnerable if you bring data with you. The first level of protection is making a backup, formatting your devices as new, and restoring once you're on US soil. Better yet is not bringing devices at all. But certainly don't bring secrets with you: bank records, medical records, and military secrets should never be carried with you through customs.

If you're a non-citizen and you choose to go back home, you're probably also choosing not to be admitted back into the US for a long stretch of time, at least without a struggle.

This depends on the particulars of what happened, and it's going to be difficult for most non-experts to navigate, in the same fashion as "determine whether this code is Python or Ruby" is difficult if you've never seen a command line.

Say you're talking to your friendly neighborhood CBP officer and they say this:

"I think you're an immigration risk and, accordingly, I'm issuing an Order for Expedited Removal. You get on the next plane back home." Your passport gets tagged with a 5 year timeout.

However, they could say something like:

"I think you're not eligible for the Visa Waiver Program, because some factors suggest you're an immigration risk. I recommend you withdraw your application for entry into the United States and voluntarily get on the next plane back home." You will not get timed out for 5 years.

Note that the second one is neither a recommendation nor a request.

Disclaimer: IANAL but IA someone who has to have an anomalously-good-for-most-Americans understanding of immigration procedure.

Yes, it's a small but real risk foreigners should consider every time they chose to cross the US border.

It's no small risk. It's forcing you to whistleblow with no protection. Forcing you to do something, that they kill their own citizens for.

> not being allowed back to the US

And potentially any other country that has the "have you been denied access to any country for any reason" rider on its immigration questionaires.

What does the searching of devices at the border have to do with presidential administrations? This policy has been in place for years (from the article).

> But then this raises a further issue: do I keep social media passwords on that list, or leave them off? If I kept them off, I could honestly say "I can't login. I didn't want distracting social media on a business trip".

To go a step further, what if you don't even have a Facebook account? How do you even prove that, if there are other accounts with the same name as you that show up when searching (and the profile picture is not sufficient to rule it out)?

> I'm not sure of the risks of having CBP log into Facebook.

There's a non-zero chance you're going to be detained and grilled if any of your friends have talked about terrorism, drugs, have criminal records, or are on or share a name with someone on a terrorist watch list (and that may extend to their friends or further).

They could also potentially take a copy of your friends list, posts or any other content and do who knows what with it at some point in the future.

I use syncthing.

Mostly for syncing all my music and pictures between phone / laptop and home server.

For your use case, there is a solution with the caveat that your password manager is unavailable on the flight. Simply have a dumb phone on entry with Syncthing and your Password manager installed but no password file. Once you have been allowed entry into the despotic regime's lands, connect to a starbucks wifi, initiate syncthing and it will pull your password file from your home server / computer etc.

If you update your password file, it will be synced back to your home server. When you travel again, disable syncthing, delete your password manager.

Or use an ssh script to pull it from your home server.

Could you just bring a device with freshly installed Windows / OSX, and clone the whole disk image over the internet once you're inside U.S. ?

Well, yes. But as tptacek said:

"But non-citizens, possibly including LPRs, cannot: if an alien attempts to cross the border with a device they can't unlock "because they don't have the corresponding 2FA token with them" (as one friend suggested they do), they'll be detained, their devices confiscated, and then put on a flight out of the country."

I'm not a US citizen. I don't have anything in particular I care about the CBP seeing. But, I'd rather they not have all of my 400 passwords. I'd then have to change everything, and also be breaking a bunch of bank terms of service.

I don't think CBP actually wants my bank info. But with all passwords in a manager, they would get it if they had access. However, with no passwords, they may bar entry.

I'm traveling overseas this summer, and I don't plan on having my 1Password database handy when I reenter the country.

So you will be a position of "can't login to that site". How does that square with:

"if an alien attempts to cross the border with a device they can't unlock "because they don't have the corresponding 2FA token with them" (as one friend suggested they do), they'll be detained, their devices confiscated, and then put on a flight out of the country."

I guess they haven't yet started asking for social media passwords, so maybe I'm overthinking this. I'm certainly going to be prepared to unlock any devices. It's the web passwords I'm not sure what to do with.

Well, in tptacek's case, I believe he's a US citizen so they can't deny him entry.

Hmm. What would be the best practice for a foreign national?

> What would be the best practice for a foreign national?

Understand that you may be denied entry to any country but your own. It's a fact of life which you cannot do anything about, so you might as well accept it.

What I do is:

- travel with a machine which is not logged into any of my accounts

- if asked, I can honestly say that I do not know any of my social-media passwords (because they are all of the form mZOH05WaxeAWqI79myMxcx or SWwDmDOkyHCVdX8eOiTLXC1U1psffeXfFgNx6PaZZhp); if that's unacceptable to customs in any country, they can send me back home

- if they press, I can honestly say that my computer back home (not the computer I have with me) has my master password file, and that there is no other copy

None of us know. It's a real problem.

If your password manager doesn't encrypt it's own files on disk, then you're using the wrong password manager.

I'm operating on the assumption they'll ask for the password to that too. That's where the social media passwords are.

Encrypt your password store using gpg and zx2c4's pass! The GUI app qtpass even works on Windows. I've been using it for months and the system is rock solid and has never let me down.

https://www.passwordstore.org/

They can copy your drive all you want, and you have until 2030 to change your passwords.

Alternatively, just store them in a git repo on a server somewhere and access them remotely.