Hacker News Reader

Comment by confounded | Hacker News Reader

There needs to be some reasonable way to get your digital life into an E2E encrypted cloud, wipe your devices, fly into the police state you call home, and get setup again when you land. You can promise at the border that your head doesn't contain anything either.

I get very worried about traveling with an object as alien and shiny as a Yubikey. I don't know how I'd explain it to an aneurism in a Kevlar vest without triggering them with words like "encryption".

View on HN

> wipe your devices

But then you risk:

> They said, ‘Next time you come through, don’t have a cleared phone,’

That and the bit about the bill that would increase CBP's power to detain and strip search Canadians entering the US were the two most troubling things in the article, IMO.

Why Canadians?

It's the pre-screen areas are inside Canadian airports, on Canadian lands. Anything the us border cops can do there, they do so with the permission of the Canadian government.

Which really, should be whatever they need to do. The twist being at any point you should say "No, I'm staying in Canada" and they should say okay bye.

I think that happened in the article.

In some Canadian airports, there's "pre-clearance", where you go through American customs while still on Canadian soil. Right now, they can't hold you, because you're in Canada -- so if they aren't going to let you in, you can just leave, back into Canada.

There was a recent (Canadian) bill that gives US customs the ability to hold and search in pre-clearance, in Canada.

If the alternative is just to go back to Canada, why would they want to hold you anyway?

Let's say during the search they find a conspiracy to commit a crime in the US. They want to hold you, extradite you to the US, and throw you in jail.

Wait. In that case, wouldn't the crime (conspiracy) have taken place in Canada? There should be no extradition, then.

Quite. Once you have such an E2E encrypted cloud, the next step is to simply not bring your device over the border, but rather buy/rent one in the country you arrived in and load your stuff on that one. The only problem is finding hardware you can sort of trust.

My phone almost always costs around a thousand dollars, roughly the amount the guy persecuted by the CBP was complaining about losing on flights.

It's also instrumental for getting me from the airport I land at to my hotel, as well as remembering the name and address of the hotel I need to travel to from the airport.

I would do what you suggest but a) the Apple store isn't always open when I land, and b) I have no way of summoning a non-taxi to get there (or to where I am sleeping).

And besides, it still wouldn't help. They could hand you a device and tell you to log into your social media accounts. If you say you don't have the passwords because of whatever technical measures you cooked up to make them temporarily inaccessible, you're back to, "Don't do that next time. You're not entering today."

They have to let US citizens in, provided you've proven citizenship.

I'd be interested in their response to this technical measure: they're written down in a book on my desk at home.

They would probably tell younto bring them next time.

What if you don't have social media accounts?

Reports like this tend to trigger a Google search for my own name and correspondence with all sites that show up, "please delete all my shit".

Finally deleted my Facebook account last week, too.

Maybe we need a religion that forbids using social media, or more broadly, your real identity online?

> Maybe we need a religion that forbids using social media, or more broadly, your real identity online?

Good idea. You'll get bonus social points for being a persecuted religious minority when you're turned away and it's publicized.

When you start considering renting a device to evade surveillance, you've come full circle. Are you going to pry that thing open for bugs? Not if your deposit depends on it

If there is nothing more suspicious than a cleared device, the next step in the privacy arms race is to automate the generation of an innocuous but prolific history for cleared devices and find a way to link that history with decoy accounts, preferably accounts that have existed for a while and that have been created solely for that purpose.

Scripts could be written to populate a system with an inoffensive browser history and file usage that reflects light-moderate casual use, the only issue is making any attempts at spoofing appear congruent, believable and not anachronistic with whatever dummy accounts you present.

It's extreme and absurd, yes, but preferable to have them snooping in on your actual life. I suspect crossing the border in the future will be on the same level of 'invasive' as a personal audit.

Encrypt the disk passwords to your lawyer's PGP key. Give them your lawyer's business card if they ask about it.

Or don't bring your devices with you.

Then they can just refuse entry, like they did to him after he tried to enter after deleting the apps.

> You can promise at the border that your head doesn't contain anything either.

That would look like a clumsy "I'm just like you" attempt at building personal rapport.

It's funny, but I don't think it does much good to think of somebody as dumb. If you or I were actually them, we would be doing the same job. Everyone is getting swept up and used by processes that are too big for them to see.

I can't speak for you the way you think you can speak for me, but I wouldn't be one of them.

Sorry, I didn't mean for it to sound as if I was speaking for you. What I meant was, if you were actually them, you would be doing the same things they are. Maybe this seems tautological, but I think it's an insight that helps one to be compassionate.

If my current mind were to be downloaded somehow into the other guy's body, would I be a border patrol agent? No! But that weird hybrid person never existed and never will. If I had been born as he did, and had the same brain, and gone through the same experiences (in other words, if I were actually him), I would be doing exactly the same things.

This realization that people are doing the best they can (usually very unskillfully) can help us be compassionate toward them.

Encrypt a blob of your stuff (using a key derived only from a memorizable password), stick it anywhere, then download after passing through the border.

I don't think they have grounds to seize wiped/empty devices from US citizens, but who knows.

Sadly, yubikeys don't work everywhere and can't store more than a couple traditional-style passwords last I checked.

Reply on news.ycombinator.com