Hacker News Reader

Comment by misnome | Hacker News Reader

Isn't the counter simple; they ask for your logins to the 1Password vault? I guess this just adds an extra layer of obfuscation.

The most secure way I can think of is to either encrypt your drive (or wipe for travel and online restore once arriving) and physically mail the new password (or hand over to a trusted friend/store location) to the destination. Then there is no way of restoring at the airport.

Of course, then they can just detain you indefinitely for not revealing the password you don't know...

View on HN

They can ask for logins for the vaults they see on your device. But those vaults are the ones you've marked "travel-safe", so you're accepting the risk of these being breached by invasive governmental searches.

However, non-travel-safe vaults a) won't show up on your devices, so they can't ask for what they don't know the existence of, and more importantly b) there is no evidence on the device of "hidden" vaults, or that you're in travel mode, so they doubly don't know the existence of those vaults.

How is the web interface handled? Essentially, where do you turn this on and off? Wouldn't it become standard ptotocol to just demand web credentials for 1Password? This feature is only for subscription based 1Password accounts, so it would seem to me it would just be easiest to delete the app and re-download after crossing?

Demanding web logins rather than local logins for anything is a step beyond the fuzzy legal authority currently given to the TSA.

They already ask for social media account logins.

If you're a resident, they eventually have to let you in. But if you aren't, they can reject you for any reason. This isn't something you can solve with tech. Those of us who are citizens of the US need to vote for politicians who make privacy a priority, and be more politically active in general. I feel like you could even make the play that it's bad for business, because it's impeding business travel. You could even point to this very post as evidence that many companies consider it a Big Deal - the idea that they have to explicitly hide their company secrets in this way because border agents are out of control.

Not CBP though, which is the relevant institution for international border crossings.

web login is likely the same as app login credentials. I don't use 1password, but that's the generate case with LastPass (at least last time i used its mobile app).

So, if they take the actual password, as opposed to having you log in for them, then they can easily go to 1password's web interface.

I'm not sure if there is a legal barrier to taking that step, but there is no real barrier there if the credentials are the same.

Perhaps if there were also travel credentials, that would be useful. With the travel creds there would be no indication that you were in travel mode and no access to additional data.

There is an additional key/identifier that you don’t have to carry with you that would prevent them from logging in even if you had to give them your vault password.

One option is to lock out the passwords for some amount of time, or to do geolocation.

Both can be defeated (they can detain you at the airport for a whole day, or they can spoof GPS) but neither of these mechanisms holds up to mass surveillance: you can't detain everyone who goes through the airport, or even all people with 1Password, for a day, nor can you spoof GPS at the security checkpoint because it'll probably leak to airplanes. You have to pick individual travellers and put them in a Faraday cage with a Stingray and an internet connection.

I'm not sure what the threat model really is, but it's possible that this will require enough time and resources to disincentivize asking for even more passwords when there's not a very specific suspicion, which might be good enough.

There are competing reports, but the maximum detention time for US citizens crossing the US border is about four hours.

If you are a foreign citizen, you are looking at about twenty four hours, and then refusal of admittance.

This information is the case for keeping a cheap back up device(s).

I thought that, according to the NDAA Obama signed, that the military can detain Americans indefinitely without reason.

"Then there is no way of restoring at the airport."

IIRC, the border agent has the power to turn you back, visa or no visa. So there might be a price to pay for getting too cute. They want what they want and trying to avoid that might make them angrier.

If you are a US citizen they can make you wait in a room for a few hours and maybe add your name to the "make his life miserable every time he flies" list.

,,even if you’re asked to unlock 1Password by someone at the border, there’s no way for them to tell that Travel Mode is even enabled.''

It looks similar to hidden partition in TrueCrypt

Any subscription-based 1Password can be accessed from the web. Couldn't they just demand those credentials?

Only if you know them. I don't know about you, but I don't have my long random account key memorized (only my master password). You can't log into the website without that account key.

Of course, you do need to be able to log in to turn travel mode back on, so if I were to use this I'd probably do something like set up a service to securely send me my account key after I'm expected to have finished crossing the border, or maybe just store it on a remote server that I have access to under the expectation that the TSA can't demand that I SSH into a remote server (especially one they don't even know about). Though if I'm traveling alone (instead of with my wife) I'd probably just call her and ask her to turn travel mode off for me.

That's a great solution if you're a US citizen and want to enjoy showing off to a border guard before being guaranteed entry, but for migrants (who are most affected by this), this kind of 'gotcha' logic would likely be considered insubordinate grandstanding, and get them denied entry.

> this kind of 'gotcha' logic would likely be considered insubordinate grandstanding

I'm not sure what you mean. I don't think it's unreasonable for anyone, migrants included, to tell CBP "I don't feel safe traveling with sensitive data, so I don't have any of that data on my computer". What's the 'gotcha' here? CBP isn't the only reason to want to have Travel Mode, there's also the increased risk of having your laptop stolen or misplaced.

In your original post, I took

> Only if you know them. ... You can't log into the website without that account key.

To mean that you'd openly have access to information in front of the guard, and then let them know that you can't access it at this time because of your elaborate scheme (e.g. tell them that it exists, but that they can't have it).

That's quite different to just not travelling with the data (or evidence of it existing) at all.

> CBP isn't the only reason to want to have Travel Mode

No, but it's the only 'reason' that's likely to use serious, life-altering coercion to make you to disable it, if they detect that it exists. It may be better to have no data that suggests capabilities, than openly posses partially disabled capabilities.

There's no way for a border agent to tell if you're refusing to disable travel mode because you won't or you can't (and little reason for them to care).

Of course it's not unreasonable, but 'reasonable' is not the relevant criterion here.

Yes, it does. And you provide them to the password for the local vault. Since you activated travel mode, they'll be able to see your "travel safe" passwords, but no indication that there are other passwords that were recently removed from the vault, and no indication that you entered travel mode.

> physically mail the new password

Nobody will ever do this.

Just travel with a dedicated traveling phone and have your main phone mailed to your destination.

Reply on news.ycombinator.com