Hacker News Reader

Comment by pkulak | Hacker News Reader

I think it's enough to shut down you phone. Then it needs a pin, and you're entitled to not give that over, I believe. So you should be safe, apart from some kind of rubber-hose cryptanalysis.

View on HN

> So you should be safe, apart from some kind of rubber-hose cryptanalysis.

There are vendors that sell the technology to adversarially access phone data, the "Before First Unlock" is the safest state a phone can be, but it's not infallible. The safest option is to have a burner or factory-reset phone with nothing on it, even if the hack succeeds.

I've worked with Cellebrite, the industry standard in IT forensics for unlocking and imaging phones. It just runs a series of known exploits. PIN lock, data encryption and regular updates will beat it most of the time.

> I've worked with Cellebrite

Any chance you want to do a public service and publish the latest compatibility matrix?

Just joking, obviously…

When I interact with the general public, I get a nice reminder that most people don't do a decent PIN lock, don't have encryption on unless it's the default for that platform, and don't do regular updates. Lots of reasons why (phone is out of space to do an update; not signed in properly to Apple / Google account; kids use their phone so they want an easy to remember PIN on it, etc. etc.)

Before First Unlock with recent hardware and an up to date OS is probably sufficiently infallible for an average person. I wouldn't want to rely on it if I was engaged in espionage, but for someone who won't get the NSA pulled into the case, I'd be pretty confident. This leaked Cellebrite support matrix shows that BFU was secure against them for iPhones that were nearly four years old at the time, and I doubt it's become significantly worse since then: https://ia800405.us.archive.org/32/items/inseyets-offline-uf...

If you don't give a pin, they can seize your devices (Andrew Tate on his 1st visit to Florida said that he refused to give pin and they seized phone and laptop)

They can't keep them, you'll get the devices back. Use a temp phone in the mean time.

Sad that we have to accept this as a risk of international travel, but here we are.

They can absolutely keep them. Or they can just "lose" them "accidentally". Who exactly would force them to give them back? Or put another way, who exactly will punish them if they break the law?

They can’t keep them permanently, but unfortunately they have in the past kept them from some people for years, until the hardware was past its useful life. It’s a good idea to only travel with electronics you don’t mind losing (and not just because of this).

You have a worldview that’s incompatible with the reality of the current US legal system where things work the way you believe they should, rather than the way they actually do.

Morality and direct commonsense interpretations of law do not apply when there are literally unlimited resources stacked against you. But, assuming you can wait the potential ~10y to receive your device back that it will take to get your device returned to you, good on you. If you think that the current SCOTUS will rule in your favor, good on you.

The reality is, we live in a time where the most horrendous interpretation of the law is the one that will happen. And it won’t be in your favor.

I don’t see how what you said contradicts anything I said, and I suspect you didn’t even read it. Yes, people have before had their devices seized for years, and courts wouldn’t return it sooner. That’s literally what I said.

I must have replied to the wrong comment. I swear I read something else. But maybe not.

My bad.

No problem, I have also misread a comment or two before, although I’ve been lucky and had time to delete my reply before the deadline.

I think you're arguing with someone who agrees with you.

Honestly, I think this is still fine for most people. The probability of a border agent asking me to unlock my phone is very, very low. The inconvenience of using a burner phone is high.

If they do take my phone (completely shut down, unlikely they'll be able to break in) and it's gone forever, that sucks, but then I get a new phone, restore from a backup, and move on with my life. Given that the probability of getting to this point is very low, I'm comfortable with the risk.

But sure, if I was at high risk of being detained at the border due to my profession, country of origin, ethnicity, etc., I'd probably look at this differently.

It's not sad, it's always been the case, and just expanding areas that are implementing it. It seems a lot of people here haven't travelled, or especially haven't travelled to 'restrictive' places in the past.

I've been to Russia, China (about ten times,) central Asian -stans, various parts of South America, Africa, etc. My phones and laptops (plural because I travel with >2/ea, and it looks kind of weird,) have never been inspected.

I really only hear these stories when people travel to the US, lol. It's especially sad+funny (darkly comic, say,) that the guy in OP is a US Citizen traveling back to the US.

They’ll keep them until you sue. A lawsuit costs more than the devices.

You will lose them.

I'll take that risk. It's pretty unlikely, and if it happens, having to buy a new phone is not the worst thing in the world.

That seems like a wildly different scenario to me. The OP is about a guy who has not committed any crimes. Andrew Tate is a known predator and CSAM peddler, with an active warrant in several countries.

With Graphene that's to be considered reasonably safe if your PIN is unguessable. The wrong PIN delay is enforced by TPM and they don't (yet) have anything other than brute force.

> Then it needs a pin

A compromise to this is that many phones have a "lockdown" mode, where it isn't fully off but refuses to accept biometrics until a code/pattern is used to bring it to a more day-to-day mode.

It's less-secure than being fully off, but it also means if you do need to access your phone you can do so more-quickly.

Just reboot it. The disk is encrypted until you unlock it.

That’s probably why they’ve been pushing the MPC app heavily.

Only a matter of time until mandatory key disclosure like the UK and other countries. This overrides even the right to silence.

If you’re a U.S. citizen: CBP cannot deny you entry to the United States merely because you refuse to unlock the phone. If you’re a non-citizen seeking admission: refusal is much riskier.

The important wrinkle is that CBP’s published policy expressly guarantees that a person being admitted as a U.S. citizen won’t be denied entry solely because CBP couldn’t inspect the device. It doesn’t give lawful permanent resident (green card holders) that same explicit statement. Instead, it says refusal by a “foreign national” can be considered in an admissibility determination.

Isn't the guarantee for citizens a bit stronger than CBP's policy? I don't think they can lawfully deny entry of a citizen, period.

They cannot (lawfully) deny entry. But they can admit you and then immediately detain and/or arrest you.

Sure, if they have a warrant or probable cause, just like any other law enforcement officer.

In theory, yes, but in practice they can do whatever they want, and suing them after the fact is going to be expensive, and have a high probability of not working out for you.

When interacting with border officials (or any LEOs, for that matter), be polite, don't get hostile or aggressive, but also be firm and don't volunteer any information that you're not required to give.

Not unlocking your phone is probable cause. Non-criminals readily submit for inspection. (We can fix this by refusing inspection even when we are not criminals)

this only applies if they don't refuse to acknowledge your papers as valid and/or they haven't previously put you on some hidden list of people of interest, in which case the instance where you get to prove you're who you say you are will be mediated, like the rest of the (as per the current system) nonpeople, by as many layers of humilliation and risk to your life and health as they can place.

Reply on news.ycombinator.com