Hacker News Reader

Comment by beedogs | Hacker News Reader

> I don't exactly live in fear of muggings but I take sensible precautions like e.g. backing up my data, making sure that I can turn a factory-new laptop into a working dev environment within a day, and carrying insurance.

Yep. When I visit the US, I bring a freshly-wiped laptop with no personal data on it with me. If I lose it, it doesn't matter.

View on HN

Another way would be to have truecrypt completely encrypt the drive in the laptop and have a colleague set up the password.

Then, when you have arrived, you ask your colleague to send you the password. That way you have security of the laptop data and you can confidently tell any government agency that you do not know the password should they request it.

I hear some companies do it this way. Should the man request the password of the work laptop you brought along? You can just tell em "Take it up with my superior back home"

That is an absolutely terrible idea.

You are asked when you check in if anyone has given you anything to carry for them. You presumably answered "no" to that question, yet now you're saying "Yes, they asked me to carry this unknown data".

They don't care if you know the password or not. They care if the data can be made available in plaintext or not. While you do not know the password you do know the method of making the plaintext available - you get whoever does know the passphrase to enter it. Thus, you're going to be detained until the passphrase turns up, or the machine is going to be confiscated and all data cloned and you're going to be denied entry.

Being denied entry is expensive. It also has consequences for future travel. Visas might be different. Customs clearance will be different. Possibility of getting in is lower.

> You can just tell em "Take it up with my superior back home"

They do this all the time. Watch a couple of hours of any of the various border-crossing / customs control "reality" tv shows. You'll see someone held in a room for hours, questioned for hours, with all their documents being searched for phone numbers and people being called to corroborate the story. They have no problem making phone calls back home and to the destination country.

This method is going out of your way to give them something to detain you for; it is making extra effort to look guilty.

> You are asked when you check in if anyone has given you anything to carry for them. You presumably answered "no" to that question, yet now you're saying "Yes, they asked me to carry this unknown data".

Not necessarily. You could have encrypted the data to your friend's asymmetric keypair. Then you aren't technically carrying any data other than your own.

Clever, but try explaining that to these people. Most barely seem to have a high school diploma, much less understand encryption.

I have a box that I put a lock on, I left the keys to this lock with my friend and he will send it to me when I get to my destination.

why not just actually put your laptop in a lockbox like that?

And then hide your drugs inside the laptop.

Ok, well done. :)

Why would you need to explain anything at all?

"Has anyone given you anything to carry for them?"

No.

That is precisely what I meant when I said that I encrypt my laptop and have someone else choose the password.

Is that "unkown data" as the guy above you seems to believe? Hardly. If I pack my suitcase and then just have a friend come in with a padlock to which only he holds the key and he locks it, are the contents on my suitcase unknown to me? No, they aren't. They are my belongings and I just chose, for security reasons to not only stop carrying the key on me but to not even knowing what that key is.

You could create a hidden partition in your TrueCrypt volume, put some plausible data in the public partition and give them the password for that.

Why bother when you can just download anything you want after you cross customs.

Are we trusting cloud storage now? I would've thought that could be susceptible to official or unofficial attack.

Because I should not have to go out of my way to make a legal activity, LOOK like a legal activity, when it's not even remotely illegal. It's privacy, that's all it is. Lock is to box as encryption is to computer.

We live in a very sad state of affairs that will continue to deteriorate.

> Lock is to box as encryption is to computer.

Um, you realize that you can't carry locked boxes through customs and then refuse to open them, right? That comparison actually hurts the case for taking encrypted data through customs.

Fill it with whatever analogy works for you then, you know what I mean.

The issue is that refusing to let customs inspect your electronics is illegal. This is the broken thing. Encrypting is just a half-assed way to try to get past this (I say half-assed, because it doesn't work). I don't especially care that encrypting doesn't "look legal". I care that customs has the right to inspect the digital contents of my devices. That is a completely pointless invasion of my privacy. It doesn't reduce crime. It doesn't protect the country I'm entering. It's just an exercise of power.

So do I have to create a hidden volume on my computer then?

It's important to remember the destructive nature of Truecrypt's hidden volume function. Unless you use both keys to unlock the volume, opening the outer volume and allowing the OS to load will destroy the hidden volume that has your real files. It's meant to be a last-resort against a "Use this wrench and beat the password out of him" scenario.

I've only used it with a TrueCrypt volume as a file, where it works flawlessly (unless you continue to add files to the public volume). See http://www.truecrypt.org/docs/hidden-volume

You could. You're carrying encrypted data across borders. That shouldn't be anything that raises flags, and we need to campaign to make it normal. (After all, US businesses need to protect the US by stopping US technology and trade secrets and etc from getting into the hands of foreign spies).

But sadly we live in a world where carrying encrypted data is a flag, and will get you more scrutiny, and get your name put on lists.

It also doesn't help if you carry the passphrase on you with your encrypted data.

Why a. go to all that trouble and b. even expose anyone to the knowledge that you have encrypted data?

All this requires is a TrueCrypt file volume uploaded to your favourite cloud storage service. When you've cleared customs go find a Starbucks or something and download it.

Border officials won't have a clue. If they confiscate your laptop, buy a new one.

> Border officials won't have a clue. If they confiscate your laptop, buy a new one.

Is that really your mentality? That's fucked up. If they take away my $3000 work mac I'd be absolutely livid.

Actually I'm travelling soon. What precautions should I take? What can I even do if they take my electronics?

>> What can I even do if they take my electronics?

"Write to your representatives!!" .. nah, I'm kidding. You can't do shit about it. We live in an increasingly totalitarian world, as the article shows. It's fucking insane.

Of course they may employ the rubber glove and wrench treatment to make sure you don't know the password.

What's the rubber glove for?

To blow up and make amusing animal shapes with, while everyone's waiting.

This story is about New Zealand, but I'm sure we agree on which government exerts the pressure that these police state tactics are about to become the new (and apparently accepted) "normal".

I really hate to see the US going down that path, it would have had so much potential to exert positive pressure, to make the World a better place.

That's a really bad idea, especially if you're not a US citizen. If they want to access your computer, they _will_ call your superior back home and might tell him that they will either get the password or deny you entry.

I think they'd just threaten to keep the laptop instead. Once they've taken the laptop from you, presuming that's the only reason they're stopping you, they should no longer have cause to prevent you from continuing.

Why would they threaten that? An encrypted laptop would be useless to them without the password. The worst they could threaten you with is denied entry or detainment, so I think it's far more likely that they would threaten with that to compel you to produce the password.

In any case, if you are worried about protecting your data, you put yourself in a pretty bad situation if you rely on encrypting that data and hide the password. Bringing a relatively clean laptop will just avoid the issue altogether and will allow you to be cooperative with them.

Remember that they don't _need_ any cause to deny you entry or detain you, as long as you're not a US citizen.

> Why would they threaten that?

Because messing with you is equally rewarding as "protecting the country."

That sound the way to ask them to take it away seeing how they are treating companies that encrypt their data(lavabit)

I would be more worried about the TSA accidentally wiping my hard drive when they try to crack the encryption.

Reply on news.ycombinator.com