I read the article on "The Signal Chats That Cost OpenAI Researchers Their Jobs" [0] and the (former) employees were asked for their phone password.
Accessing Signal, OpenAI discovered (the absence of) disappearing messages to an external researcher.
So, if an application is password protected either by the OS or another app which demands a password to launch another app, would the official just ask for the application's launch password, or is that beyond whatever overly generous powers granted to them? Perhaps this is rhetorical, because what we called laws are merely ignored these days.
Laws for which there is no charge, no prosecution, and no consequence (I can give 34 examples) are merely suggestions.
Isn't this just giving in if your only reasonable backup location is a US cloud that regularly has to negotiate with the US federal government. The only difference I see is that they have to resort to parallel construction.
> Isn't this just giving in if your only reasonable backup location is a US cloud
my backups are not in a US Cloud.
Contacts and calendar on self hosted carddav
Pictures and files on self hosted drive.
Deltachat on mail servers (non us hosted provider) and XMPP conversation backups.
I don't backup whatsapp automatically, only do manual exports once in a while of important conversations that get copied to my self hosted server. Whatsapp pictures and vids are automatically synched with syncthing.
I host encrypted backups for another tech savy relative on a server of mine and in exchange he also host space for me on his own local backup server. We are 2000km appart so it allows us to keep a safe backup in remote location in case of fire or natural disaster without relying on the cloud.
Only thing I have missing is an automatic backup test of random files to compare checksums. I have done test backups manually but last was a bit more than a year ago so it is time to run a new one and add this automation as well.
That's quite an approach, thanks for sharing. I still don't think it mitigates restoring within the US since they claim to have search rights within 100 miles of any international airport. Personally, I try not to fall into the trap of believing I need retention of data that doesn't fall into a few categories, most of which I would assume I will already be sharing with authorities through taxes, etc.
CBP believes it has the right to files saved locally on your device itself. However explicitly cloud-hosted data (that is not stored on the device) is supposed to be off-limits, as I understand it.
And keep in mind that American citizens cannot be denied entry to the country for refusing to unlock or hand over their devices. They might hold you for a little while, but they cannot stop you.
People are getting arrested for all sorts of excuses. The Cop City protestor with the GrapheneOS phone was detained for "a routine search for child porn" - not something they routinely search for, and some people think they were going to plant some if they could get into the phone.
They have also arrested citizens simply for driving in their own car proximate to an ICE kidnapping. But if we preemptively act like we have no rights then they've already won.
I haven't entered the U.S. in some years now and I don't plan to any more. Unlike going to any other country, it just feels icky to go there and dehumanizing to go through any airport in the U.S.
It's rather sad too because I like lots of places there and there's lots of cool stuff but with what's happening, I'm making an active effort to avoid it.
I remember seeing a "Lonely Planet Guide to the USSR" book in a CouchSurfing host's shelf. A section about passing through the border mentions the possible interrogation and checks of your belongings...
I'm sorry to be nitpicking like this, because I absolutely empathise with what you wanted to say. However, if you really think the US is the only country that does this, you haven't been paying attention.
I'm always eager to learn. Which ones? I mean aside from maybe the really dangerous ones. Because I've traveled a bit, to different countries over the years and I've never encountered crossing a border in the same league as the United States.
Not saying that they don't exist - but I just haven't encountered it.
You can already do this with built in android features, on any phone. It only works against cursory examination and not against your phone being plugged in to forensic devices.
GrapheneOS has repeatedly turned down this idea because it gives a wider area of attack (signed in vs in a locked state) and would be easily detectable.
Unfortunately non-citizens probably don't have this luxury, but before entering certain countries - including returning to the USA as a citizen from a recent trip abroad, I wipe and do a fresh OS reinstall (simple new password not used anywhere else, zero user data, no email or chat or cloud accounts configured).
Right before the wipe I update my cloud backups of course, and if I've been doing a lot of work I use Carbon Copy Cloner to an SSD encrypted APFS volume and use DHL to ship the SSD to someone I can retrieve it from once home. I also have finally started traveling with a second phone (a cheap Consumer Cellular backup flip phone with only a few family in the address book).
"Password, please" - "sure, no problem: Travel1234 with a capital T."*
Restoring the devices is a bit of a pain, but is faster and easier with the SSD assuming it arrives.
But them's the times we're living in.
* I suppose if it they ever ask and login, CBP will ask "Why doesn't your device have any user data? This is suspicious." I might tell them about the time an Israeli border dude took my computer into a back room for an hour and by the time I got home someone in Israel had stolen and sold one of my better domain names. Or might just shrug and say "Citizen".
I am a little curious in that scenario (thoroughly wiped device, comply with password request) if they still impound the wiped device (after they presumably connect it to whatever digital-strip-search gadget they hide in the back room and it comes back clean).
Yeah I don't plan on visiting the US any time soon. Even before the current shift in vibe the US border was unpleasant - as if the agents had confused being hostile with being effective
The US is the one that makes it into the news the most often, but I bet if you search just about any country's name and the same subject you will get the same stories. The UK for example has plenty of stories of cop visits/arrests for just making Facebook posts that the government finds distasteful.
I read the article on "The Signal Chats That Cost OpenAI Researchers Their Jobs" [0] and the (former) employees were asked for their phone password.
Accessing Signal, OpenAI discovered (the absence of) disappearing messages to an external researcher.
So, if an application is password protected either by the OS or another app which demands a password to launch another app, would the official just ask for the application's launch password, or is that beyond whatever overly generous powers granted to them? Perhaps this is rhetorical, because what we called laws are merely ignored these days.
Laws for which there is no charge, no prosecution, and no consequence (I can give 34 examples) are merely suggestions.
[0] https://news.ycombinator.com/item?id=50210481
Just wipe your phone before entering any airport and restore the data once at destination.
Isn't this just giving in if your only reasonable backup location is a US cloud that regularly has to negotiate with the US federal government. The only difference I see is that they have to resort to parallel construction.
> Isn't this just giving in if your only reasonable backup location is a US cloud
my backups are not in a US Cloud.
Contacts and calendar on self hosted carddav
Pictures and files on self hosted drive.
Deltachat on mail servers (non us hosted provider) and XMPP conversation backups.
I don't backup whatsapp automatically, only do manual exports once in a while of important conversations that get copied to my self hosted server. Whatsapp pictures and vids are automatically synched with syncthing.
I host encrypted backups for another tech savy relative on a server of mine and in exchange he also host space for me on his own local backup server. We are 2000km appart so it allows us to keep a safe backup in remote location in case of fire or natural disaster without relying on the cloud.
Only thing I have missing is an automatic backup test of random files to compare checksums. I have done test backups manually but last was a bit more than a year ago so it is time to run a new one and add this automation as well.
That's quite an approach, thanks for sharing. I still don't think it mitigates restoring within the US since they claim to have search rights within 100 miles of any international airport. Personally, I try not to fall into the trap of believing I need retention of data that doesn't fall into a few categories, most of which I would assume I will already be sharing with authorities through taxes, etc.
CBP believes it has the right to files saved locally on your device itself. However explicitly cloud-hosted data (that is not stored on the device) is supposed to be off-limits, as I understand it.
And keep in mind that American citizens cannot be denied entry to the country for refusing to unlock or hand over their devices. They might hold you for a little while, but they cannot stop you.
They can arrest you the second you are admitted into the country.
For what, the ambiguous phrasing is misleading
People are getting arrested for all sorts of excuses. The Cop City protestor with the GrapheneOS phone was detained for "a routine search for child porn" - not something they routinely search for, and some people think they were going to plant some if they could get into the phone.
What I’m saying is that you are correct. No country can deny entry to their own citizens.
They can, and frequently do, arrest you the second they admit you.
What for? Whatever they make up.
In the US they can also keep all your devices indefinitely.
They have also arrested citizens simply for driving in their own car proximate to an ICE kidnapping. But if we preemptively act like we have no rights then they've already won.
“a little while” isn’t defined in any laws or regulations, so that could be weeks or months if they don’t like you
I haven't entered the U.S. in some years now and I don't plan to any more. Unlike going to any other country, it just feels icky to go there and dehumanizing to go through any airport in the U.S.
It's rather sad too because I like lots of places there and there's lots of cool stuff but with what's happening, I'm making an active effort to avoid it.
I remember seeing a "Lonely Planet Guide to the USSR" book in a CouchSurfing host's shelf. A section about passing through the border mentions the possible interrogation and checks of your belongings...
I'm sorry to be nitpicking like this, because I absolutely empathise with what you wanted to say. However, if you really think the US is the only country that does this, you haven't been paying attention.
I'm always eager to learn. Which ones? I mean aside from maybe the really dangerous ones. Because I've traveled a bit, to different countries over the years and I've never encountered crossing a border in the same league as the United States.
Not saying that they don't exist - but I just haven't encountered it.
There needs to be a decoy passphrase for laptops or mobiles etc. Allow access to a decoy enclave.
Instead of a killphrass/killcode, give them access to playground of `dummy` data.
You can already do this with built in android features, on any phone. It only works against cursory examination and not against your phone being plugged in to forensic devices.
GrapheneOS has repeatedly turned down this idea because it gives a wider area of attack (signed in vs in a locked state) and would be easily detectable.
Unfortunately non-citizens probably don't have this luxury, but before entering certain countries - including returning to the USA as a citizen from a recent trip abroad, I wipe and do a fresh OS reinstall (simple new password not used anywhere else, zero user data, no email or chat or cloud accounts configured).
Right before the wipe I update my cloud backups of course, and if I've been doing a lot of work I use Carbon Copy Cloner to an SSD encrypted APFS volume and use DHL to ship the SSD to someone I can retrieve it from once home. I also have finally started traveling with a second phone (a cheap Consumer Cellular backup flip phone with only a few family in the address book).
"Password, please" - "sure, no problem: Travel1234 with a capital T."*
Restoring the devices is a bit of a pain, but is faster and easier with the SSD assuming it arrives.
But them's the times we're living in.
* I suppose if it they ever ask and login, CBP will ask "Why doesn't your device have any user data? This is suspicious." I might tell them about the time an Israeli border dude took my computer into a back room for an hour and by the time I got home someone in Israel had stolen and sold one of my better domain names. Or might just shrug and say "Citizen".
I am a little curious in that scenario (thoroughly wiped device, comply with password request) if they still impound the wiped device (after they presumably connect it to whatever digital-strip-search gadget they hide in the back room and it comes back clean).
Yeah I don't plan on visiting the US any time soon. Even before the current shift in vibe the US border was unpleasant - as if the agents had confused being hostile with being effective
The US is the one that makes it into the news the most often, but I bet if you search just about any country's name and the same subject you will get the same stories. The UK for example has plenty of stories of cop visits/arrests for just making Facebook posts that the government finds distasteful.
I would let them peek around my Windows partition at will.
Anything that matters is in the Linux one.
US
https://www.reddit.com/r/USdefaultism/
It’s either that, or in mice.