upvote

points

by microtonal13 hours ago |
comments
upvoteby msh13 hours ago|
next
[-]
I dont understand why people like a journalist working on things they dont want seized would carry this kind of data on their device at a situation like this (border crossing), I see it as more useful to remove that kind of data from the device first.
reply
upvoteby dugite-code12 hours ago|
parent|
next
[-]
Probably because everything seems to be an "app" these days. Even when it has no business being one.
reply
upvoteby inigyou11 hours ago|
parent|
next
[-]
Exactly. Everything must be switched to Service as a Software Substitute. It's for your own safety, you see.
reply
upvoteby 5 hours ago|
parent|
prev|
[-]
deleted
reply
upvoteby xnickb11 hours ago|
parent|
prev|
next
[-]
So delete messengers, email apps and other comms?

Delete the contact book? Clear calendars?

Where exactly should one stop?

reply
upvoteby daneel_w8 hours ago|
parent|
[-]
You're misinterpreting. They mean that there are additional options next to only keeping these things on your phone.
reply
upvoteby xnickb6 hours ago|
parent|
[-]
What am I misinterpreting? OP literally said they don't understand why a journalist would carry these data with them. As if the data is a file on your phone. Data can be a contact book on your phone, or a messenger with E2E encrypted messages. What would the alternative to that be? Sending pigeons?
reply
upvoteby iamnothere6 hours ago|
parent|
[-]
Restoring from remote backup when you reach your destination, then wiping again before you cross borders. Or shipping the (encrypted) data separately and picking it up after safe arrival.
reply
upvoteby xnickb6 hours ago|
parent|
next
[-]
What's the difference between this and wiping when under duress using the special PIN? If you aren't being checked you don't wipe and are gopd to go.
reply
upvoteby iamnothere6 hours ago|
parent|
next
[-]
Because you show up with nothing on you, and there’s no way to prove that the backups even exist. Especially given how often people travel with blank/disposable phones.

Just as the border guard can’t require you to fetch something from your house before entry, they can’t require you to restore from a remote backup that they don’t even know about.

reply
upvoteby prmoustache4 hours ago|
parent|
prev|
[-]
Wiping under duress is unlawful and could lead to prosecution in some juridictions.

On the other hand I don't know of any juridiction that force you to carry all the personal data in a single device when crossing borders. It would moat likely not even be possible.

reply
upvoteby inigyou6 hours ago|
parent|
prev|
[-]
The government can easily get your remote backup, of course. It's just that border control won't know you have one.
reply
upvoteby iamnothere6 hours ago|
parent|
[-]
Not if it’s encrypted and self-hosted. Your doomerism is silly. “The government” is not all-powerful, or they wouldn’t need to pester people for PINs at the border.
reply
upvoteby xnickb6 hours ago|
parent|
[-]
Encryption in this case is irrelevant. If they get the encrypted backup they can already charge you if you don't decrypt it.

Self-hosting is the way obviously

reply
upvoteby iamnothere6 hours ago|
parent|
[-]
Can the border guard go to your house and retrieve something, bring it to the checkpoint, and ask you to do something with it before entry? No. This is out of their legal authority.

Also, you could set up a system where the phone cannot restore the backup on reentry. Perhaps a single use restore key that you use at your original destination, so the restore cannot be performed again until you return home and generate a new code. This evades the (flimsy) charges that were applied in this case.

The best option, however, is to bring a blank disposable device, restore from backup at your destination, then discard the device before you cross the border again.

reply
upvoteby xnickb5 hours ago|
parent|
[-]
That's not my point. Rather that any self-hosted solution would. Encryption is completely optional and can be illegal in some places. As long as you trust the endpoint you only care about encryption in transit.

If your devices are seized having encrypted data can pose extra risk.

Deniable encryption exists and burden of proving that you haven't used it can be put on you.

Basically I'm trying to say "it depends". I'm not a fan of "let's just slap a(nother) layer of encryption on it" security model. My home servers aren't encrypted and I see no reason to do so. Sensitive data is encrypted based on the sensitivity.

> The best option

The best option is the one that is most convenient to the user and fits the task at hand.

If you are on a demonstration and need to broadcast status live then you don't have a luxury of bringing in a blank phone and restoring backup before each transmission

reply
upvoteby iamnothere5 hours ago|
parent|
[-]
> If your devices are seized having encrypted data can pose extra risk.

I don’t think you can even set up an iPhone anymore without encryption. It’s just “on”, not even “on by default”.

> My home servers aren't encrypted and I see no reason to do so. Sensitive data is encrypted based on the sensitivity.

If you do sensitive work, you should be concerned about someone breaking in and running off with your storage. It’s unfortunate but that’s just how it is. Encryption adds very little overhead on modern hardware.

> If you are on a demonstration and need to broadcast status live then you don't have a luxury of bringing in a blank phone and restoring backup before each transmission

That’s not crossing a border then, is it? The case under discussion was about a border crossing, where (apparently?) Constitutional rights are suspended. A used phone adds little to the cost of an international trip.

reply
upvoteby xnickb4 hours ago|
parent|
[-]
No you just chose to ignore other cases that OP mentioned and focused on this one
reply
upvoteby iamnothere2 hours ago|
parent|
[-]
A protest is a completely different situation. In that situation I’d recommend a burner phone that you can afford to lose or throw away. Ideally the cheapest one available. And never log in to your primary accounts on it.
reply
upvoteby choo-t12 hours ago|
parent|
prev|
next
[-]
Because you may need the data in the data during/after your travel and lack clean way to access safely, securely and anonymously remotely.
reply
upvoteby daneel_w8 hours ago|
parent|
next
[-]
No one is stopped from backing up important data. It is, in fact, kind of boneheaded to keep all "valuables" on a single device. I don't understand the scenario of not trusting a device to safely access the Internet or the telephony grid while also insisting that they need a PHONE to keep all their stuff on where they're going, and at the same time somehow trust that both themselves and their possessions are perfectly safe from seizure and extortion in the very same location.
reply
upvoteby inigyou6 hours ago|
parent|
[-]
Personally I just got grapheneos to replace my normal phone. It's nice, it works for the user instead of the advertiser, and its security features help block antiuser features in apps
reply
upvoteby kotaKat10 hours ago|
parent|
prev|
[-]
This is where we need "cloud phones as a service" / "selfhosting a cellphone at home with some kind of remote access system".

Not even kidding here, it's time to bring out thin client computing to cellphones. Let the spicy stuff sit somewhere else. I could bootstrap a Tailscale or Netbird signin remotely, install the access client, and remote back into the 'normal phone'.

Would be then funny to map that to lockscreen PINs - enter a PIN to unlock the device, be remoted into "phone A", enter another pin and be remoted into "phone B", enter another PIN and you're on the 'local device' session. (Or duress-PIN kill "phone A" if someone attempts to bruteforce PINs, etc, etc...)

reply
upvoteby drnick16 hours ago|
parent|
next
[-]
You can already do most of that with GrapheneOS or even an iPhone. My contacts, files, photos, etc. are on my home server, accessed through a VPN. My GrapheneOS phone only runs a handful of open source apps. If I were to lose the phone, I would simply revoke the Wireguard key and there wouldn't be anything valuable left on it.
reply
upvoteby mystifyingpoi9 hours ago|
parent|
prev|
[-]
> "selfhosting a cellphone at home with some kind of remote access system

You can use TeamViewer for that. Or maybe scrcpy could be coerced into working in a similar way.

reply
upvoteby prmoustache4 hours ago|
parent|
[-]
Good luck making it work again remotely after a long power outage.
reply
upvoteby mystifyingpoi3 hours ago|
parent|
[-]
Not sure what do you mean? If that is a concern, there are solutions for this. Like UPSes and backup cellular connections.
reply
upvoteby like_any_other41 minutes ago|
parent|
prev|
[-]
Remove and securely overwrite, otherwise the data can still be recovered from the disk image. We have not made privacy easy.
reply
upvoteby podocarp12 hours ago|
prev|
[-]
What about using decoy profiles? Say before the border crossing you switch to another user. Does that expose keys or anything for other users?
reply
upvoteby 0-_-012 hours ago|
parent|
[-]
You would need to hide the existence of the original profile while in the decoy profile for this to work, which GrapheneOS considers too complex to implement
reply
upvoteby inigyou6 hours ago|
parent|
next
[-]
The only really plausibly deniable way to do it is for every graphene phone to come pre-partitioned for this. E.g. 128GB main + 128GB duress, random selection of whether partition 0 or 1 is the duress partition. But that means giving up half your storage.

You can't even make them different sizes because that gives away which one is duress. You could have more partitions with a static split like 32+32+32+32+32+32+32+32 but then you have to manage so many independent partitions it isn't practical.

reply
upvoteby kmeisthax4 hours ago|
parent|
[-]
Deniable encryption has gotten way more advanced than this, though - the state-of-the-art is to have a bunch of independently unlockable data stores along with a mechanism to add chaff data that doesn't decrypt with any key. That's how bunnie's Betrusted project works, and it's the same idea as PhonebookFS from yesterdecade.

The main problem with any deniable encryption system is that while your adversary might not be able to prove if you gave them the decoy or real data, they can at least force you to wipe anything you fail to decrypt. In your partitioning scheme, that would mean wiping any partition that doesn't decrypt with the set of PINs you gave them. In the more advanced granular scheme that Betrusted devices use, that would mean border control unlocking all the basis keys you dared to give them, and then them running the storage reclaim tool that wipes all other keys.

In either case, it would probably be easier (and less suspicious!) to pre-wipe your device and then redownload a backup after you pass through border control... assuming you can get access to an untampered Internet connection after the fact, AND assuming your backup is actually complete. Like, I'm pretty sure most apps exclude their login tokens from backup, because every time I do wind up restoring a backup, I have to log into everything again, which makes me wonder what the point of the backup even is?

reply
upvoteby inigyou4 hours ago|
parent|
[-]
That requires a whole new OS from scratch. It won't work to support Android. Even if it did, would you unlock your duress partition every time you used your phone to prevent overwriting?
reply