I read the article on "The Signal Chats That Cost OpenAI Researchers Their Jobs" [0] and the (former) employees were asked for their phone password.
Accessing Signal, OpenAI discovered (the absence of) disappearing messages to an external researcher.
So, if an application is password protected either by the OS or another app which demands a password to launch another app, would the official just ask for the application's launch password, or is that beyond whatever overly generous powers granted to them? Perhaps this is rhetorical, because what we called laws are merely ignored these days.
Laws for which there is no charge, no prosecution, and no consequence (I can give 34 examples) are merely suggestions.
Isn't this just giving in if your only reasonable backup location is a US cloud that regularly has to negotiate with the US federal government. The only difference I see is that they have to resort to parallel construction.
> Isn't this just giving in if your only reasonable backup location is a US cloud
my backups are not in a US Cloud.
Contacts and calendar on self hosted carddav
Pictures and files on self hosted drive.
Deltachat on mail servers (non us hosted provider) and XMPP conversation backups.
I don't backup whatsapp automatically, only do manual exports once in a while of important conversations that get copied to my self hosted server. Whatsapp pictures and vids are automatically synched with syncthing.
I host encrypted backups for another tech savy relative on a server of mine and in exchange he also host space for me on his own local backup server. We are 2000km appart so it allows us to keep a safe backup in remote location in case of fire or natural disaster without relying on the cloud.
Only thing I have missing is an automatic backup test of random files to compare checksums. I have done test backups manually but last was a bit more than a year ago so it is time to run a new one and add this automation as well.
CBP believes it has the right to files saved locally on your device itself. However explicitly cloud-hosted data (that is not stored on the device) is supposed to be off-limits, as I understand it.
And keep in mind that American citizens cannot be denied entry to the country for refusing to unlock or hand over their devices. They might hold you for a little while, but they cannot stop you.
People are getting arrested for all sorts of excuses. The Cop City protestor with the GrapheneOS phone was detained for "a routine search for child porn" - not something they routinely search for, and some people think they were going to plant some if they could get into the phone.
They have also arrested citizens simply for driving in their own car proximate to an ICE kidnapping. But if we preemptively act like we have no rights then they've already won.
I haven't entered the U.S. in some years now and I don't plan to any more. Unlike going to any other country, it just feels icky to go there and dehumanizing to go through any airport in the U.S.
It's rather sad too because I like lots of places there and there's lots of cool stuff but with what's happening, I'm making an active effort to avoid it.
I remember seeing a "Lonely Planet Guide to the USSR" book in a CouchSurfing host's shelf. A section about passing through the border mentions the possible interrogation and checks of your belongings...
I'm sorry to be nitpicking like this, because I absolutely empathise with what you wanted to say. However, if you really think the US is the only country that does this, you haven't been paying attention.
I'm always eager to learn. Which ones? I mean aside from maybe the really dangerous ones. Because I've traveled a bit, to different countries over the years and I've never encountered crossing a border in the same league as the United States.
Not saying that they don't exist - but I just haven't encountered it.
Unfortunately non-citizens probably don't have this luxury, but before entering certain countries - including returning to the USA as a citizen from a recent trip abroad, I wipe and do a fresh OS reinstall (simple new password not used anywhere else, zero user data, no email or chat or cloud accounts configured).
Right before the wipe I update my cloud backups of course, and if I've been doing a lot of work I use Carbon Copy Cloner to an SSD encrypted APFS volume and use DHL to ship the SSD to someone I can retrieve it from once home. I also have finally started traveling with a second phone (a cheap Consumer Cellular backup flip phone with only a few family in the address book).
"Password, please" - "sure, no problem: Travel1234 with a capital T."*
Restoring the devices is a bit of a pain, but is faster and easier with the SSD assuming it arrives.
But them's the times we're living in.
* I suppose if it they ever ask and login, CBP will ask "Why doesn't your device have any user data? This is suspicious." I might tell them about the time an Israeli border dude took my computer into a back room for an hour and by the time I got home someone in Israel had stolen and sold one of my better domain names. Or might just shrug and say "Citizen".
I am a little curious in that scenario (thoroughly wiped device, comply with password request) if they still impound the wiped device (after they presumably connect it to whatever digital-strip-search gadget they hide in the back room and it comes back clean).
You can already do this with built in android features, on any phone. It only works against cursory examination and not against your phone being plugged in to forensic devices.
GrapheneOS has repeatedly turned down this idea because it gives a wider area of attack (signed in vs in a locked state) and would be easily detectable.
Yeah I don't plan on visiting the US any time soon. Even before the current shift in vibe the US border was unpleasant - as if the agents had confused being hostile with being effective
k310 1 day ago
Accessing Signal, OpenAI discovered (the absence of) disappearing messages to an external researcher.
So, if an application is password protected either by the OS or another app which demands a password to launch another app, would the official just ask for the application's launch password, or is that beyond whatever overly generous powers granted to them? Perhaps this is rhetorical, because what we called laws are merely ignored these days.
Laws for which there is no charge, no prosecution, and no consequence (I can give 34 examples) are merely suggestions.
[0] https://news.ycombinator.com/item?id=50210481
prmoustache 15 hours ago
telebub 12 hours ago
prmoustache 10 hours ago
my backups are not in a US Cloud.
Contacts and calendar on self hosted carddav
Pictures and files on self hosted drive.
Deltachat on mail servers (non us hosted provider) and XMPP conversation backups.
I don't backup whatsapp automatically, only do manual exports once in a while of important conversations that get copied to my self hosted server. Whatsapp pictures and vids are automatically synched with syncthing.
I host encrypted backups for another tech savy relative on a server of mine and in exchange he also host space for me on his own local backup server. We are 2000km appart so it allows us to keep a safe backup in remote location in case of fire or natural disaster without relying on the cloud.
Only thing I have missing is an automatic backup test of random files to compare checksums. I have done test backups manually but last was a bit more than a year ago so it is time to run a new one and add this automation as well.
mrtesthah 1 day ago
And keep in mind that American citizens cannot be denied entry to the country for refusing to unlock or hand over their devices. They might hold you for a little while, but they cannot stop you.
testing22321 1 day ago
zaphirplane 20 hours ago
cowlevel 18 hours ago
testing22321 15 hours ago
They can, and frequently do, arrest you the second they admit you.
What for? Whatever they make up.
In the US they can also keep all your devices indefinitely.
mrtesthah 11 hours ago
iAMkenough 16 hours ago
bemtevi 21 hours ago
It's rather sad too because I like lots of places there and there's lots of cool stuff but with what's happening, I'm making an active effort to avoid it.
netsharc 16 hours ago
throw-the-towel 14 hours ago
bemtevi 10 hours ago
Not saying that they don't exist - but I just haven't encountered it.
pardner 8 hours ago
Right before the wipe I update my cloud backups of course, and if I've been doing a lot of work I use Carbon Copy Cloner to an SSD encrypted APFS volume and use DHL to ship the SSD to someone I can retrieve it from once home. I also have finally started traveling with a second phone (a cheap Consumer Cellular backup flip phone with only a few family in the address book).
"Password, please" - "sure, no problem: Travel1234 with a capital T."*
Restoring the devices is a bit of a pain, but is faster and easier with the SSD assuming it arrives.
But them's the times we're living in.
* I suppose if it they ever ask and login, CBP will ask "Why doesn't your device have any user data? This is suspicious." I might tell them about the time an Israeli border dude took my computer into a back room for an hour and by the time I got home someone in Israel had stolen and sold one of my better domain names. Or might just shrug and say "Citizen".
I am a little curious in that scenario (thoroughly wiped device, comply with password request) if they still impound the wiped device (after they presumably connect it to whatever digital-strip-search gadget they hide in the back room and it comes back clean).
timothyduong 20 hours ago
Instead of a killphrass/killcode, give them access to playground of `dummy` data.
dolorian 20 hours ago
novafunc 20 hours ago
Havoc 11 hours ago
Shorel 16 hours ago
Anything that matters is in the Linux one.
pestatije 1 day ago
penguin_booze 13 hours ago
vconnor 1 day ago