Slashdot Mirror
'Social Media Needs A Travel Mode' (idlewords.com)
Maciej CegÅowski, a Polish-American web developer, entrepreneur, and social critic, writes on a blog post: We need a 'trip mode' for social media sites that reduces our contact list and history to a minimal subset of what the site normally offers. Not only would such a feature protect people forced to give their passwords at the border, but it would mitigate the many additional threats to privacy they face when they use their social media accounts away from home. Both Facebook and Google make lofty claims about user safety, but they've done little to show they take the darkening political climate around the world seriously. A 'trip mode' would be a chance for them to demonstrate their commitment to user safety beyond press releases and anodyne letters of support. What's required is a small amount of engineering, a good marketing effort, and the conviction that any company that makes its fortune hoarding user data has a moral responsibility to protect its users. To work effectively, a trip mode feature would need to be easy to turn on, configurable (so you can choose how long you want the protection turned on for) and irrevocable for an amount of time chosen by the user once it's set. There's no sense in having a 'trip mode' if the person demanding your password can simply switch it off, or coerce you into switching it off.
As a former C++ app engineer, I've found adding "modes" increases the source and test complexity and often end up not being used very much.
...
A sprawling generalization, but that's what I've got
then they will simply not let you in. Luckily, these days, there are much better and safer destinations for your travels than the United States, because let's not kid ourselves, the blogger's use of "around the world" really means first and foremost "the United States".
"We need a 'trip mode' for social media sites..."
Speak for yourself...my devices aren't polluted with social media apps that leak my info and make me a target for hackers and Border Patrol fascists.
Just cruising through this digital world at 33 1/3 rpm...
We're talking about international travel here. I've never taken a cell phone to another country. I don't see the need.
Of course, I've never used social media on a cell phone, so maybe I'm just out of touch with what people care about.
Good intention, but what's to prevent a border patrol agent from a rogue state from just detaining people until the trip mode timer expires?
Liberty - Security - Laziness - Pick any two.
Does Facebook keep much locally on the phone? It'd seem easier to just uninstall it, deny having an account at the border, and reinstall whenever. Same as backing up stuff to the cloud.
Far better to have a cutsie account in your real name with only polite BS and a 2nd account in a different name where you can be honest. No politics or opinion on your real name and open an incognito browser before logging in to the real account where you say what you really think. A cut down account is far too dangerous as it would still be the person that the junta in Thailand are looking for for criticising the way they arrest, murder people or sell Rohinghya into slavery. It is not just the US who want to read your Facebook page. Better still, leave Facebook and meet your family.
I love stacking my barbecues in the shed at the end of summer - you can't beat a bit of grill on grill action.
This is so incredibly stupid.
If the feature depends on a timer, and it cannot be easily turned off, all the authorities have to do is detain you until the timer expires.
If you try to thwart them by putting an absurdly large timer (one month? one year?), well, you're just screwing yourself then because you are locked out for that duration as well.
But the authorities don't even need to do this! They can just get a warrant (or not, depends on how badly they want you), turn to Facebook and say "this guy is suspicious, hand over his data".
This is a stupid, stupid idea... If you are concerned about what the authorities can glean from your Facebook account then you have an easy option: DON'T POST THAT INFORMATION ON FACEBOOK.
Seriously.
Border guards can ask for your account passwords.
You don't have to provide them, of course.
But if you're not a citizen, you don't have to be admitted, either.
There are little or no practical appeals.
Not responding truthfully to a border guard is a very serious crime; it's not an option, although refusing can be, with consequences.
It will be interesting to watch the economic impact of this over time - I suspect there will be none, as people have adapted in the past, and this will just become the norm.
..don't panic
There is literally no point trying to protect your social media logins from US Customs officers because the federal government already has direct access to everything on Social Media.
When I travel, I bring a burner phone which I do a factory reset everytime I cross an international border, and a chromebook which I powerwash before I cross the border. I have several online accounts for practically every site so under duress, if they forced me to log in to an account I would simply log into one of the boring ones with nothing interesting on it.
This isn't because I doubt the NSA and CIA already have everything. It's because I don't want a US Customs Officer with a high school diploma reading my shit.
Seriously, does this Maciej dude really think that a "Trip Mode" does anything meaningful about intrusive border searches? That's just dumb!
In order to limit Border Services' activities, you have to make it so they cannot see anything. Nothing, zero, zip! As soon as they can see "something", then they can continuously expand their search for as long as they are interested. As soon as they can see that you have Trip Mode turned on they can "ask" you in that unpleasant & coercive way they have, to turn Trip Mode off.
The best things you can do are to:
1). Leave your devices at home;
2). Travel under the name Joe/Jane Smith and claim you never use social media. Ever. For anything!
3). Actually not use social media;
4). Boot into a fake, but plausibly real looking environment, with nothing interesting on it. Load it to the gills with internet cat videos and nothing more;
5). When they ask for your device passwords, politely but firmly decline. And be prepared to be detained and miss your flight.
A "mode" will be detectable — looking at your screen whoever compels you to show it (a criminal or an officer or both-in-one) will be able to tell, you are in "travel mode" and demand to see the real deal.
The concept you want is Duress Password — which ostensibly unlocks "everything", but hides the things you previously marked for hiding whenever the "duress" password is entered instead of real one.
And you may wish to use it not only to fool overzealous border-guards, but, for example, to hide certain materials from bystanders at Internet-cafes.
There is a "duress" PAM-module in the works for folks compelled to login to their Unix-laptop and a move to add the feature to Cyrus IMAP-server.
But, to reiterate, it is of utmost importance, that your usage of such functionality can not be not only proven, but even suspected. Whoever is in a position to compel you to login, is also in a position to punish you for fooling him...
In Soviet Washington the swamp drains you.
There
for an amount of time chosen by the user
Which, coincidentally, will be the amount of time you are held in detention until your phone unlocks.
Have gnu, will travel.
How do I provide that which doesn't exist? What then?
So-called 'social media' is bullshit. It's anything but 'social', it gives people a reason to not interact with each other (pro-tip: The Internets don't count!), it encourages bullying, toxic speech, fake news, and in the end is just a platform for terrorist organizations to radicalize people whose personalities are already on the fringes to start with. For young people especially it prevents them from learning proper social skills, which just isolates them from their peers even more, especially as they get older. Socially isolated people are orders of magnitude more likely to suffer from mental illnesses, which very often leads to violent crimes. Kill off so-called 'social media' and many of our modern problems will go away with it.
Do you really think that existence of a "duress mode" will be a secret only we know? Of course they will find out, and adjust tactics accordingly.
The safety and security of the homeland (no matter which nation that is) trumps your so called privacy every time. Too bad. If you are not willing to subjugate yourself completely to the host country's vetting process, STAY HOME.
I don't think you understand what social media is for...
YOU are the product. Not the customer.
So gathering MORE data is the job.
User safety? How does that make them money?
If that means it needs a feature to send it to or preferably past the end of the world, then I agree.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Really, traveling without social media is a very pleasant option in most cases. My most memorable vacations are the ones I took where I was not worried about WiFi or 3G service. Your vacation should get you away from what consumes you during the rest of your existence; if you are worrying about that crap while you are away I'm going to tell you that your doing your vacation wrong.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
The premise: Someone is (figuratively, but only barely) pointing a loaded gun at your face and demanding you give them a list of your associates.
Furthermore, the premise is that this is how the law is and how it will/should say. By that, I mean that 1) You always vote against the only people who run on a platform of upholding the plain meaning and spirit of the 4th amendment, and 2) you are ok with the social networking site's database still having a list of your associates. You just don't want that list to be accessible through your user-agent. If the guy with the gun asks the company directly without involving you or your phone, you don't have a problem (or at least not such a problem, that you would stop using that website or stop voting for Republicrats).
And you want a third party (social networking websites) to Do Something, such that the guy pointing a gun at your face, doesn't get whatever he wants.
I think this is an absurd position and I can't respect it .. or you. Take some responsibility; quit trying to get someone else (who has no stake in the situation) to fix it for you. At a minumum, at least put your votes where your mouth is, both in the booth and with your wallet. Stop using Facebook, and stop voting for people like Trump/Clinton. Currently, you are always acting like your privacy is worthless, and you are always helping (even when the gun isn't in your face) the guy with the gun. You fucking hypocrite. Why would anyone help you? You are the enemy that you're complaining about, asshole!
don't bring any devices with you, and if someone asks for your Facebook password reply with "Whats a face book?"
It is a political one. If you travel to a country where they can demand your passwords, they can do equally bad things to you if you have a "travel-mode" configured. The problem is that they can demand your passwords. In a country that respects personal freedoms, that will not happen. Unfortunately, the citizens of most democratic countries are too unaware of history today to understand the value of those freedoms and how hard it was to get them and are not defending them. If you go to such a country, having them look at all your social media stuff from the inside may be the only option. Whether you want to go to a country run by honor-less and decency-less "authorities" that do these things with the general consent of the citizens there is another question.
Incidentally, doing a "travel mode" is easy: Create long random password that you cannot remember, write it down, set it as your account-password and leave the piece of paper it is on at home. Done.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Look, traffic analysis is a bitch. Charlie just has to look at the fact that suddenly Alice is only doing +1 to posts from Bob (her brother) but not from himself (which she usually would), and he can infer she might be in "travel mode".
Add enough "Bobs", and Charlie can do that with >90% confidence. Then he hires some crooks to break into Alice's home, hide lots of defamatory material inside a wall, and one year later, when her husband is running for the local ClimateChange chapter, leak info to the police that "they hide in their basement"...
Sounds far fetched? Maybe the second paragraph is, but the first one is not. Do you trust all "Charlies" in your social network?
Duress codes...use them
Great so you set "travel mode." And then what? Lock it with a different password? The TLA involved will just ask you for the credentials to turn off travel mode.
Or do you set a time period with no way to turn it back off if you make a mistake? That doesn't sound like a very good idea.
The only way to avoid exposure is to not have social media accounts, or have shell accounts that you log your phone into when you travel. That's your travel mode.
It's called the "Logout" button. It's an amazing privacy feature.
You never expect irony, do you?
Want to be a professional wrestler? Visit www.iyfwrestling.com
@iyfwrestling
You can powerwash a chromebook? Cool. I'm going to have to look into one of those.
Faster! Faster! Faster would be better!
The problem isn't just that the ask for passwords. The problem is also that they save them for later use.
http://www.dailyxtra.com/canad...
A month later, André attempted to fly to New Orleans again. This time, he brought what he thought was ample proof that he was not a sex worker: letters from his employer, pay stubs, bank statements, a lease agreement and phone contracts to prove he intended to return to Canada.
When he went through secondary inspection at Vancouver airport, US Customs officers didn’t even need to ask for his passwords — they were saved in their own system. But André had wiped his phone of sex apps, browser history and messages, thinking that would dispel any suggestion he was looking for sex work. Instead, the border officers took that as suspicious.
All the "travel mode" protections we can think of will be useless, unless it also forces a password change. And we all know how often that happens.
As so many other commenters have pointed out, technology is not the problem here. The laws allowing it (or the lack of laws prohibiting it) are the problem.
"Government is like fire; a handy servant, but a dangerous master." -- George Washington
You: "Sorry, my account is locked for the next 30 days. Can't give you access"
Police: "No problems, you just have to wait here for the next 31 days"....
You: "Oh"
You appear to be advocating for a technical solution for fascism. The problem is, the fascists have better rubber hoses. Also, if it can't be turned off, then it can be used to grief people; if you can get them to turn it on, whether by owning their account or by tricking them, and they can't turn it off, that's beyond inconvenient.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
" they take the darkening political climate around the world seriously"
The only "darkening political climate" has been created by people who believe open borders are financially feasible.
A condition of sovereignty is to control your borders.
The only thing darkening is the Western world progressives accepting of religious violence and their acceptance that some religions are "special" and that they'll tolerate some of the most crude and cruel behavior because, well.... trump.
Don't use that crap. It's nothing more than candy to lure you into the paedophile's van.
So you say you can't live without your beloved Facebook, Twitter, Instagram, etc? Well, some people think they can't live without heroin, cocaine or oxycontin. That's your fucking problem and I have no sympathy.
If they can force you to give them your password, they can just as easily force you to deactivate any kind of "trip mode." This is just silly.
How about stop putting private information on social media....AND when you're traveling, pay attention to the foreign place over the virtual one....
Log out, remove it from your device and actually be fully present for your trip. The world's a fascinating place, experiencing it through a four inch screen really doesn't do it justice.
It's my Facebook password in the same way it's my library book or my company car. If I started handing those items to strangers so their contents could be searched, people would complain yet Facebook and friends say nothing.
The US government wants to search people without a search warrant and they've created 'no constitutional rights' zones to do it: We see this best in "stop and frisk" on the street with personal computing devices and social media being the low-hanging fruit. Since social media tends to project a 'come see me' mentality, the government can search those any time (since the USA demands passenger manifests in advance, not to mention, Visas for all non-residents, they know everybody's name) to discover what anti-American sentiments are being written. Government snooping at the customs gate is partly more accurate surveillance and mostly obnoxious theatre. The DHS even admits to wanting security mechanisms to be obnoxious; for the terrorists, you understand. Just be grateful their plans to search the railways and highways haven't succeeded yet.
My phone has a global "travel mode", AKA "Airplane mode."
IOW, I just disconnect when traveling. Also when sleeping. And working.
The Internet in all its various forms and guises serves me. Not the other way around. If it's not that way for you, you need to stop selling death-sticks, go home, and rethink your life. Go on. Go.
I've fallen off your lawn, and I can't get up.
I was thinking as a work around to this how about just overnighting your electronics to the house? Mostly just as an FU.
US gov, federal police, city, state, public/private partnerships, private groups will have collected everything in real time over the years.
A face that finds past use with facial recognition would re build any past social media use.
Politics, parties, friends of friends, funding, support, groups, leaders, other nations, work, holidays.
All a more secure mode hints at is a person knows they will be questioned and tried to quickly hide their digital pasts.
If they are a citizen, expect questions and every device to be searched, cloned, copied, any deleted files on a camera card recovered, any encrypted files systems detected. A few different request for a password.
So a citizen will get to walk out after a few hours of repeated questions, requests for a password, but their need to hide would have been added to a few databases. Any interesting devices will be examined, returned over days or weeks.
What did that person do? Why is that person interesting? Images/gps from another nation they visited while on holiday but had no paperwork for? Why hide the account?
Not a citizen? The interviews go on until the first lie. Deport.
Domestic spying is now "Benign Information Gathering"
I was tempted to say that you need new laws which protect your right to privacy but maybe technical solutions to government nosiness are the way to go.
Requiem for the American Dream
how about not having a social network profile? Or, not use your real name? What are they gonna do, make you get one before you travel? Actually check to see if you're lying?
The idea of duress passwords sounds right, but requires some changes to the device/software.
If we simply keep another account of the same type that authenticates with the device and syncs to a different set of contacts, map history, browser history, then it should be as plausible as what the security guy finds on the account for someone who is not a very regular user of the "smart" part of their phone.
Let's break it down...
"We need a 'trip mode' for social media sites that reduces our contact list and history to a minimal subset of what the site normally offers."
If you don't want things in public, don't put them on social media.
"Not only would such a feature protect people forced to give their passwords at the border, but it would mitigate the many additional threats to privacy they face when they use their social media accounts away from home."
No it wouldn't. The oligarchs who want the data will just get it via other means. "Giving passwords at the border" is a convenience for them, but not the only way to get the data. And what are these "additional threats to privacy"? That's just meaningless add-on to the sentence. You created the threat to your privacy when you posted the information in public.
"Both Facebook and Google make lofty claims about user safety, but they've done little to show they take the darkening political climate around the world seriously."
Facebook and Google never have and never will care as much about your privacy as you do. They MAKE MONEY off of mining your information! And another meaningless sentence add-on... "darkening political climate"... huh? When did governments stop wanting information on travelers, ever?
"A 'trip mode' would be a chance for them to demonstrate their commitment to user safety beyond press releases and anodyne letters of support."
And it would be a false sense of security. All it takes is a subpoena or a claim that you're a "terrorist" to get any social media company to quite-willingly hand over whatever law enforcement wants, without you even knowing about it.
"What's required is a small amount of engineering, a good marketing effort, and the conviction that any company that makes its fortune hoarding user data has a moral responsibility to protect its users."
Or just stop feeding them user data.
"To work effectively, a trip mode feature would need to be easy to turn on, configurable (so you can choose how long you want the protection turned on for) and irrevocable for an amount of time chosen by the user once it's set. There's no sense in having a 'trip mode' if the person demanding your password can simply switch it off, or coerce you into switching it off."
They can switch it off whenever they like... it's called a subpoena. You're fixing the wrong problem putting a "mode" in the user front-end. What's needed is encryption on the back end and even the company "hoarding" the data you willingly gave them NOT being able to read it at all, which... obviously isn't their business model...
The key thought here is, you do NOT need social media. No one NEEDS social media. Whatever you GIVE WILLINGLY to a company about yourself is easily accessed by anyone who can even hint that you are some sort of "threat" to anyone in society. No "mode" will fix that. Just STOP providing the information if you don't want it seen by everyone.
+++OK ATH