Slashdot Mirror
'Social Media Needs A Travel Mode' (idlewords.com)
Maciej CegÅowski, a Polish-American web developer, entrepreneur, and social critic, writes on a blog post: We need a 'trip mode' for social media sites that reduces our contact list and history to a minimal subset of what the site normally offers. Not only would such a feature protect people forced to give their passwords at the border, but it would mitigate the many additional threats to privacy they face when they use their social media accounts away from home. Both Facebook and Google make lofty claims about user safety, but they've done little to show they take the darkening political climate around the world seriously. A 'trip mode' would be a chance for them to demonstrate their commitment to user safety beyond press releases and anodyne letters of support. What's required is a small amount of engineering, a good marketing effort, and the conviction that any company that makes its fortune hoarding user data has a moral responsibility to protect its users. To work effectively, a trip mode feature would need to be easy to turn on, configurable (so you can choose how long you want the protection turned on for) and irrevocable for an amount of time chosen by the user once it's set. There's no sense in having a 'trip mode' if the person demanding your password can simply switch it off, or coerce you into switching it off.
As a former C++ app engineer, I've found adding "modes" increases the source and test complexity and often end up not being used very much.
...
A sprawling generalization, but that's what I've got
"We need a 'trip mode' for social media sites..."
Speak for yourself...my devices aren't polluted with social media apps that leak my info and make me a target for hackers and Border Patrol fascists.
Just cruising through this digital world at 33 1/3 rpm...
Good intention, but what's to prevent a border patrol agent from a rogue state from just detaining people until the trip mode timer expires?
Liberty - Security - Laziness - Pick any two.
Does Facebook keep much locally on the phone? It'd seem easier to just uninstall it, deny having an account at the border, and reinstall whenever. Same as backing up stuff to the cloud.
Far better to have a cutsie account in your real name with only polite BS and a 2nd account in a different name where you can be honest. No politics or opinion on your real name and open an incognito browser before logging in to the real account where you say what you really think. A cut down account is far too dangerous as it would still be the person that the junta in Thailand are looking for for criticising the way they arrest, murder people or sell Rohinghya into slavery. It is not just the US who want to read your Facebook page. Better still, leave Facebook and meet your family.
I love stacking my barbecues in the shed at the end of summer - you can't beat a bit of grill on grill action.
Border guards can ask for your account passwords.
You don't have to provide them, of course.
But if you're not a citizen, you don't have to be admitted, either.
There are little or no practical appeals.
Not responding truthfully to a border guard is a very serious crime; it's not an option, although refusing can be, with consequences.
It will be interesting to watch the economic impact of this over time - I suspect there will be none, as people have adapted in the past, and this will just become the norm.
..don't panic
A "mode" will be detectable — looking at your screen whoever compels you to show it (a criminal or an officer or both-in-one) will be able to tell, you are in "travel mode" and demand to see the real deal.
The concept you want is Duress Password — which ostensibly unlocks "everything", but hides the things you previously marked for hiding whenever the "duress" password is entered instead of real one.
And you may wish to use it not only to fool overzealous border-guards, but, for example, to hide certain materials from bystanders at Internet-cafes.
There is a "duress" PAM-module in the works for folks compelled to login to their Unix-laptop and a move to add the feature to Cyrus IMAP-server.
But, to reiterate, it is of utmost importance, that your usage of such functionality can not be not only proven, but even suspected. Whoever is in a position to compel you to login, is also in a position to punish you for fooling him...
In Soviet Washington the swamp drains you.
for an amount of time chosen by the user
Which, coincidentally, will be the amount of time you are held in detention until your phone unlocks.
Have gnu, will travel.
Because Travel Mode is an indicator that you've got something to hide, and thus, must be using social media to send encoded terrorist messages.
Sometimes I think terrorists are just nature's way of weeding out the violent and stupid- especially suicide bombers.
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
No, they would not — the concept is in wide usage by security and alarm-monitoring companies for example.
Without access to the remote server, it can be made impossible to detect, whether or not the user used the special password or the real one.
In Soviet Washington the swamp drains you.
If that means it needs a feature to send it to or preferably past the end of the world, then I agree.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
If you cannot tell whether the device is in "duress" mode, how would you find out?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Really, traveling without social media is a very pleasant option in most cases. My most memorable vacations are the ones I took where I was not worried about WiFi or 3G service. Your vacation should get you away from what consumes you during the rest of your existence; if you are worrying about that crap while you are away I'm going to tell you that your doing your vacation wrong.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
2). Travel under the name Joe/Jane Smith and claim you never use social media. Ever. For anything!
Smart move. Where do I get a passport that says I'm Joe Smith?
4). Boot into a fake, but plausibly real looking environment, with nothing interesting on it. Load it to the gills with internet cat videos and nothing more;
I'd load it with gross but legal porn. Give them something to vomit over. Lemonparty or Tubgirl... gee, if I only could decide...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
don't bring any devices with you, and if someone asks for your Facebook password reply with "Whats a face book?"
"Traveling around the world" means more and more "Traveling all around, but also you go around the USA if you at all can."
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Because Travel Mode is an indicator that you've got something to hide, and thus, must be using social media to send encoded terrorist messages.
Sometimes I think terrorists are just nature's way of weeding out the violent and stupid- especially suicide bombers.
For one thing, there has to be something for them to see, so they don't see a blank slate and, on that basis, assume you have something to hide and probe you ever more deeply.
Clearly if there were going to be a 'Travel Mode' it would have to be very very well hidden.
When I'm travelling I wipe the phone, factory reset it, and then set it up with my work account instead of personal. That way there are contacts and emails etc but its only work related. My work isn't sensitive so I don't care. But it looks like it has stuff on it so it gives the security guys a nice satisfying experience.
In the free world the media isn't government run; the government is media run.
It is a political one. If you travel to a country where they can demand your passwords, they can do equally bad things to you if you have a "travel-mode" configured. The problem is that they can demand your passwords. In a country that respects personal freedoms, that will not happen. Unfortunately, the citizens of most democratic countries are too unaware of history today to understand the value of those freedoms and how hard it was to get them and are not defending them. If you go to such a country, having them look at all your social media stuff from the inside may be the only option. Whether you want to go to a country run by honor-less and decency-less "authorities" that do these things with the general consent of the citizens there is another question.
Incidentally, doing a "travel mode" is easy: Create long random password that you cannot remember, write it down, set it as your account-password and leave the piece of paper it is on at home. Done.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Maybe, it would have if it actually helped. But it is so trivial for anyone to bypass the entire problem — such as by resetting their phone when the plane is landing and restoring from the cloud after checking-in to their hotel — that no terrorist will be thwarted by this.
If any, the safety gain will be temporarily while the lost liberty — substantial. Do the words I just used remind you of a quote by one of the Founding Fathers? They better...
During Obama's last fiscal year, the practice quintupled — and is targeting not only foreigners, but US citizens as well. Surrendering your privacy to a random guard's unfounded suspicions or hunches shall not be a condition for returning home.
In Soviet Washington the swamp drains you.
> just nature's way of weeding out the violent and stupid
Yeah but its also society that is to blame for their existence in the first place. We have already invented and enabled massive mechanisms (such as religion and governments) that systemically hide the real truth, suppress free speech and use education/media as brainwashing mechanisms expressly in order to keep us "little people" ignorant and distracted with crap like social media or with fighting each other, and therefore completely controllable.
Why we would vote for people that want to make it easy for terrorists to enter the country?
Because Travel Mode is an indicator that you've got something to hide, and thus, must be using social media to send encoded terrorist messages.
Maybe, but most likely they'll just see you as another nuisance maker trying to make their job difficult. And in their opinion it's important, valuable, patriotic and you're either non-American or one of the wusses they defend. I'm sure the TSA system has some informal way to shitlist a person so he'll get picked for extra security screenings, luggage checks, extended questioning, "problems" processing forms etc. so any kind of solution that lets the TSA know you're trying to obstruct or evade them is kinda a non-starter.
Sometimes I think terrorists are just nature's way of weeding out the violent and stupid- especially suicide bombers.
I think we'd run of places to blow up before we'd run out of violent and stupid people. Also, most of them manage a pretty solid kill:death ratio so if 50 people of average intelligence dies and one nutjob the average doesn't move much at all.
Live today, because you never know what tomorrow brings
Logging-in with a duress code to your laptop should trigger removal of whatever it is you want to protect (whether it is encrypted/hidden or not).
It is a reasonably fast operation and, after it is over, the diskspace will match... The only way to prevent it would be for the compelling party to confiscate the laptop and attempt to unlock it themselves. That method is way too tedious to be used in a dragnet, however...
In Soviet Washington the swamp drains you.
AFAIK, they don't ask for password. They ask you to "please, enter your password"...
In Soviet Washington the swamp drains you.
Great so you set "travel mode." And then what? Lock it with a different password? The TLA involved will just ask you for the credentials to turn off travel mode.
Or do you set a time period with no way to turn it back off if you make a mistake? That doesn't sound like a very good idea.
The only way to avoid exposure is to not have social media accounts, or have shell accounts that you log your phone into when you travel. That's your travel mode.
It's called the "Logout" button. It's an amazing privacy feature.
You never expect irony, do you?
Want to be a professional wrestler? Visit www.iyfwrestling.com
@iyfwrestling
Maybe, but most likely they'll just see you as another nuisance maker trying to make their job difficult. And in their opinion it's important, valuable, patriotic and you're either non-American or one of the wusses they defend. I'm sure the TSA system has some informal way to shitlist a person so he'll get picked for extra security screenings, luggage checks, extended questioning, "problems" processing forms etc. so any kind of solution that lets the TSA know you're trying to obstruct or evade them is kinda a non-starter.
They're only going to care if you're wrapped head to toe in a Burka or tin foil. And then only maybe.
You do realize that the VAST majority of TSA employees are just trying to get through the day. That includes middle and upper level management. Yes, they realize that most of what they do is security theater - at best - but they still have to do it. Showing up with a blank computer / no social site logins / stupid T shirt or bizarre attitude isn't going to faze them nor will it put you on some magical shit list.
You aren't a special snowflake. Just a random, generic one. And when you melt, no one will care. Get over it.
Faster! Faster! Faster would be better!
You can powerwash a chromebook? Cool. I'm going to have to look into one of those.
Faster! Faster! Faster would be better!
The problem isn't just that the ask for passwords. The problem is also that they save them for later use.
http://www.dailyxtra.com/canad...
A month later, André attempted to fly to New Orleans again. This time, he brought what he thought was ample proof that he was not a sex worker: letters from his employer, pay stubs, bank statements, a lease agreement and phone contracts to prove he intended to return to Canada.
When he went through secondary inspection at Vancouver airport, US Customs officers didn’t even need to ask for his passwords — they were saved in their own system. But André had wiped his phone of sex apps, browser history and messages, thinking that would dispel any suggestion he was looking for sex work. Instead, the border officers took that as suspicious.
All the "travel mode" protections we can think of will be useless, unless it also forces a password change. And we all know how often that happens.
As so many other commenters have pointed out, technology is not the problem here. The laws allowing it (or the lack of laws prohibiting it) are the problem.
"Government is like fire; a handy servant, but a dangerous master." -- George Washington
Yes, a large portion of that hard drive is not partitioned yet. Didn't need it yet, it's probably filled with random stuff from the last wipe.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
What second password are you talking about? There is none.
Part of having a good duress password is not having to have one to make whatever you're using work in the first place...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
You appear to be advocating for a technical solution for fascism. The problem is, the fascists have better rubber hoses. Also, if it can't be turned off, then it can be used to grief people; if you can get them to turn it on, whether by owning their account or by tricking them, and they can't turn it off, that's beyond inconvenient.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Don't use that crap. It's nothing more than candy to lure you into the paedophile's van.
So you say you can't live without your beloved Facebook, Twitter, Instagram, etc? Well, some people think they can't live without heroin, cocaine or oxycontin. That's your fucking problem and I have no sympathy.
If they can force you to give them your password, they can just as easily force you to deactivate any kind of "trip mode." This is just silly.
How about stop putting private information on social media....AND when you're traveling, pay attention to the foreign place over the virtual one....
Log out, remove it from your device and actually be fully present for your trip. The world's a fascinating place, experiencing it through a four inch screen really doesn't do it justice.
My phone has a global "travel mode", AKA "Airplane mode."
IOW, I just disconnect when traveling. Also when sleeping. And working.
The Internet in all its various forms and guises serves me. Not the other way around. If it's not that way for you, you need to stop selling death-sticks, go home, and rethink your life. Go on. Go.
I've fallen off your lawn, and I can't get up.
I was thinking as a work around to this how about just overnighting your electronics to the house? Mostly just as an FU.
US gov, federal police, city, state, public/private partnerships, private groups will have collected everything in real time over the years.
A face that finds past use with facial recognition would re build any past social media use.
Politics, parties, friends of friends, funding, support, groups, leaders, other nations, work, holidays.
All a more secure mode hints at is a person knows they will be questioned and tried to quickly hide their digital pasts.
If they are a citizen, expect questions and every device to be searched, cloned, copied, any deleted files on a camera card recovered, any encrypted files systems detected. A few different request for a password.
So a citizen will get to walk out after a few hours of repeated questions, requests for a password, but their need to hide would have been added to a few databases. Any interesting devices will be examined, returned over days or weeks.
What did that person do? Why is that person interesting? Images/gps from another nation they visited while on holiday but had no paperwork for? Why hide the account?
Not a citizen? The interviews go on until the first lie. Deport.
Domestic spying is now "Benign Information Gathering"
AC any use of encryption or a different OS mode, encrypted file system can be detected. ...
With the US gov paying, that software is easy to buy and fast to scan any device for can encryption or hidden accounts or a mode setting.
The encryption will hold but the use of such efforts will be found.
If your a citizen the question will be what files are been hidden? Decrypt and its all good...
The use of a flight mode will then be a chat down about hiding digital photos using cryptography. Still feel the need to hide the photos? Is it the gps and the location in an interesting nation? An interesting person is in one of the images? How many photos are been hidden in that device using that "travel" mode?
Need a lawyer? Time to talk to US law enforcement to start an investigation in the US? The US legal system is ready 24/7 with the needed paperwork. Send the device for more detailed examination to find what image files are been hidden?
The US citizen walks free, the device is returned days, weeks later.
Was an investigation opened? Home computer? ISP logs?
What do the ISP logs show? A lot of https searching for hours? Finally some http
If not a US citizen, thats a few lies, time to return to your own nation again.
Domestic spying is now "Benign Information Gathering"
I was tempted to say that you need new laws which protect your right to privacy but maybe technical solutions to government nosiness are the way to go.
Requiem for the American Dream
The idea of duress passwords sounds right, but requires some changes to the device/software.
If we simply keep another account of the same type that authenticates with the device and syncs to a different set of contacts, map history, browser history, then it should be as plausible as what the security guy finds on the account for someone who is not a very regular user of the "smart" part of their phone.
It must be really fun going through life with such constant paranoia. Taking such drastic and inconvenient measures means they (the terr'rists or the gov'mint, take your pick) have already won.
I don't travel that often. When I do travel this is really not an inconvenience, you are totally exaggerating.
In the free world the media isn't government run; the government is media run.
Let's break it down...
"We need a 'trip mode' for social media sites that reduces our contact list and history to a minimal subset of what the site normally offers."
If you don't want things in public, don't put them on social media.
"Not only would such a feature protect people forced to give their passwords at the border, but it would mitigate the many additional threats to privacy they face when they use their social media accounts away from home."
No it wouldn't. The oligarchs who want the data will just get it via other means. "Giving passwords at the border" is a convenience for them, but not the only way to get the data. And what are these "additional threats to privacy"? That's just meaningless add-on to the sentence. You created the threat to your privacy when you posted the information in public.
"Both Facebook and Google make lofty claims about user safety, but they've done little to show they take the darkening political climate around the world seriously."
Facebook and Google never have and never will care as much about your privacy as you do. They MAKE MONEY off of mining your information! And another meaningless sentence add-on... "darkening political climate"... huh? When did governments stop wanting information on travelers, ever?
"A 'trip mode' would be a chance for them to demonstrate their commitment to user safety beyond press releases and anodyne letters of support."
And it would be a false sense of security. All it takes is a subpoena or a claim that you're a "terrorist" to get any social media company to quite-willingly hand over whatever law enforcement wants, without you even knowing about it.
"What's required is a small amount of engineering, a good marketing effort, and the conviction that any company that makes its fortune hoarding user data has a moral responsibility to protect its users."
Or just stop feeding them user data.
"To work effectively, a trip mode feature would need to be easy to turn on, configurable (so you can choose how long you want the protection turned on for) and irrevocable for an amount of time chosen by the user once it's set. There's no sense in having a 'trip mode' if the person demanding your password can simply switch it off, or coerce you into switching it off."
They can switch it off whenever they like... it's called a subpoena. You're fixing the wrong problem putting a "mode" in the user front-end. What's needed is encryption on the back end and even the company "hoarding" the data you willingly gave them NOT being able to read it at all, which... obviously isn't their business model...
The key thought here is, you do NOT need social media. No one NEEDS social media. Whatever you GIVE WILLINGLY to a company about yourself is easily accessed by anyone who can even hint that you are some sort of "threat" to anyone in society. No "mode" will fix that. Just STOP providing the information if you don't want it seen by everyone.
+++OK ATH
Given their current abuses of power, they would think it perfectly fine to detain someone who they thought might be using a duress password until that person coughs up their "real" password. Whether or not they would know for sure wouldn't be important to them.
That's why even though these technical solutions are nice, the only way to solve the real problem is to stop these abuses of power.
We're Americans, they're not. That's the point. If we choose to admit others, that's our choice, but nothing compels us to do so. We certainly shouldn't do so when it's a threat to national security. Attitudes like yours are why people are getting molested by the TSA for exercising their right to travel. That is a violation of the Bill of Rights, you fuckstick.