The Mandelbear's Musings

There's a really great post on tips for airplane travel over on sweetmusic_2 that I've been meaning to point to for a long time. Go read it, especially if you haven't traveled by air much.

This post isn't very closely related at all; it just seemed like a convenient excuse for a link. This post is more directly related to this post on Techdirt.com and related matters, which point out that customs agents on both sides of the US/Canadian border are searching and in some cases seizing laptops and cell phones.

OK, we all know that keeping sensitive data on your laptop is a bad idea. And we all know that you can encrypt your home directory -- at least on Linux and Mac. And you can use something like TrueCrypt to make a complete virtual encrypted disk. Both will protect your privacy pretty well, but if your laptop gets stolen or seized, you still lose the use of your data. Similarly, you can set a master password in Firefox, but it's probably not going to protect your login cookies, it might be breakable, and customs might be able to force you to reveal it in any case.

So here's a better idea: don't have secrets anywhere on your computer when you cross the border. This is the software equivalent of taking all the metal out of your pockets and using a piece of rope for a belt as you go through the security checkpoint.

This relies on having all of your private data accessible via the web. It has to be either encrypted, or on your home server and accessible through an encrypted tunnel like ssh. Because your connections may be slow, it also helps to minimize what you really need: basically your keychain file(s) and your ssh and gpg private keys.

The private keys will all be protected by long passphrases anyway, if you're doing it right. You can encrypt your browser password file with a master password as well. Your IM client probably keeps your account passwords around; find that file too. If you keep a separate file of website passwords, as I do, you should encrypt that. Now put them all in a directory, zip it up, and encrypt the zip file. Note: do not use your gpg private key for this: it's not going to be on your machine when you need to decrypt the secrets! Use AES and a long passphrase.

Mail the resulting zip file, as an attachment, to yourself on any convenient webmail account. Or put it on a website that you control. If you want to be really safe, use steganography to put it inside an image.

Now delete all your secrets, using a secure deletion program that overwrites all the files with random bits before actually deleting them. Clear your browser cache, history, and cookies, again with a secure deletion program. Go.

When you get to your destination, retrieve the secrets file, decrypt and unzip it, and put everything back in the directories where they belong.

I'll be doing some international traveling in a couple of weeks; by that time I'll have some scripts I can post for you.

From this post in BoingBoing we get a link to a column by Patrick Smith in today's New York Times titled "The Airport Security Follies". Well worth a read, but it will make you angry. If enough people read it, maybe...

To understand what makes these measures so absurd, we first need to revisit the morning of September 11th, and grasp exactly what it was the 19 hijackers so easily took advantage of. Conventional wisdom says the terrorists exploited a weakness in airport security by smuggling aboard box-cutters. What they actually exploited was a weakness in our mindset -- a set of presumptions based on the decades-long track record of hijackings.

In years past, a takeover meant hostage negotiations and standoffs; crews were trained in the concept of "passive resistance." All of that changed forever the instant American Airlines Flight 11 collided with the north tower. What weapons the 19 men possessed mattered little; the success of their plan relied fundamentally on the element of surprise. And in this respect, their scheme was all but guaranteed not to fail.

For several reasons -- particularly the awareness of passengers and crew -- just the opposite is true today. Any hijacker would face a planeload of angry and frightened people ready to fight back. Say what you want of terrorists, they cannot afford to waste time and resources on schemes with a high probability of failure. And thus the September 11th template is all but useless to potential hijackers.

No matter that a deadly sharp can be fashioned from virtually anything found on a plane, be it a broken wine bottle or a snapped-off length of plastic, we are content wasting billions of taxpayer dollars and untold hours of labor in a delusional attempt to thwart an attack that has already happened, asked to queue for absurd lengths of time, subject to embarrassing pat-downs and loss of our belongings.

The comments are worthwhile, too.

Short version: it wasn't a "fake bomb" at all, it was a wearable tech jacket on the body of a friendly young technologist who would have been *way* better off wearing something else to the airport today. Authorities in Massachussetts who've been accused of overreacting to tech art misunderstandings before -- remember the Mooninite Menace? -- are throwing the book at her.