Passwords for social media accounts could be required for some to enter country

https://techcrunch.com/2017/02/08/passwords-for-social-media-accounts-could-be-required-for-some-to-enter-country/

by rainhacker • 9 years ago

143 138 9 years ago

salesguy22213• 9 years ago

i hope everyone can look at this and see the conclusive proof:

many people in government from all sides abuse technology to control the lives of people in new, shocking, and totalitarian ways

to say "i'm not muslim, or Iranian, or Mexican, or a dissident", or etc, will soon no longer suffice.

Every conceivable activity and word you speak or think will eventually be evaluated if the technology is cheap enough and politicians are daring enough

The constitution doesn't even stop people from doing things like this anymore, so I don't know how to fix this

anigbrowl2• 9 years ago

The Constitution is on it's way to becoming a dead letter. There's nothing wrong with rebooting the Republic, many countries go through such disruptions. I'm not saying just do it, but if the existing political consensus collapses we won't benefit from trying to back to how things used to be.

andai3• 9 years ago

I was just thinking today about Thomas Jefferson's idea that the constitution be rewritten every 19 years (every generation).

I arrived at that thought while thinking about how Dropbox Paper is more modern than Google Docs (which turns 12 this year).

Sometimes it's better to start over from scratch.

It lets you do things you actually couldn't do with lots of small changes.

zouhair2• 9 years ago

We are living all secret police's wet dream.

salesguy22213• 9 years ago

Though I wish it were different, I can't help but feel that this truly is game over. The statists have won. The technology is too powerful, they're too easily able to afford it, and the public can't do much to stop it

tn134• 9 years ago

One of the simple ways to fix this is to by simply starving the beast. Constantly demanding lower taxes. In fact a constitutional amendment to limit US government's spending to may be 15% of GDP.

Once US government is faced with either wage a war in country X under the pretense of WMD or Zombie virus or spend on public education I think we will see some sanity. But the war mongering right and welfare mongering on left will not let that pass.

stuckagain• 9 years ago

I don't fall for your both-sides-do-it framing. Fact is that the other side had power and didn't do it. Now we have insane cheetoh in office and we're getting insane cheetoh policy ideas. This is not a matter of equivalence.

okreallywtf2• 9 years ago

Agreed, I came up with analogy that I intend to use whenever false equivalencies are used to try to scuttle an argument: there is a massive difference between going 65 (mph) in a 60 and 110 in a 60. While both are illegal, you can not use one to justify the other. We can have high standards and expect them to be met but if we cannot tell the difference in scale between two actions we are doomed.

Inconel• 9 years ago

I'm not really sure I agree with that analogy. My primary problem with it stems from the fact that current policies don't exist independently of previous policies.

I agree that on a scale of badness, Trump certainly seems worse to me than Obama.

But in your analogy it isn't so much that Trump took a car from zero to 110 in a 60 zone. The car he got in was already speeding thanks to the policies of the Obama administration, and prior administrations. I don't think pointing this out is necessarily excusing it through false equivalence.

So while I agree that it's important to tell the difference in scale, I think it's equally important to realize that in most cases these policies don't come about out of thin air, they are built and extended from prior policies.

icebraining5• 9 years ago

Actually, this idea comes from the time of the previous administration: https://www.nytimes.com/2016/06/29/us/homeland-security-soci...

conistonwater4• 9 years ago

From your own link, this was the previous proposal:

Visitors entering the country under the Visa Waiver Program, which allows citizens of some countries to visit up to 90 days without a visa, would not be required to list their social media accounts, and the forms would not ask for passwords.
The department said that while it does not consistently examine social media accounts of applicants for visas or immigration, it has a list of nearly three dozen situations in which social media can be examined to screen applicants.

They say they didn't ask for passwords, which is the main objection, and also said it was optional (see also the same thing in this very article). How does it make sense to call it the same idea?

salesguy22213• 9 years ago

While I am not a defender of insane cheetoh, the article itself says the Obama administration (but more importantly, the officials that work for the admin in every agency) crafted these initial ideas around social media affecting immigration

Regardless of party, I would invite you to google the following governmental overreaches and then see which parties were in office:

The Pirate Bay raid, NATO bombing of Yugoslavia, NSA surveillance revelations, Superpredators, War on Drugs, War on Crime...

kobayashi• 9 years ago

NATO bombing of Yugoslavia

One of these things is not like the others

devwastaken• 9 years ago

The NSA and mass data collection and the overall technology was massively developed by the previous administration. Both sides do it, its the same evil done in different ways.

salesguy22213• 9 years ago

Thank you for stating this. It is important to realize IMO that some very deeply moneyed interests in the US beleive in massive surveillance.

If they didn't, then it wouldn't be happening from both parties

UnoriginalGuy3• 9 years ago

Everything about this came under Obama.

I actually wrote in protesting this policy over a year ago when they proposed it. It has nothing at all to do with Trump.

salesguy22213• 9 years ago

besides the fact that his administration will enforce it? haha

both parties are guilty. if trump doesn't want to enforce it, he wouldn't. if obama admin didn't want to brainstorm it, they wouldn't have

belorn• 9 years ago

4 years ago the 9th Circuit Appeals Court ruled over a court case regarding DHS searching phone and laptops at the border, including demanding passwords to unlock said devices.

The concept is so old that not only did both side do it, but the previous administration has a court case judged against them. What we should say to the current administration is what the court said to the previous, which is that the 4th amendment applies at the border (https://www.techdirt.com/articles/20130308/13380622263/9th-c...). Password for social media, as with password to unlock the address book of a phone, cannot be demanded without reasonable suspicion.

zouhair2• 9 years ago

That's the thing. the other side didn't have power. If you think Obama was "the other" side you are quite naive.

kristopolous• 9 years ago

There's a deeper industrial surveillance state at work. I thought that was the core insight of Snowden's work - was that it's not all tinfoil crazy talk.

salesguy22213• 9 years ago

You are exactly right. Some people here might be employed in this line of work, and that's why the engage in fingerpointing and "we're different" :)

dang• 9 years ago

Please don't post inflammatory political rhetoric to HN. It lowers signal, raises noise, and triggers flamewars. You probably have a good point in there, but the Molotov cocktail is not an acceptable delivery mechanism.

We detached this subthread from https://news.ycombinator.com/item?id=13626479 and marked it off-topic.

marklyon• 9 years ago

They did get it kicked off, though, by adding the questions to the form.

nodesocket3• 9 years ago

I am failing to see how providing your Facebook password provides any legitimate confirmation about you and your associations. You can easily create a fake Facebook profile with your picture, fake posts, fake friends, fake everything.

The internet is a cesspool of people who troll, create fake profiles, invoke reactions, behave completely different than they would on the streets, and intentionally hide their identity. Using it as a primary source of identity verification is a terrible idea.

Why not require proof of a financial statement? Bank account in your name, or a process to verify somebody via their bank account without requiring their bank account password.

pier253• 9 years ago

It's just as ridiculous as those forms you are asked to fill when entering the US as a foreigner.

For example:

Do you seek to engage in terrorist activities while in the United States?

jackweirdy• 9 years ago

Another example of an absurd question like that was one I was asked when I was applying for my visa; along the lines of "are you planning to commit espionage for another country against the United States". I assume they do it so they can pin you for perjury as well was whatever crime you committed should you turn out to be a spy. But it's just so absurd when asked deadpan like that.

couchand• 9 years ago

Sure that question is dumb, but it's not at all comparable to forcing you to turn over a password. Why would you make that false equivalence?

greglindahl2• 9 years ago

They're just getting you to incriminate yourself. The standard of proof for excluding someone for lying on the forms is quite different from convicting them of an actual terrorism-related crime.

rdtsc• 9 years ago

The reason for those is to then quickly provide a way to invalidate their visa and have an administratively easy path to kick them out without having to go to court and such. Terrorist activities doesn't mean blowing things up, it could be open to all kinds of interpretation (donated money to some organization, protested and was arrested for rioting, went to a black-hat conference which had talks about subverting security systems of power plants etc, etc).

roywiggins3• 9 years ago

Those are just to make people easily deportable if they're found to have lied.

icebraining5• 9 years ago

Sure, you can provide a fake profile. And then they'll find out your real one (Facebook will certainly be compelled to help out) and you're now guilty of lying to the border officials, and probably banned for a long time, if not for life.

nodesocket3• 9 years ago

How would they discover you provided a fake profile in the first place? Sure they might be able to catch a percentage of people, but not nearly all of them.

rocky1138• 9 years ago

Do we really need the USA anyway? What is honestly being lost if we're banned?

MichaelGG4• 9 years ago

It won't be primary. A surprising number of people post dumb things, or even talk about their plans to violate their visa conditions while in line for entry. This'll catch a lot of mundane violations, like folks planning on working or permanently residing in the country while claiming they're just visiting for a week. It's very intrusive and I'm against it, but it will be quite effective.

Most people aren't gonna create fake profiles. Or if they do, they'll be suspiciously empty. If someone is gonna go through that effort to get entry they probably can just refrain from posting their plans online in the first place.

llukas• 9 years ago

You really think there won't be industry of creating and maintaining fake profiles?

Cyph0n3• 9 years ago

It's very intrusive and I'm against it, but it will be quite effective.

It will be effective initially, but people will catch wind of this and start to purge their Facebook profiles prior to entry. I'm certain that cheap online "Facebook cleaning" services will start to pop up very soon.

jacques_chester3• 9 years ago

You can easily create a fake Facebook profile with your picture, fake posts, fake friends, fake everything.

Perjuring yourself to a border agent is inadvisable. The legal threat follows you whether or not you are granted or denied entry. At any time, it may be discovered and lead to very serious criminal and administrative consequences.

If you simply refuse to give over the password, they can refuse entry. But they can't necessarily treat you as an actual criminal.

It is never a good idea to lie to, mislead or interfere with law enforcement officers. If you are having trouble, get a lawyer as quickly as you can.

Speaking of which: I am not a lawyer and consequently this is not legal advice.

jboles• 9 years ago

There is no legal obligation to be truthful in what one places on their Facebook profile, however, so it's not perjuring. You can out on whatever you like and it's up to the border agent to make of it whatever they will.

tn134• 9 years ago

They will make you sign a document that would be something like

"I confirm under penalty of perjury that this is the only social media account I have." Later when the government wants to target you specifically they will point out that you had also owned an Orkut account which you had failed to disclose. Bam! you have to leave the country.

smb06• 9 years ago

All of that (identifiable info such as bank accounts or other docs) is already required when you are applying for the visa in the first place

ylecuyer• 9 years ago

What happens if I have 2FA enables?

differentView3• 9 years ago

First, you and your devices will be held for hours while they go through your accounts and devices. Then they'll require you to disable 2FA.

MichaelGG4• 9 years ago

Yeah the best approach, the one I use when crossing, is to encrypt everything, then send part of the password to someone else who won't give it to me until later. They can steal your hardware, I guess.

greglindahl2• 9 years ago

That probably only works if you're entering a country that you're a citizen of, and not otherwise.

BTW, legally speaking by US law, it's a lot easier to force someone to give up their thumbprint than a password. So whatever you do, don't go through an American border with touch-id unlocking your phone.

privong• 9 years ago

This has been discussed several times in the past few days:

https://news.ycombinator.com/item?id=13600704

https://news.ycombinator.com/item?id=13598505

hefeweizen• 9 years ago

In addition to other points against this measure, there are massive privacy implications. Loads of people could be reusing passwords or may reuse keywords for multiple passwords. A collection of such data by an organization can and will be misused.

Tharre• 9 years ago

What if I don't have any social media accounts? Do the officials just assume I'm lying and deny me entry?

This is insanity.

x0x0• 9 years ago

You know what's better? Other countries will follow our lead and demand the same. Particularly of American visitors. And why should they not?

adventured2• 9 years ago

You act like that's some kind of revelation. Countries such as France, Britain, Germany, Sweden, the Netherlands, Australia, India, Russia and China are already on par with or beyond the US when it comes to abusive domestic espionage.

skewart• 9 years ago

This was one of my first thoughts too. I deleted my Facebook account years ago. I almost never use Twitter. Would a border person believe me? Would I seem sketchy? Should I create a new Facebook account and post something banal every few weeks just so I can travel with peace of mind? That does seem insane.

I can only assume this threat of asking visitors to grant government agencies complete and unfettered access to their online accounts was conceived by people who don't know how the internet works. There are just so many logistical problems with it at so many levels that it's hard to imagine it ever working in practice.

x1798DE• 9 years ago

Alternatively, what if you do have such accounts and don't know the passwords? I keep all my passwords in a password manager, and if I'm crossing a border, I'm probably going to make sure I can't access it until after I'm across.

I'll guessing the right thing to do, if you know about this requirement, is to set up a Facebook account specifically for this purpose, then right before you cross a border, change its password to something easy to remember.

roywiggins3• 9 years ago

They'll make you sign something that asserts you don't have any other social media accounts, and now you've lied to a federal agent, oops.

oskarth• 9 years ago

Considering how the NSA probably has access to this already, what does this mean? A few options off the top of my head. Not putting any probabilities on these, but it's interesting to think about. The options are neither exhaustive nor exclusive.

(a) NSA info is drying up due to resistance from companies

(b) NSA info can't be shared due to low-priority targets

(d) NSA info can be shared, but only to people of a certain clearance, which makes this non-scalable for ports of entry

(e) NSA info can be shared but the goal of the policy isn't info, it's signaling

salesguy22213• 9 years ago

I would say everything except option (a). additionally, it's possible that data streams are drying up into the NSA (i dont think they are), but the NSA already has enough to incriminate literally every human on earth for any petty thoughtcrime

most likely, I say, is that the data in NSA Utah is basically like a walled off test dev that only a few special people can query for currently important things. their main job is to determine how best to query it in the future

and then each agency maintains a prod database of its own data its collected to oppress everyone. very rarely would they ever get NSA data

Cyph0n3• 9 years ago

but the NSA already has enough to incriminate literally every human on earth for any petty thoughtcrime

I think that you are slightly overestimating how much the NSA can achieve with current technologies.

jacques_chester3• 9 years ago

My hunch is that this is less about the technical ability to access data and more about adding another legally-defensible way to reject people they want to reject for other reasons.

The NSA is probably already cahooting with the CBP for selected cases.

simplemath2• 9 years ago

This is as good a time as any to stop using social media.

ben0x539• 9 years ago

I hope other countries introduce that requirement for US-based travelers too, that'd probably be the quickest way to get the US to knock it off.

adventured2• 9 years ago

Most other countries have been thrilled to abuse their own people when it comes to espionage. So no, they'll jump right on board, gladly. Not primarily to punish the US, but because it's a perfect excuse to expand their existing spying programs.

natch• 9 years ago

If they get a person's password, the largest privacy violation is not to that person. It's to all that person's friends and family who shared private material.

We can discuss all we want whether it was wise for anyone to share, say, everyday normal photos of their children or themselves on Facebook.

If you think they shouldn't have shared normal, everyday, family photos on an online service, sure, fine, I don't know what to say. But let's say they did do so, which is pretty normal.

Are they entitled to some privacy from whatever pervs the DHS hires?

Remember "they" is the friends and family of the person visiting the US, not the person themselves.

Many of these friends and family will be US citizens, so arguments about differing rights for non-citizens, whether valid or invalid with respect to privacy rights, don't necessarily apply in those cases.

tn134• 9 years ago

US citizens must thank the founding fathers for all the amendments else the feds would have treated all of us just like this.These wannabe immigrants have 0 rights or voting power so they are being treated like complete shit.

The way US government treats legal immigrants, they might as well ask them to bring a lube and drop pants and bend over at the immigration check. This comment might seem crass but it is nowhere close to the crassness with which US government has come to treat people who are going through all the ridiculous legal hoops and in process making criminals out of perfectly ordinary people.

This is like having a super complex CAPTCHA on your signup page for humans while letting bots pass through by some minor cookie manipulation.

zitterbewegung• 9 years ago

I don't have a Facebook account so will I be let in the country?

differentView3• 9 years ago

Depends how much the border officer likes you.

matt_wulfeck• 9 years ago

I hope that we can keep this issue "apartisan", because the importance absolutely transcends past or future political affiliation. What has become "reasonable" is slowly but surely come to mean "what we can get away with".

lechevalierd3on2• 9 years ago

Wouldn't two factor make this irrelevant?

jewbacca• 9 years ago

A state actor wouldn't even break a sweat getting around 2FA, individually or at scale, if the 2nd factor involves SMS (or the phone system in general) (which, for 99% percent of the 1% of people using it, it currently does):

https://en.wikipedia.org/wiki/Dishfire

It's not even out of the question for malicious private actors who don't have total control over the whole system:

https://krebsonsecurity.com/2016/09/the-limits-of-sms-for-2-...

differentView3• 9 years ago

Yes, those people will simply be denied entry.

tptacek• 9 years ago

No, because if you refuse to help them access your account, they will detain or turn you back.

dbg314153• 9 years ago

Look, as much as we all get up in arms about this... total access to my email, calendar, and contacts were required to play Pokemon Go. I hate it, but until people starting taking privacy seriously, what is an appropriate response? The encroachments are everywhere and so prevalent (and people are so dulled) that nobody bats an eye when "the authority" (or just someone who seems mildly trustworthy) asks for things they shouldn't ask for.

If you offer to help a stranger fix something on their laptop, what percentage do you think would just tell you that their password is their kids' middle name -- and how many do you think would use the same password on their Gmail and bank accounts? The fact that so few people take privacy and security seriously is enraging; it's hard to go from enraged to outraged when most people don't even bother protecting themselves.

It's all so infuriating.

romanows• 9 years ago

Yikes, was that on an iPhone? I'm not seeing permissions to read email or calendar content on the Android version. It does have permissions to read your contacts.

dbg314153• 9 years ago

* Pokémon Go shouldn’t have full access to your Gmail, Docs and Google account — but it does | TechCrunch || https://techcrunch.com/2016/07/11/pokemon-go-shouldnt-have-f...

Got fixed I think... but how many people cared?

Every try and roll out 2FA for an office and get the majority of people -- C-level folks included -- griping and giving pushback that they hate it because now they have to do one more tinsy little thing to sign in? After a while it's just sort of like... "Well... you've been warned you should care more about security, you have been given every opportunity to learn about how technology works, and bottom line I don't really care about your privacy if you don't..."

It's so frustrating is all I'm saying.

curriedbits2• 9 years ago

Maybe if they change this to an app that was required for entry, instead of turning over passwords.

dbg314153• 9 years ago

How far off do you think we are from that? It'll be here within 5 years. To get a visa, you have to have the visa pre-scan app that requires every account you own to share data with it. They'll run that through some magic black box and it'll show the TSA's glorified mall cops a green or red light when you walk up to the scanner.

Fucking terrifying, and 99.9% of the people won't bat an eye before logging in. Thought policing is "for national security." That same percentage of people would be ok with the government raping their own mother if it was for national security.

This is all so damn frustrating.

irishcoffee3• 9 years ago

If you put it on the internet, it isn't private. There really isn't a debate to be had about this.

I think requiring passwords for social media is fucking stupid. Really, really stupid.

People who expects to have "privacy on the internet" are also fucking stupid. Yes, this includes facebook, twitter, instagram, email, et. al.

If you wan't to keep a secret, don't tell anyone. If you put something "private" on the internet, you've ostensibly told 3-4 billion people.

trendia• 9 years ago

If you put it on the internet, it isn't private.

Access to social media accounts includes access to private communications, e.g. messages that were sent with the understanding that only the recipient would receive it.

But those nudes your girlfriend sent you are now in the hands of an immigration agent working in the name of "border security".

irishcoffee3• 9 years ago

Yeah, and those nudes are also visible on whatever server they're stored on, with whatever rootkit is installed on it, or to whatever bored employee decides to look at them. Or to the jackass who saw you looking at your phone and took a picture, or the asshole who rooted your girlfriends phone, or the neighbor who hopped on your wireless router and guessed your "test12" password. God forbid anyone uses their phone to sign onto a public wifi somewhere, don't even get me started on that.

It is very foolish to consider anything, sent across any digital medium "private" in any sense.

pfooti• 9 years ago

I wonder if this includes google accounts (since you know, google plus).

I mean, the whole notion is horrific and abysmal, but in today's OAUTH world you're not just giving up the facebook goods, you're giving up co-logins to lots of other sites too. There's other technical issues too - I use 2FA everywhere. So, do I disable the 2FA or have to give that up too? In perpetuity? I mean, I don't trust law enforcement to not go around murdering people, why should they have access to passwords?

The very thought or suggestion that this could someday happen would make me cancel any and all trips to the US for the foreseeable future (if I weren't already a US citizen who lived here, that is, and as it is I'm seriously considering emigrating in response to this administration).

The brain drain effects will have to be enormous. There's already a company focused on helping startups use Vancouver to base their remote employees. [0]

On so many levels this is bad. I'd heard the notion floated under the Obama administration, but I trusted them to be adult and see all the possible ramifications. I do not trust the Trump administration to even be in the neighborhood of rational, let alone adult. I mean, they dumped the immigration executive order with no actual warning whatsoever (besides repeatedly saying he'd do just that, I suppose). So now we have no real choice but to take them at their word.

0: https://techvibes.com/2017/02/01/true-north-establish-vancou...

PakG1• 9 years ago

Here's the question I want answered. How does this type of thinking affect the future of Snapchat. The future of Signal is easy to predict. Back door. Snapchat? This type of thinking seems like an existential threat to Snapchat.

westmeal• 9 years ago

Easy fix: Delete your Facebook and Twitter accounts.

dahart4• 9 years ago

I saw a video interview with the CEO of Hotspot shield vpn the other day, he had a quote ready that went something like 'The first 3 companies to hit 1 billion users did it by selling private information, the next 3 are going to make it by protecting private information.'

I wrote it off as a nice sound bite, but maybe he's right...

Hey I'm sure I'm not the only one to think of this, but to everyone trying to build the next social network, how about putting in a feature where a second password will open your scrubbed profile? You'd choose what goes in from your main account, and not have to build entirely fake accounts. There's a way to get some quick traction, should the Trump administration succeed at making a policy of asking for passwords!

mistersquid2• 9 years ago

Perhaps I'm not understanding something. Why wouldn't an information-hungry regime simply ask for both passwords given that this would be a known feature?

dahart4• 9 years ago

Plausible deniability.

averagewall• 9 years ago

Those travelers would be violating their FaceBook ToS:

"You will not share your password (or in the case of developers, your secret key), let anyone else access your account, or do anything else that might jeopardize the security of your account." [1]

Perhaps this would give FaceBook the power to intervene and, well block their account or something.

[1] https://www.facebook.com/terms

otterley3• 9 years ago

Any term in contract that is contradictory to law is null and void. That's been in contract law since forever.

The law always trumps contracts.

DiabloD32• 9 years ago

IANAL, but even though this is true, Facebook could still ban accounts for complying.

They are a US company, and their TOS says they can ban an account for any reason or no reason at all. If they chose to ban anyone who shares passwords, even with the US government, even if they are Americans or not, they are within their rights as a US company to do so.

Hondor• 9 years ago

Is it really law though, or just an option? Don't give your password and don't enter.

jackjeff• 9 years ago

I heard you can have password hundreds of characters long for Facebook... it'd be nice to have some long random gibberish impossible to type or maybe the full text of the 4th amendment to remind these people that what they do is against the constitution.

PS. password managers mean you won't suffer the same inconvenience.

Passwords for social media accounts could be required for some to enter country

Related Stories