How to protect your phone or computer when crossing borders

Border agents have broad powers to search people crossing borders, including their phones and laptops.But there are ways to protect your data when crossing international borders if you understand the technology and the law.

-/-

US Customs and Border Protection (CBP) agents are responsible for enforcing immigration laws and preventing the entry of criminals. Courts have so far ruled that they are allowed to search your devices for any reason or no reason at all. You might get flagged for a device search because there is something wrong with your travel documents, your name is in a law enforcement database, or you were simply chosen for random search.

There are two levels of search, according to the CBP policy on device searches. A basic search is a simple inspection of your data, including your apps, photos, chats, and other files. An advanced search involves using external equipment to access files (including deleted data), copy data, and analyze it. CBP agents need to have reasonable suspicion of a crime or violation, or a national security concern and supervisor approval.

Agents can also “detain” your device for a “reasonable period of time” while they extract your data, copy it, or attempt to break your passwords or encryption.

https://protonmail.com/blog/border-crossing-protect-electronics/

Paramedic agrees Apple Watch Series 4 will save lives, false positives not a problem

Paramedic agrees Apple Watch Series 4 will save lives, false positives not a problem

When owners in other countries will get to enjoy the benefits of the ECG functionality is very much unknown. It could likely take years in Europe, but there is a chance that Apple took a short-cut approach which could see it happening far sooner than expected.

https://9to5mac.com/2018/10/09/paramedic/

’Do Not Track,’ the Privacy Tool Used By Millions of People, Doesn’t Do Anything

When you go into the privacy settings on your browser, there’s a little option there to turn on the ”Do Not Track” function, which will send an invisible request on your behalf to all the websites you visit telling them not to track you.

-/-

Yahoo and Twitter initially said they would respect it, only to later abandon it. The most popular sites on the internet, from Google and Facebook to Pornhub and xHamster, never honored it in the first place.

-/-

From the department of irony, Google’s Chrome browser offers users the ability to turn off tracking, but Google itself doesn’t honor the request, a fact Google added to its support page some time in the last year. […] ”It is, in many respects, a failed experiment,” said Jonathan Mayer, an assistant computer science professor at Princeton University. ”There’s a question of whether it’s time to declare failure, move on, and withdraw the feature from web browsers.” That’s a big deal coming from Mayer: He spent four years of his life helping to bring Do Not Track into existence in the first place.

https://it.slashdot.org/story/18/10/16/2234235/do-not-track-the-privacy-tool-used-by-millions-of-people-doesnt-do-anything

Krönika: Ett smutsigt slut för internets största spökstad

Trots miljardinvesteringar, tvångsanslutning av alla Gmail-användare och sju år, fick Google aldrig sitt sociala nätverk Google+ att lyfta. När nu nätverket stängs ner är det efter att användarnas integritet hotats p g a säkerhetshål.

-/-

Men anledningen att Google äntligen ger Google+ silkessnöret är allvarligt. I mars i år upptäcktes ett säkerhetshål som gjorde en halv miljon användarnas privata uppgifter tillgänglig för vänner och tredjepartsappar. Att avslöja ett allvarligt säkerhetshål ett halvår efter upptäckten, efter att Wall Street Journal avslöjat säkerhetshålet, hade varit allvarligt brott mot GDPR som trädde i kraft två månader efter läckan. Sannolikt blir de också stämda i USA.

https://www.jajja.com/jajja-magazine/ett-smutsigt-slut-for-internets-storsta-spokstad/

Skydda datorn mot nätfiskeförsök och andra former av onlinebedrägerier

https://support.office.com/sv-se/article/skydda-datorn-mot-n%C3%A4tfiskef%C3%B6rs%C3%B6k-och-andra-former-av-onlinebedr%C3%A4gerier-be0de46a-29cd-4c59-aaaf-136cf177d593

https är inte lika med säker domän

https kan misstolkas som Säker

Det betyder egentligen endast att trafiken är krypterad, och det är i sig bra! Men det betyder inte att du har fått en krypterad förbindelse med den du tänkt dig.

Domännamn = omkring sista punkten före snedstreck

Det registreras tusentals med certifikat som krypterar kommunikationen med sajter som ser exakt likadana ut som den du tänkt besöka men adressen är inte exakt utan endast snarlik.
Du går till den domän som står före och efter den sista punkten och innan ett eventuellt snedstreck.

Exempel på falska domäner;

  1. servicesonline-americanexpress.com
    Det är inte en punkt innan americanexpress.com.
    Hela adressen är domänen men man kan tro att det är servicesonline hos American Express
  2. dropbox.com.login.verify.danaharperandfriends.com
    Det är inget snedstreck efter dropbox.com.
    Domänen är danaharperandfriends.com
  3. login-appleid.com-direct-apple.com
    Det är inte en punkt innan appleid.com och det är inte heller något snedstreck efter appleid.com.
    Domänen är com-direct-apple.com

Vissa internet-program visar i svart det som är själva domännamnet. Alla program ger också möjlighet att se vem certifikatet är utställt till, vanligen genom att klicka på hängläset.

Mer om falska certifikat hos Netcraft, https://toolbar.netcraft.com/stats/certificate_authorities.

Google Chrome skriver inte längre att en sajt är säker bara för att den har https. https://blogg.loopia.se/tag/google-chrome/.

Put your trust in green certificates. They are Extended Validated!

Extended validated server certificates may be shown as a green address. They are expected whe the transactions you do with the site is extra valuable, eg banking and health businesses.

An EV Certificate is a quite new type of certificate that is designed to prevent phishing attacks better than normal SSL certificates An SSL Certificate Provider has to do some extensive validation to give you one including:

  • Verifying that your organization is legally registered and active
  • Verifying the address and phone number of your organization
  • Verifying that your organization has exclusive right to use the domain specified in the EV Certificate
  • Verifying that the person ordering the certificate has been authorized by the organization
  • Verifying that your organization is not on any government blacklists

EV Certificate image at sslshopper.com

https://www.sslshopper.com/cheapest-ev-ssl-certificates.html

It is even better if the Certificate Provider is one that can be trusted.

How to Send Messages in Private – use Signal

There are many times when you want to have a chat in private, such as when you have something confidential to say or you simply don’t want the world listening in. Hey, that’s what social media’s for!

-/-

Encryption is simply a means of converting text into a jumble of letters and numbers that’s unreadable to anyone without the key to unlock it. If only you and the receiver have the key, then only the two of you can get access to your private message, and not the messaging service or anyone else. This is known as ”end-to-end encryption.”

-/-

If you’d like an easy way to use secure, end-to-end encrypted messaging, we highly recommend Signal. It’s free, open source, and available from the iPhone and Android app stores. Not only that, it also allows you to make secure voice calls.

https://spreadprivacy.com/how-to-send-private-messages/