The implementation looks sound, and it's easy to use. Props to Agile Bits for making this feature a priority.
So this is great! -- I think. My only concern is that if the authorities are already suspicious of you, and find no password vaults (or practically nothing in your password vault), they may just detain you until you reveal what you haven't disclosed to them.
There's clearly a technical solution to the problem of protecting data across borders but they do not work so well under duress. Is there any technical way to convince an adversary you are not hiding anything else or did not delete something?
Instead of removing the password data off the device, replace it with "junk" data.
"Low security" accounts that you wouldn't mind the "adversaries" having, sacrificial accounts, or even just a randomly generated selection of fake passwords for a selection of accounts, etc...
It still won't fully protect you (obviously a "targeted" adversary would know that you have an account at "X" with "Y" username and the password in your vault doesn't work
for that so tie him up!), but being able to hand over something when being questioned might be better than nothing for some.
Definitely not great. It would create much more suspicion to have 1Password installed and not to have any data on it. Just uninstall 1Password before travel and re install it back after customs. Travel mode is a way worse solution.
Empty/useless vaults aren't any better. Even if you went to the lengths of creating fake social profiles and adding their passwords to your fake vault, that's not any better either.
> If you have a guilty conscience that is going to manifest itself in your body language and mannerisms.
More than once, the customs officer has asked me "you don't look people in the eye, do you?" I just say, "no, I don't." (They're apparently happy with that answer.)
So you can be questioned without having a guilty conscience; I just look down a lot.
Being anxious is something you can work on. Business secrets are perfectly legal to carry across a border. Not wanting the TSA to look at your shit is something I can understand.
I'd basically tell them to fuck off (in a more diplomatic sense) until it reached the point of being either blocked entirely from traveling or detainment. At that point you gotta ask yourself if the juice is worth the squeeze and turn back or play their game.
Also this is more than just an issue with the Trump administration and the TSA... I don't travel to Canada any longer due to the treatment I have received at the border there.
10 years ago I was working in Canada; couple of friends and I (Australian, British and Québécois) decided to go and ski in Montana for a few days. We had a few beers on the way down and stopped just before customs to drop off open cans before we crossed the border. Being 11pm, we were the only people at the crossing. As we circled round they decided something wasn't right (probably justified although not in their jurisdiction) - 4 hours later we were allowed into the US having been fingerprinted and our car searched on a ramp for what I assume was explosives or drugs.
3 days later we returned to the border travelling the other direction - the CBSA officer looked at the cover of all three different nations' passports before saying "I'm sure there's a visa in there somewhere, have a nice day."
So this is great! -- I think. My only concern is that if the authorities are already suspicious of you, and find no password vaults (or practically nothing in your password vault), they may just detain you until you reveal what you haven't disclosed to them.
There's clearly a technical solution to the problem of protecting data across borders but they do not work so well under duress. Is there any technical way to convince an adversary you are not hiding anything else or did not delete something?